CN117493220A - RPA flow operation abnormity detection method, device and storage device - Google Patents
RPA flow operation abnormity detection method, device and storage device Download PDFInfo
- Publication number
- CN117493220A CN117493220A CN202410004130.6A CN202410004130A CN117493220A CN 117493220 A CN117493220 A CN 117493220A CN 202410004130 A CN202410004130 A CN 202410004130A CN 117493220 A CN117493220 A CN 117493220A
- Authority
- CN
- China
- Prior art keywords
- rpa
- template sequence
- training
- key
- operation key
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 53
- 238000003860 storage Methods 0.000 title claims abstract description 14
- 238000012549 training Methods 0.000 claims abstract description 65
- 238000000034 method Methods 0.000 claims abstract description 46
- 230000005856 abnormality Effects 0.000 claims abstract description 26
- 238000009826 distribution Methods 0.000 claims abstract description 17
- 238000012545 processing Methods 0.000 claims abstract description 11
- 238000003825 pressing Methods 0.000 claims abstract description 8
- 238000004422 calculation algorithm Methods 0.000 claims abstract description 5
- 238000013473 artificial intelligence Methods 0.000 claims abstract description 4
- 230000002159 abnormal effect Effects 0.000 claims description 26
- 230000008569 process Effects 0.000 claims description 24
- 230000006870 function Effects 0.000 claims description 19
- 238000003062 neural network model Methods 0.000 claims description 16
- 238000012360 testing method Methods 0.000 claims description 10
- 230000004048 modification Effects 0.000 claims description 4
- 238000012986 modification Methods 0.000 claims description 4
- 238000013528 artificial neural network Methods 0.000 abstract description 3
- 230000009286 beneficial effect Effects 0.000 abstract description 3
- 239000010410 layer Substances 0.000 description 13
- 238000004458 analytical method Methods 0.000 description 7
- 238000010586 diagram Methods 0.000 description 5
- 238000004519 manufacturing process Methods 0.000 description 5
- 230000008859 change Effects 0.000 description 4
- 238000004364 calculation method Methods 0.000 description 2
- 238000003745 diagnosis Methods 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 238000004801 process automation Methods 0.000 description 2
- 238000011112 process operation Methods 0.000 description 2
- 230000000903 blocking effect Effects 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000000605 extraction Methods 0.000 description 1
- 230000008676 import Effects 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000014759 maintenance of location Effects 0.000 description 1
- 230000000306 recurrent effect Effects 0.000 description 1
- 230000009467 reduction Effects 0.000 description 1
- 230000000717 retained effect Effects 0.000 description 1
- 238000004088 simulation Methods 0.000 description 1
- 239000002356 single layer Substances 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/36—Preventing errors by testing or debugging software
- G06F11/3668—Software testing
- G06F11/3672—Test management
- G06F11/3688—Test management for test execution, e.g. scheduling of test suites
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/044—Recurrent networks, e.g. Hopfield networks
- G06N3/0442—Recurrent networks, e.g. Hopfield networks characterised by memory or gating, e.g. long short-term memory [LSTM] or gated recurrent units [GRU]
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q10/00—Administration; Management
- G06Q10/10—Office automation; Time management
- G06Q10/103—Workflow collaboration or project management
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
- Y02P—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN THE PRODUCTION OR PROCESSING OF GOODS
- Y02P90/00—Enabling technologies with a potential contribution to greenhouse gas [GHG] emissions mitigation
- Y02P90/02—Total factory control, e.g. smart factories, flexible manufacturing systems [FMS] or integrated manufacturing systems [IMS]
Abstract
The invention provides a method, equipment and storage equipment for detecting an operation abnormality of an RPA (remote procedure), which relate to the technical field of RPA procedures and are used for preparing RPA operation procedure use cases in an enterprise asset library; pressing an operation key to extract an operation template sequence of training data; setting the length of a window, and sequentially extracting training data from each operation template sequence through a sliding window according to a certain step length to obtain a training set; training a neural network by using a training set and combining an artificial intelligence algorithm, accessing a fully connected network layer after training, and outputting probability distribution of all operation keys which are possibly correctly output after softmax function processing; taking an RPA operation flow use case to be detected, and pressing an operation key to extract an operation template sequence of a detection sample; and loading the trained model, and sequentially detecting the abnormality of the operation template sequence through a sliding window. The beneficial effects of the invention are as follows: the invention has real-time performance and accuracy.
Description
Technical Field
The present invention relates to the technical field of RPA processes, and in particular, to a method, an apparatus, and a storage device for detecting an operation abnormality of an RPA process.
Background
The robotic process automation (Robotic Process Automation, RPA) technology enables a series of fixed process operations to be performed manually by means of machines that effectively replace human resources, such as: the operation requirements of users on various software such as system application, browser, office software and the like are simulated and completed, but the traditional RPA use case production needs a certain computer language and operation basis, and the complicated templated instruction codes of the traditional RPA use case production needs to be familiar with the RPA production software. In order to be more suitable for users without programming foundation, a recording module is introduced by a plurality of RPA manufacturers at present, and the function is that the user can automatically generate corresponding RPA flow automatic codes and reproduce the operation of the user only by operating the function once according to the normal working flow, so that the use threshold of RPA software is greatly reduced, the user does not need to be familiar with operation instructions under various applications, and the RPA software is more suitable for popularization.
