96results about How to "Improve Anomaly Detection Efficiency" patented technology

The invention discloses a large-data-flow-based network traffic abnormality detection system and method. The large-data-flow-based network traffic abnormality detection method is characterized by comprising the following steps: acquiring network packet information in network equipment in real time in a distributed manner; transmitting the network packet information to a distributed flow processing platform in real time for network data analysis, feature matching and access counting; storing the analyzed and detected network data into a large data platform according to an abnormal status so as to facilitate clustering analysis and classified training of the network data and dynamically update a network data protocol characteristic library. Through the system and the method, real-time detection is achieved through a distributed flow-type processing mechanism; through distributed storage of the large data platform and through the data calculating and analyzing capability, the distributed storage of the network data is achieved and the network data protocol characteristic library can be trained more accurately.

The invention provides LSTM (Long Short-Term Memory) based time sequence network anomaly detection method and device, and relates to the technical field of information security. The method comprises the following steps: acquiring an actual measured value of the to-be-detected network traffic; inputting the actual measured value of the to-be-detected network traffic into a LSTM based time sequencenetwork traffic prediction model, to obtain a predicted value of the to-be-detected network traffic; comparing the actual measured value of the to-be-detected network traffic with the predicted valueof the to-be-detected network traffic, to obtain an anomaly data detection result of the to-be-detected network traffic. The LSTM based time sequence network anomaly detection method provided by the invention can detect one-dimensional time sequence traffic data anomaly data and provide early warning in a large-scale network environment, thus improves the network anomaly detection efficiency, realizes a good effect of identifying network traffic anomaly, ensures relatively complete development fitting and can visually and obviously distinguish the anomaly information.

The invention belongs to the technical field of communication control and communication processing, and discloses an isolated forest-based binary classification abnormal point detection method and aninformation data processing terminal. The method comprises the steps of carrying out initial static average blocking on an original data set, and calculating the density in the block and the mean density; after calculating the density in each block of the static block, reducing the data set by taking the mean density of the original data set as a threshold value; constructing an isolated forest byusing a node recursion method; performing corresponding feature extraction and datamation on the original data set, and calculating the spatial position distances between the clustering center pointand other points; adding the abnormal score calculated on the basis of the density and the distance and the abnormal score calculated on the basis of the proof information and comparing with a corresponding threshold value. According to the method, the accuracy of an abnormal point detection algorithm is effectively improved, the actual data size in the abnormal detection process can be greatly reduced, the calculation resources are saved, and the abnormal detection efficiency is improved, and the robustness of an abnormal detection algorithm is enhanced.

The embodiment of the invention provides an anomaly detection method and device. The method comprises the following steps: acquiring the target time sequence data of a power grid system, and converting the target time sequence data to a first matrix; and inputting the first matrix to a pre-trained coding and decoding model to acquire a second matrix, calculating a first error of the second matrix with respect to the first matrix, and determining that the target time sequence data is the abnormal sequence data when the first error exceeds the preset error range. By adopting the anomaly detection method and device provided by the embodiment of the invention, the anomaly is detected by using the pre-trained coding and decoding model, and thus the manual workload in the anomaly detection of power systems can be reduced, and the efficiency of anomaly detection can be increased.

The embodiment of the invention discloses an anomaly detection method and device for an automatic driving test, computer equipment and a storage medium, and the method comprises the steps: simulatingan operation object to carry out the automatic driving of a virtual vehicle in scene data, so as to test an automatic driving program and obtain a test result, wherein the scene data is collected whena real vehicle drives on a road surface; querying a switching operation in the test result, wherein the switching operation indicates switching from the automatic driving mode to the manual driving mode and switching from the manual driving mode to the automatic driving mode; if the switching operations are the same, determining the switching operation as a target operation; determining the stateof the automatic driving program in the scene data of the target operation; and if the state is the abnormal state, positioning the factor of the target operation in the abnormal state according to the test result. Whether the test result of the automatic driving program in the real scene is abnormal or not is judged according to the state of the target operation, so that the anomaly detection efficiency and accuracy are improved.