When the existing RPA recording function module is started to be used, the recording function is initialized firstly, including the initialization of detecting mouse keyboard information, high-frequency screen capturing and double-buffer initialization. After initialization is completed, allowing a user to start recording operation, recording user operation in real time in the user operation process, automatically analyzing detection information of the recording operation after the user confirms that recording is completed, generating an operation code block suitable for RPA software, and repeating the original operation flow after the user imports the corresponding code block. The RPA recording function module has higher requirements on recording operation, so that not only can the operation steps not be excessive, but also the operation environment is required to be smooth enough, but in most enterprise working scenes, the workflow required by a user to complete a task is complex and lengthy, and even various working software needs to be continuously switched. Therefore, in an actual production environment, the RPA recording functional module is affected by operating environment differences (different versions of an operating system or a browser, inconsistent certain related settings of the system, popup windows caused by automatic pushing and installation of patch plug-ins at a certain period of time, etc.), abnormal application (application program interruption or blocking due to network, etc., a certain page of a website is not opened or abnormal reporting errors occur in application, etc.), abnormal business (difference between test sample data and real business data) and abnormal operation in an operation code block automatically generated by RPA software can be caused. In the existing RPA technology, only the situation when an abnormality occurs in the RPA flow is considered, and redundant operation possibly occurring in the RPA flow generated by the recording function module is not considered, so that the flow is not simplified, the calculation complexity is high, enterprise resources are wasted, and the enterprise cost is increased; and during the process of extracting the video frames, some important context information may be lost, resulting in reduced accuracy of the matching result. And a large number of RPA assets are usually mastered in an enterprise, and abnormal operation detection by manpower is practically infeasible, so that how to reasonably combine AI to perform automatic abnormal operation detection is a key attention direction for helping enterprises reduce cost and increase efficiency.
Disclosure of Invention
In order to solve the problems, the invention provides a method, equipment and storage equipment for detecting the operation abnormality of an RPA flow, which simultaneously consider two problem scenes of abnormality and redundancy, evaluate each step of operation generated by an RPA recording function module through a pre-training model, and remind a user of abnormality if the generation step is different from an operation list obtained by the pre-training model; in addition, through the mode of analyzing and extracting the operation template sequence, the overall calculation complexity is reduced, and the problems that the operation environments of different users are different and cannot be matched can be avoided, for example: the different versions of the browser cause great difference of element layout in the browser, and the abnormal detection mode of the video frames is too sensitive to the change of the video frames, so that the problem of incapability of matching possibly occurs; finally, the invention also considers the abnormal false alarm condition, allows the user to feed back aiming at the false alarm operation, feeds the false alarm RPA whole operation flow back to the training set as the supplementary training data to train the model in real time, so that the trained model is more suitable for different business scenes of enterprises, and the accuracy of abnormal detection is improved.
An RPA process operation anomaly detection method, comprising:
s1: preparing RPA operation flow use cases in an enterprise asset library;
s2: extracting an operation template sequence by pressing an operation key on an RPA operation flow example;
s3: setting the window length, and sequentially carrying out sliding window on the operation template sequence according to a preset step length to extract training data so as to obtain a training set;
s4: training a neural network model by using a training set and combining an artificial intelligence algorithm, accessing a fully connected network layer after training, and outputting probability distribution of all operation keys which are possibly correctly output after softmax function processing;
s5: taking an RPA operation flow use case to be detected, and pressing an operation key to extract an operation template sequence of the RPA to be detected;
s6: and (3) loading the trained neural network model, sequentially carrying out anomaly detection on the operation template sequence of the RPA to be detected corresponding to each operation key through a sliding window by combining the probability distribution obtained in the step (S4), judging whether the current operation is abnormal or not, and if so, feeding back to a user for modification.
Further, in step S2, the process of extracting the operation template sequence of the training data is as follows:
s2.1: reading the selected RPA operation flow use case;
s2.2: and analyzing the selected RPA operation flow use case, extracting an operation template sequence of the RPA flow, wherein the operation template sequence comprises operation contents, an operation key set and order information of the operation keys, and vectorizing and representing each operation key by adopting One-Hot independent coding.
Further, the specific process of step S3 is as follows:
s3.1: after analyzing the RPA operation flow use cases into operation keys, the operation template sequence designates an execution path which reflects the specific execution sequence of the RPA operation flow use cases;
s3.2: setting the length of a window, and sequentially extracting training data from an operation template sequence of each operation key through a sliding window according to a preset step length;
s3.3: the training data are combined to obtain a training set.
Further, in step S4, the neural network model includes a plurality of hidden layers, each hidden layer corresponds to h expanded LSTM blocks, each LSTM block corresponds to an input operation template sequence one by one, and h is a window length;
each LSTM block has three gate functions: the input door is used for determining the influence degree of the input of the current time step on the hidden state vector, the forgetting door is used for determining the information quantity to be reserved in the hidden state vector of the previous step, and the output door is used for determining the information quantity to be output to the next layer in the hidden state vector of the previous step.
Further, the process of training the neural network model is as follows:
s4.1: to maximize the probability of the next key operation of the training data, the probability distribution is learned，k i Represents the ith operation key, T t An operation key indicated at position t in the sequence of operation templates,/->Representation ofTime constant T t Taking the ith operation key k i Probability of time->Representation->Operation key T for analyzing next operation without changing t =k i Times T of (1) t =k i An operation key T representing the mth training data at position T t Namely k i ，/>Representing the training set as belonging toThe number of examples of such cases;
s4.2: according to learningProbability distribution of arrival to operate key at position t-jHidden state vector from previous step->As input, individual LSTM blocks are processed in combination with gate functions and weight variables, j=1, 2,..h, h being the window length;
cell state vector output after LSTM block processingAnd hidden state vector->As a new input into the LSTM block of the next time step;
wherein,indicate->Layer hiding layer, p E {1,2, …, h 1 }，h 1 Representing the number of LSTM blocks, p representing the p-th LSTM block;
s4.3: and processing the LSTM blocks one by one according to the steps S4.1-S4.2 to obtain the trained neural network model.
Further, in step S6, the abnormality detection process is as follows:
s6.1: extracting a detection set X from an operation template sequence of RPA to be detected according to a preset step length in sequence by the set window length h test =[x 1 ,x 2 ,…,x q ,…,x v-h ]And Y test =[y 1 ,y 2 ,…,y q, …,y v-h ]Wherein v-h represents the total number of detection samples, v represents the total number of operation contents of analyzing RPA operation flow use cases to be detected, and x q And y q Representing the q-th detection sample, h representing the window length;
s6.2: to detect y q ={T t If the input operation key is abnormal, taking an operation template sequence w=x of RPA to be detected q ={T t-h ,…,T t-2 ,T t-1 Detection as input template sequence of neural network model, T t-j Representing an operation key at position t-j in the operation template sequence w, j=1, 2, …, h;
s6.3: calculating a topN template set with the highest probability for each detection sample, if the detection sample belongs to the topN template set, the input operation key is normal, otherwise, the input operation key is abnormal;
s6.4: obtaining conditional probability distribution in descending order of probability by anomaly detection, when y m ={T t An operation key T at position T in the operation template sequence w t Belonging to a set of a plurality of operation keys with the highest probabilityAnd if the operation is normal, prompting the user that the operation is abnormal.
The technical scheme provided by the invention has the beneficial effects that: according to the technical scheme provided by the invention, RPA operation is analyzed into an operation template sequence, and the operation template sequence obtained after analysis is utilized to refer to a specific operation flow trend. The invention has real-time performance: in the abnormality detection process, when an abnormality exists, the user can be fed back to the user in time, and corresponding diagnosis comments are provided, and when the user feeds back that the abnormality is misinformation, the RPA use case can be used as a marked record to update the abnormality detection model in an increment mode so as to merge and adapt to a new mode; the invention also has the accuracy: the invention can carry out reasoning detection on the rest of most use cases only by using a small part of representative use cases which can be normally used in part of RPA software, has good performance on accuracy, and has universality and effectiveness.
Drawings
FIG. 1 is a flow chart of a method for detecting an operation anomaly of an RPA flow in an embodiment of the invention;
FIG. 2 is a schematic diagram of extracting training data through a sliding window for each sequence of operation keys in an embodiment of the present invention;
FIG. 3 is a schematic diagram of a neural network model in an embodiment of the invention;
FIG. 4 is a schematic diagram of anomaly detection in an embodiment of the present invention;
FIG. 5 is a schematic diagram of the operation of a hardware device in an embodiment of the invention.
Detailed Description
For a clearer understanding of technical features, objects and effects of the present invention, a detailed description of embodiments of the present invention will be made with reference to the accompanying drawings.
The invention provides a method, equipment and storage equipment for detecting the operation abnormality of an RPA flow,
s1: it should be noted that, in this embodiment, the RPA operation procedure use case used as the training sample must be able to run normally.
S2: the RPA operation flow is used for extracting an operation template sequence by pressing an operation key, namely RPA operation instruction analysis is carried out, and taking the content of the table 1 as an example, one RPA operation flow comprises three operations described in the table, and the operation template sequence is [1,2 and 3] according to the flow executed in the sequence listed in the table. The operation template sequence is actually an ordered array formed by a plurality of operation keys (obtained by analysis operation), and the sequence of the operation keys represents the sequence of the actual RPA flow operation execution.