The invention discloses a group abnormal behavior detection algorithm in a video. Firstly, a large amount of video image data is acquired as a training sample for analyzing and identifying groups anddetecting abnormal behaviors; secondly, a crowd density estimation model is trained by adopting a neural network based on hole convolution to obtain a video image crowd density map, and point clustering is performed on the density map in combination with a clustering method to obtain the position and the size of a group; thirdly, for all the anomaly detection video data sets, a feature extractionnetwork is used for extracting spatial and temporal features of the anomaly detection video data sets, input of a training neural network is obtained, training samples are input into a full-connectionneural network with set parameters, the neural network is trained until cost loss is reduced to a certain degree and the maximum number of iterations is achieved, and a trained model is obtained; andfinally, group information obtained by group identification is taken as a region of interest, spatial and temporal features of the test video are extracted, and the spatial and temporal features areinput into the trained anomaly detection model to obtain an anomaly detection score of the video.

The invention discloses an abnormity detection method and device for large-scale log data and a storage medium. The method comprises the steps: inputting a selected log sequence with a set length intoa pre-constructed machine learning prediction model, and outputting the conditional probability that each log template appears at a current position; screening the log templates according to the conditional probability of each log template to obtain a candidate log template set; analyzing the log to be detected to obtain a log template of the log to be detected; judging whether the log template corresponding to the to-be-detected log belongs to a candidate log template set or not, if yes, judging that the log is normal, and if not, judging that the log is abnormal. According to the method, probability distribution of occurrence of each log during large-scale log detection is considered, so that the efficiency of abnormity detection for large-scale log data is remarkably improved.

The invention relates to the field of system data monitoring, and discloses an anomaly detection method and device of an operation and maintenance management system, equipment and a storage medium. The method comprises: acquiring monitoring data of the operation and maintenance management system, wherein the monitoring data comprise time series data corresponding to multiple detection indexes; classifying the time series data corresponding to the detection indexes according to fast Fourier transform to obtain regularity indexes and non-regularity indexes; detecting the regularity index according to a time sequence anomaly detection algorithm so as to determine whether the regularity index is abnormal or not; and detecting the non-regularity index according to a time period segmentation method to determine whether the non-regularity index is abnormal or not; and carrying out anomaly detection on the operation and maintenance management system.

The embodiment of the invention provides a time series data anomaly detection method and device, electronic equipment and a storage medium, and aims to improve anomaly detection efficiency and/or detection accuracy. The anomaly detection method for the time series data comprises the steps of according to a preset period, segmenting the time series data to be detected, and obtaining time series data segments with the time length being the preset period length; collecting a time series data segment, performing encoding operation on the time series data segment to obtain an encoding result, and performing decoding operation on the encoding result to obtain a decoded data segment, the encoding operation and the decoding operation being used for generating decoded data consistent with the timeseries data based on periodic time series data; and comparing the time series data segment with the decoded data segment to determine whether the time series data segment is abnormal or not.

The invention discloses an abnormity detection method on the basis of non-negative matrix factorization, which comprises the following steps: preprocessing read hyperspectral images to obtain hyperspectral images which are subjected to noise removal; carrying out vector conversion on the obtained hyperspectral images which are subjected to noise removal so as to obtain a two-dimensional initialization matrix V; then carrying out linear decomposition on the two-dimensional initialization matrix V to generate a random initialization basis matrix W and a coefficient matrix H; according to a non-negative matrix factorization multiplicative algorithm, carrying out iteration on the random initialization basis matrix W and the coefficient matrix H to obtain hyperspectral images with a plurality of wave bands; finally, according to a local self-adaptive kernel density estimation operator, processing the hyperspectral images of which the wave band has the greatest quantity of abnormal information in the hyperspectral images with a plurality of wave bands so as to obtain images of which abnormal targets are detected. The invention also discloses an abnormity detection device on the basis of non-negative matrix factorization. By the abnormity detection method and the abnormity detection device on the basis of non-negative matrix factorization, a great quantity of redundant wave bands and noise information can be eliminated so as to effectively improve efficiency of abnormity detection.