The specific process of step S2 is as follows:
s2.1: reading the selected RPA operation flow use case;
s2.2: the operation template sequence of the RPA flow is extracted by analyzing the selected RPA operation flow use case, the operation template sequence comprises operation content, an operation key set and order information of the operation keys, and the operation key set is set as K= { K 1 ,k 2 ,…,k i ,…,k n }，k i The i-th operation key is represented, i=1, 2,..n, n is a positive integer, and each operation key is represented in a vectorization manner by using One-Hot independent coding. RPA operation actually refers to an operation made by a simulation person under different environments such as application or operating system, for example, operation on txt text is only open, closed, add-delete-and-modify-check for RPA applicationAnd the limited operation, therefore, the operation content is limited, and the corresponding operation keys are limited; for a set of RPA operation flows, the operation keys that resolve the set are also limited according to the program's finite (the program's execution time is limited, an algorithm must guarantee that execution ends after a finite step). Therefore, in RPA software, the code format in the software corresponding to various artificial operations is relatively fixed, for example: in the instruction of opening the specified workbook, "opening the workbook in Excel object" is fixed, only v_excel is variable, and the set of operation keys outputted after parsing the data and extracting the operation template sequence is limited, as shown in table 1:
table 1 data analysis
S3: setting the window length, and sequentially carrying out sliding window on the operation template sequence according to a preset step length to extract training data so as to obtain a training set; as shown in fig. 2, the window length h=10, the step size s=1, and training data is extracted sequentially for the operation template sequence through a sliding window. The training data can be obtained by sliding the window once, and the training data can be combined to obtain a training set; the window length can be adjusted according to actual conditions. The specific implementation steps of the step S3 are as follows:
s3.1: after the RPA operation flow use case is analyzed into the operation key, the operation template sequence designates an execution path which reflects the specific execution sequence of the RPA operation flow use case; taking table 1 as an example, an RPA operation procedure includes three operations described in the table, and the procedure is performed in the order listed in the table, and the operation template sequence is [1,2,3]. The corresponding operation execution sequence is to open the workbook, read the cells, and close the workbook.
S3.2: as shown in fig. 2, setting a window length h=10, and sequentially extracting training data from the operation template sequence of each operation key through a sliding window according to a step length s=1; let training set be X train =[x 1 ,x 2 ,…,x m ,…,x u-h ]And Y train =[y 1 ,y 2 ,…,y m, …,y u-h ]Wherein u-h represents the total number of training data, u represents the total number of operation contents for analyzing the RPA operation flow use case, and x m ={T t-h ,…,T t-j ,…,T t-2 ,T t-1 }(j=1,2,…,h)，y m ={T t The m-th training data, where h represents the window length, T t-j Representing the operation key at position T-j in the sequence of operation templates, j=1, 2, …, h, T t Representing an operation key at position T in the sequence of operation templates, T t It is possible to take any one of n operation keys in the operation key set K, and the taken value strongly depends on T t Previous operation keys;
s4: training a neural network (LSTM network) model shown in figure 3 by using a training set and combining an artificial intelligence algorithm, accessing a fully connected network layer after training, and outputting probability distribution of all operation keys which are possibly correctly output after softmax function processing; the specific process of the step is as follows:
s4.1: given an operation template sequence, training an LSTM network model, and setting k i E, K represents the set of operation keys, K i Representing the ith operating key by learning the probability distributionLet k i The probability of the next log key expected as training data sequence is maximized, +.>Represents { T ] t-h ,…,T t-2 ,T t-1 T when not changed t Taking the ith operation key k i Probability of time, T t =k i Represents x m ={T t-h ,…,T t-2 ,T t-1 Operation key T at next position T t Namely k i ；/>Represents { T ] t-h ,…,T t-2 ,T t-1 Operation key for next operation analysis without changeT t =k i Is>Representing that the training set belongs to { T ] t-h ,…,T t-2 ,T t-1 Number of examples of this case, T t Representing an operation key at position t in the sequence of operation templates.
The above operation is to process { T } t-h ,…,T t-2 ,T t-1 T in case of coincidence t In different situations, for example, after opening an excel file and selecting an A1 cell, the next step may be copying content or pasting content, and the overall formula actually refers to how much probability that the next operation Tt is copying or pasting is respectively, and whether the copying or pasting operation is k on the premise that two operations of { opening an excel file and selecting an A1 cell } are unchanged i ∈K。
S4.1.1: as shown in fig. 3, taking only two hidden layers as an example, each LSTM block of the first hidden layer corresponds to the input operation template sequence one by one, so that the single layer corresponds to h expanded LSTM blocks;
s4.1.2: cell state vector generated after LSTM block processingHidden vector +.>As a new input into the LSTM block of the next time step, and +.>Will also be passed into the corresponding next layer LSTM block, where +.>The hidden layer of the model setting is shown,pe {1,2, …, h }, predicts the operating key T at position T t Relative to the first position before the predicted position tpA step position;
s4.2: for a single LSTM block, the key is operated as inputHidden vector output from previous stepTraining is performed by combining a gate function and a weight variable, and training rules are as follows: (1) Cell state vector->Cell state vector relative to the previous step +.>Is a degree of retention of (2); (2) How to change cell state vector->The method comprises the steps of carrying out a first treatment on the surface of the (3) How to construct the output hidden state vector +.>；
LSTM is a recurrent neural network that can process sequence data and has memory capabilities. In LSTM, the hidden state vector is stored in the cell state vector, which is a weighted sum of the previous hidden state vector and the current time step input vector. Each LSTM block has three gate functions: an input gate, a forget gate, and an output gate. These gate functions determine how to change the cell state vector and construct the hidden vector of the output. Specifically, the input gate determines the extent to which the input vector of the current time step affects the hidden state. The forget gate determines the amount of information that needs to be retained in the hidden state vector of the previous step. The output gate determines the amount of information in the previous hidden state vector that needs to be output to the next layer. By using these gate functions and weight variables, the LSTM block can decide how to change the cell state vector and how to construct the output hidden state vector. Thus, the LSTM can retain important information and forget unimportant information when processing sequence data.
S4.2.1: during training, the weight variables of the neural network model are appropriately distributed and pass through the gradientIncrementally updating these weight variables in a falling manner, ensuring that the final LSTM sequence output is the correct operation key k given a particular operation template sequence i The probability of (2) is the largest;
s4.2.2: after LSTM training is completed, the LSTM training is connected to a fully connected network layer (FC), and after softmax function processing, probability distribution of all operation keys which are possibly correctly output is outputThe method comprises the steps of carrying out a first treatment on the surface of the Probability distribution of output->Representing all correct operation keys and corresponding probabilities generated by a user under the training model condition and the current step in the operation recording process, if the operation key actually generated after the user operation is not in the probability distribution +.>In the front topN operation keys, the abnormality is reminded. The topN is a preset value, namely, the front topN operation keys with the highest possibility are taken.
S5: taking an RPA operation flow use case to be detected, and pressing an operation key to extract an operation template sequence w of the RPA to be detected;
in the invention, steps S1-S4 are all training stages in practice; step S5 is an initial step of actual operation performed by a specific user in a production environment, and analysis and extraction are performed on RPA operation flow generated by the user in the production environment as test content, which is applied to a subsequent detection stage.
S6: as shown in fig. 4, the trained neural network model is loaded, the operation template sequences corresponding to the operation keys are sequentially subjected to abnormality detection through the sliding window, when the operation is abnormal, the operation template sequences are fed back to the user for modification, and if the detected abnormality is misinformation, the neural network model is used as a marked record to update the abnormality detection model in fig. 4 in an incremental manner. The method comprises the following steps:
s6.1: extracting a detection set X from the sequence of each operation key according to the step length s=1 through the set window length h test And Y test The method comprises the steps of carrying out a first treatment on the surface of the Set X test =[x 1 ,x 2 ,…,x q ,…,x v-h ]And Y test =[y 1 ,y 2 ,…,y q, …,y v-h ]Wherein v represents the total number of operation contents of the analysis and detection RPA operation flow use case;
s6.2: to detect y q ={T t If the input operation key is abnormal, taking an operation template sequence w=x of RPA to be detected q ={T t-h ,…,T t-2 ,T t-1 Detecting as an input template sequence } (j=1, 2, …, h);
s6.3: and calculating a topN template set with the highest probability for each detection sample, if the detection sample belongs to the topN template set, the input operation key is normal, and otherwise, the input operation key is abnormal.
S6.4: using w as the input template sequence, a conditional probability distribution in descending order of probability size is obtained by anomaly detection, e.g., { k in FIG. 4 27 :0.8316,k 36 0.1137, … }, when y q ={T t An operation key T at position T in the operation template sequence w t Belongs to the front topN operation key setsAnd if the operation is normal, prompting the user that the operation is abnormal. As shown in fig. 4, it is assumed that topn=2, < > is>= {27,36}, if y 1 =27, belonging to->Indicating normal operation if it does not belong toAn operation abnormality is indicated.
Because the environments of the RPA software used by users are quite different, when training data is selected, the selected data is required to normally run under different application environments, and the requirements of no redundant operation and enough representativeness are required to be met as much as possible.
The size of the training set is influenced by the size and scale of the RPA operation flow example actually selected by the enterprise, and is also influenced by the window length in the step S3, and the too long window length can lead to a more generalized training result, but can lead to a reduction of training samples, and possibly reduce the reliability of the result; and too short a window length is prone to over-fitting. Therefore, a suitable window length needs to be selected.
The operation key set is a finite set, and by parsing the RPA into operation keys, the sequence of operation templates reflects an execution path that can reflect the specific execution order of the RPA.
After the new RPA operation flow use case is analyzed into an operation template sequence, checking whether the operation template sequence is normal or not through an abnormality detection model, and if the operation template sequence is abnormal, warning a user of a specific abnormal point to allow the user to manually modify; if the user misreports the detected anomaly, it is used as a marked record to incrementally update the anomaly detection model to incorporate and adapt to the new pattern.
Referring to fig. 5, fig. 5 is a schematic working diagram of a hardware device according to an embodiment of the present invention, where the hardware device specifically includes: an RPA flow operation anomaly detection device 501, a processor 502, and a storage device 503.
An RPA flow operation abnormality detection apparatus 501: the RPA flow operation anomaly detection device 501 implements the RPA flow operation anomaly detection method.
The processor 502: the processor 502 loads and executes instructions and data in the storage device 503 to implement the RPA flow operation anomaly detection method.
Storage device 503: the storage device 503 stores instructions and data; the storage device 503 is configured to implement the method for detecting an operation anomaly of an RPA procedure.
The beneficial effects of the invention are as follows: according to the technical scheme provided by the invention, RPA operation is analyzed into an operation template sequence, and the operation template sequence obtained after analysis is utilized to refer to a specific operation flow trend. The invention has real-time performance: in the abnormality detection process, when an abnormality exists, the user can be fed back to the user in time, and corresponding diagnosis comments are provided, and when the user feeds back that the abnormality is misinformation, the RPA use case can be used as a marked record to update the abnormality detection model in an increment mode so as to merge and adapt to a new mode; the invention also has the accuracy: the invention can carry out reasoning detection on the rest of most use cases only by using a small part of representative use cases which can be normally used in part of RPA software, has good performance on accuracy, and has universality and effectiveness.