The invention provides a dam safety monitoring data anomaly detection method based on unsupervised learning, and the method comprises the following steps: (1), obtaining to-be-detected time series data of a monitoring amount during the operation of a dam, carrying out the normalization processing of the collected to-be-detected time series data, performing rolling sampling on the normalized time sequence data to be detected by adopting a moving sliding window, and establishing a training sample data set and a test sample data set; (2) based on a training sample data set and a test sample data set long-short memory (LSTM) recurrent neural network regression prediction model, performing regression prediction on the to-be-detected time series data, and calculating a residual sequence of the to-be-detected time series data and the reconstructed sequence data; and (3) establishing an anomaly detection model based on an isolated forest (iForest) algorithm, and inputting the residual sequence into the anomaly detection model to complete real-time detection of the abnormal value of the dam monitoring data. According to the method, the problem of online intelligent identification of the abnormal value of the monitoring data in the dam safety monitoring real-time acquisition process can be solved, the method has high generalization ability and wide application range, the data types acquired by different sensors can be detected, and a large amount of data can be quickly processed.

The embodiment of the specification discloses an abnormal detection method, apparatus, device and system of an interface. The method comprises the following steps: receiving data of a target interfaceinstance sent by a query server, wherein the target interface instance is an instance obtained by converting the queried target call log by the query server; Detecting and analyzing the target interface instance according to a predetermined first interface detecting rule to obtain an intermediate detecting and analyzing result; Sending the intermediate detection analysis result to a second detection server so that the second detection server determines whether an abnormality has occurred on a target interface corresponding to the target interface instance based on the intermediate detection analysis result.

The invention provides an anomaly detection method and device. The anomaly detection method comprises the steps that fuzzy characteristic modes of a system call sequence are obtained and are added to a characteristic mode library, wherein the fuzzy characteristic modes include characteristic modes of a determination mode and a fuzzy mode, the determination mode represents the characteristic mode formed through multiple system calls according to a determination sequence, and the fuzzy mode represents the characteristic mode of a system call sequence; matching is conducted on system call sequences of a training set and the characteristic modes included in the characteristic mode library, and state sequences corresponding to the system call sequences of the training set are obtained according to rules corresponding to matching results; the state sequences are used for training a Markov model, and the trained Markov model is obtained; the anomaly of the system call sequences to be detected is detected by using the trained Markov model. By adopting the anomaly detection method and device, the problem that the number of recognizable mode types is small due to anomaly detection performed in determined characteristic modes in the related art is solved.

The invention provides an incremental track anomaly detection method based on incremental kernel principle component analysis, and belongs to the field of an incremental track anomaly detection method. The method comprises the following steps: to begin with, carrying out model initialization calculation, carrying out initial kernel feature space calculation through conventional Batch KPCA, and when M newly-increased track data comes, carrying out standardization on the M track data first; then, calculating kernel feature space of the newly-increased data through Batch KPCA; calculating average reconstruction error of the newly-increased data and training data, and if the error of the two is larger than a preset threshold value, using a follow-up kernel feature space division-merging method to update kernel feature space; then, carrying out projection on the updated kernel feature space and extracting a principal component; and finally, carrying out unsupervised learning and anomaly detection by utilizing a support vector machine. The advantages are that the method is superior to a conventional kernel principle component analysis method; computing complexity is reduced; and track anomaly detection efficiency is improved.

The invention discloses a transformer substation monitoring system based on edge computing. The system comprises an external monitoring device, an internal monitoring device, an acquisition device, aprocessing device, a judgment device, a storage device, a first alarm device and a supervision platform, and is characterized in that the external monitoring device is arranged outside a transformer substation monitoring point; the internal monitoring device is arranged in a transformer substation monitoring point; the acquisition device, the processing device, the judgment