The foregoing description of the preferred embodiments of the invention is not intended to limit the invention to the precise form disclosed, and any such modifications, equivalents, and alternatives falling within the spirit and scope of the invention are intended to be included within the scope of the invention.
Claims (8)
1. The RPA flow operation abnormality detection method is characterized in that: comprising the following steps:
s1: preparing RPA operation flow use cases in an enterprise asset library;
s2: extracting an operation template sequence by pressing an operation key on an RPA operation flow example;
s3: setting the window length, and sequentially carrying out sliding window on the operation template sequence according to a preset step length to extract training data so as to obtain a training set;
s4: training a neural network model by using a training set and combining an artificial intelligence algorithm, accessing a fully connected network layer after training, and outputting probability distribution of all operation keys which are possibly correctly output after softmax function processing;
s5: taking an RPA operation flow use case to be detected, and pressing an operation key to extract an operation template sequence of the RPA to be detected;
s6: and (3) loading the trained neural network model, sequentially carrying out anomaly detection on the operation template sequence of the RPA to be detected through a sliding window by combining the probability distribution obtained in the step (S4), judging whether the current operation is abnormal or not, and if so, feeding back to a user for modification.
2. The method for detecting the abnormal operation of the RPA process as claimed in claim 1, wherein: in step S2, the process of extracting the operation template sequence of the training data is as follows:
s2.1: reading the selected RPA operation flow use case;
s2.2: and analyzing the selected RPA operation flow use case, extracting an operation template sequence of the RPA flow, wherein the operation template sequence comprises operation contents, an operation key set and order information of the operation keys, and vectorizing and representing each operation key by adopting One-Hot independent coding.
3. The method for detecting the abnormal operation of the RPA process as claimed in claim 2, wherein: the specific process of step S3 is as follows:
s3.1: after analyzing the RPA operation flow use cases into operation keys, the operation template sequence designates an execution path which reflects the specific execution sequence of the RPA operation flow use cases;
s3.2: setting the length of a window, and sequentially extracting training data from an operation template sequence of each operation key through a sliding window according to a preset step length;
s3.3: the training data are combined to obtain a training set.
4. A method for detecting an operational anomaly in an RPA process as claimed in claim 3, wherein: in step S4, the neural network model comprises a plurality of hidden layers, each hidden layer corresponds to h expanded LSTM blocks, each LSTM block corresponds to an input operation template sequence one by one, and h is the window length; each LSTM block has three gate functions: the input door is used for determining the influence degree of the input of the current time step on the hidden state vector, the forgetting door is used for determining the information quantity to be reserved in the hidden state vector of the previous step, and the output door is used for determining the information quantity to be output to the next layer in the hidden state vector of the previous step.
5. The method for detecting an operation anomaly of an RPA process as claimed in claim 4, wherein: the process of training the neural network model is as follows:
s4.1: to trainMaximizing probability of next operation key of training data and learning probability distribution，k i Represents the ith operation key, T t An operation key indicated at position t in the sequence of operation templates,/->Representation ofTime constant T t Taking the ith operation key k i Probability of time->Representation->Operation key T for analyzing next operation without changing t =k i Times T of (1) t =k i An operation key T representing the mth training data at position T t Namely k i ，/>Representing the training set as belonging toThe number of examples of such cases;
s4.2: according to probability distribution, to operate keys at positions t-jHidden state vector from previous step->As input, individual LSTM blocks are processed in combination with gate functions and weight variables, j=1, 2,..h, h being the window length;
cell state vector output after LSTM block processingAnd hidden state vector->As a new input into the LSTM block of the next time step;
wherein,indicate->Layer hiding layer, p E {1,2, …, h 1 }，h 1 Representing the number of LSTM blocks, p representing the p-th LSTM block;
s4.3: and processing the LSTM blocks one by one according to the steps S4.1-S4.2 to obtain the trained neural network model.
6. The method for detecting the abnormal operation of the RPA process as claimed in claim 1, wherein: in step S6, the abnormality detection process is as follows:
s6.1: extracting a detection set X from an operation template sequence of RPA to be detected according to a preset step length by means of the set window length test =[x 1 ,x 2 ,…,x q ,…,x v-h ]And Y test =[y 1 ,y 2 ,…,y q, …,y v-h ]Wherein v-h represents the total number of detection samples, v represents the total number of operation contents of analyzing RPA operation flow use cases to be detected, and x q And y q Representing the q-th detection sample, h representing the window length;
s6.2: to detect y q ={T t If the input operation key is abnormal, taking an operation template sequence w=x of RPA to be detected q ={T t-h ,…,T t-2 ,T t-1 Detection as input template sequence of neural network model, T t-j Representing an operation key at position t-j in the operation template sequence w, j=1, 2, …, h;
s6.3: calculating a topN template set with the highest probability for each detection sample, if the detection sample belongs to the topN template set, the input operation key is normal, otherwise, the input operation key is abnormal;
s6.4: obtaining conditional probability distribution in descending order of probability by anomaly detection, when y q ={T t An operation key T at position T in the operation template sequence w t Belonging to a set of a plurality of operation keys with the highest probabilityAnd if the operation is normal, prompting the user that the operation is abnormal.
7. A memory device, characterized by: the storage device stores instructions and data for implementing the RPA flow operation anomaly detection method according to any one of claims 1 to 6.
8. An RPA flow operation anomaly detection device, characterized in that: comprising the following steps: a processor and a storage device; the processor loads and executes the instructions and data in the storage device to implement the RPA flow operation anomaly detection method according to any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410004130.6A CN117493220B (en) | 2024-01-03 | 2024-01-03 | RPA flow operation abnormity detection method, device and storage device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202410004130.6A CN117493220B (en) | 2024-01-03 | 2024-01-03 | RPA flow operation abnormity detection method, device and storage device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN117493220A true CN117493220A (en) | 2024-02-02 |
| CN117493220B CN117493220B (en) | 2024-03-26 |
Family
ID=89674814
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202410004130.6A Active CN117493220B (en) | 2024-01-03 | 2024-01-03 | RPA flow operation abnormity detection method, device and storage device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN117493220B (en) |
Citations (19)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190379589A1 (en) * | 2018-06-12 | 2019-12-12 | Ciena Corporation | Pattern detection in time-series data |
| CN111209168A (en) * | 2020-01-14 | 2020-05-29 | 中国人民解放军陆军炮兵防空兵学院郑州校区 | Log sequence anomaly detection framework based on nLSTM-self attention |
| JP2020144909A (en) * | 2017-06-05 | 2020-09-10 | 株式会社日立製作所 | Operation support system and method |
| CN112052233A (en) * | 2020-08-11 | 2020-12-08 | 杭州电子科技大学 | Multi-angle business process abnormity online detection method based on context awareness |
| CN112416732A (en) * | 2021-01-20 | 2021-02-26 | 国能信控互联技术有限公司 | Hidden Markov model-based data acquisition operation anomaly detection method |
| WO2021126757A1 (en) * | 2019-12-20 | 2021-06-24 | UiPath, Inc. | System and computer-implemented method for analyzing test automation workflow of robotic process automation (rpa) |
| US20220180160A1 (en) * | 2019-03-27 | 2022-06-09 | Tdk Corporation | Outlier detection device, outlier detection method, and outlier detection program |
| CN114819553A (en) * | 2022-04-11 | 2022-07-29 | 平安科技（深圳）有限公司 | Dynamic configuration method, device, equipment and storage medium based on workflow engine |
| CN115221137A (en) * | 2022-06-24 | 2022-10-21 | 山东科技大学 | Flow log identification method based on gated recurrent neural network internal state interpretation |
| US20220374700A1 (en) * | 2021-05-21 | 2022-11-24 | Adp, Llc | Time-Series Anomaly Detection Via Deep Learning |
| WO2023015843A1 (en) * | 2021-08-13 | 2023-02-16 | 上海商汤智能科技有限公司 | Anomaly detection method and apparatus, electronic device, computer readable storage medium, computer program, and computer program product |
| US20230061829A1 (en) * | 2021-09-02 | 2023-03-02 | Hitachi, Ltd. | Outlier detection apparatus and method |
| CN115878003A (en) * | 2022-11-28 | 2023-03-31 | 中科曙光南京研究院有限公司 | RPA webpage operation automation method and system based on Transformer |
| CN116049757A (en) * | 2023-04-03 | 2023-05-02 | 湖南工商大学 | Flow abnormal behavior detection method based on concept drift |
| US20230133373A1 (en) * | 2021-11-04 | 2023-05-04 | UiPath, Inc. | Building and managing artificial intelligence flows using long-running workflows for robotic process automation |
| CN116383096A (en) * | 2023-06-06 | 2023-07-04 | 安徽思高智能科技有限公司 | Micro-service system anomaly detection method and device based on multi-index time sequence prediction |
| CN116542507A (en) * | 2023-03-03 | 2023-08-04 | 阿里巴巴（中国）有限公司 | Process abnormality detection method, electronic device, computer storage medium, and program product |
| US20230353516A1 (en) * | 2022-04-29 | 2023-11-02 | Truist Bank | User interaction artificial intelligence chat engine for integration of automated machine generated responses |
| CN117314140A (en) * | 2023-08-07 | 2023-12-29 | 安徽思高智能科技有限公司 | RPA process mining method and device based on event relation extraction |
-
2024
- 2024-01-03 CN CN202410004130.6A patent/CN117493220B/en active Active
Patent Citations (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2020144909A (en) * | 2017-06-05 | 2020-09-10 | 株式会社日立製作所 | Operation support system and method |
| US20190379589A1 (en) * | 2018-06-12 | 2019-12-12 | Ciena Corporation | Pattern detection in time-series data |
| US20220180160A1 (en) * | 2019-03-27 | 2022-06-09 | Tdk Corporation | Outlier detection device, outlier detection method, and outlier detection program |
| WO2021126757A1 (en) * | 2019-12-20 | 2021-06-24 | UiPath, Inc. | System and computer-implemented method for analyzing test automation workflow of robotic process automation (rpa) |
| CN114830156A (en) * | 2019-12-20 | 2022-07-29 | 尤帕斯公司 | System and computer-implemented method for analyzing test automation workflows for Robotic Process Automation (RPA) |
| CN111209168A (en) * | 2020-01-14 | 2020-05-29 | 中国人民解放军陆军炮兵防空兵学院郑州校区 | Log sequence anomaly detection framework based on nLSTM-self attention |
| CN112052233A (en) * | 2020-08-11 | 2020-12-08 | 杭州电子科技大学 | Multi-angle business process abnormity online detection method based on context awareness |
| CN112416732A (en) * | 2021-01-20 | 2021-02-26 | 国能信控互联技术有限公司 | Hidden Markov model-based data acquisition operation anomaly detection method |
| US20220374700A1 (en) * | 2021-05-21 | 2022-11-24 | Adp, Llc | Time-Series Anomaly Detection Via Deep Learning |
| WO2023015843A1 (en) * | 2021-08-13 | 2023-02-16 | 上海商汤智能科技有限公司 | Anomaly detection method and apparatus, electronic device, computer readable storage medium, computer program, and computer program product |
| US20230061829A1 (en) * | 2021-09-02 | 2023-03-02 | Hitachi, Ltd. | Outlier detection apparatus and method |
| US20230133373A1 (en) * | 2021-11-04 | 2023-05-04 | UiPath, Inc. | Building and managing artificial intelligence flows using long-running workflows for robotic process automation |
| CN114819553A (en) * | 2022-04-11 | 2022-07-29 | 平安科技（深圳）有限公司 | Dynamic configuration method, device, equipment and storage medium based on workflow engine |
| US20230353516A1 (en) * | 2022-04-29 | 2023-11-02 | Truist Bank | User interaction artificial intelligence chat engine for integration of automated machine generated responses |
| CN115221137A (en) * | 2022-06-24 | 2022-10-21 | 山东科技大学 | Flow log identification method based on gated recurrent neural network internal state interpretation |
| CN115878003A (en) * | 2022-11-28 | 2023-03-31 | 中科曙光南京研究院有限公司 | RPA webpage operation automation method and system based on Transformer |
| CN116542507A (en) * | 2023-03-03 | 2023-08-04 | 阿里巴巴（中国）有限公司 | Process abnormality detection method, electronic device, computer storage medium, and program product |
| CN116049757A (en) * | 2023-04-03 | 2023-05-02 | 湖南工商大学 | Flow abnormal behavior detection method based on concept drift |
| CN116383096A (en) * | 2023-06-06 | 2023-07-04 | 安徽思高智能科技有限公司 | Micro-service system anomaly detection method and device based on multi-index time sequence prediction |
| CN117314140A (en) * | 2023-08-07 | 2023-12-29 | 安徽思高智能科技有限公司 | RPA process mining method and device based on event relation extraction |
Non-Patent Citations (1)
| Title |
|---|
| 刘虹: "基于 RPA技术的财务机器人应用研究", 河北青年管理干部学院学报, 15 March 2023 (2023-03-15), pages 74 - 77 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN117493220B (en) | 2024-03-26 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Rama-Maneiro et al. | Deep learning for predictive business process monitoring: Review and benchmark | |
| Yu et al. | Identifying self-admitted technical debts with jitterbug: A two-step approach | |
| CN112560036B (en) | C/C + + vulnerability static detection method based on neural network and deep learning | |
| US11443168B2 (en) | Log analysis system employing long short-term memory recurrent neural net works | |
| CN112202726B (en) | System anomaly detection method based on context sensing | |
| CN112508265A (en) | Time and activity multi-task prediction method and system for business process management | |
| CN111949535A (en) | Software defect prediction device and method based on open source community knowledge | |
| CN117390499A (en) | Be applied to multiple sample detecting system that food pesticide remained and detected | |
| CN113672931A (en) | Software vulnerability automatic detection method and device based on pre-training | |
| CN117236677A (en) | RPA process mining method and device based on event extraction | |
| CN113448843A (en) | Defect analysis-based image recognition software test data enhancement method and device | |
| CN115983087A (en) | Method for detecting time sequence data abnormity by combining attention mechanism and LSTM and terminal | |
| CN112527676A (en) | Model automation test method, device and storage medium | |
| Wu et al. | Multiscale jump testing and estimation under complex temporal dynamics | |
| CN110377910B (en) | Processing method, device, equipment and storage medium for table description | |
| Padberg et al. | Using machine learning for estimating the defect content after an inspection | |
| US20210349697A1 (en) | Smart code editor for detecting and visualizing deviations | |
| CN117493220B (en) | RPA flow operation abnormity detection method, device and storage device | |
| CN117596191A (en) | Power Internet of things abnormality detection method, device and storage medium | |
| CN116484025A (en) | Vulnerability knowledge graph construction method, vulnerability knowledge graph evaluation equipment and storage medium | |
| WO2023107207A1 (en) | Automated notebook completion using sequence-to-sequence transformer | |
| CN114297053A (en) | Software program safety detection method based on multi-layer perceptron smoothing | |
| CN112818658B (en) | Training method, classifying method, device and storage medium for text classification model | |
| Mahyari | A Hierarchical Deep Neural Network for Detecting Lines of Codes with Vulnerabilities | |
| US20240118889A1 (en) | Methods and systems for automated application development |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |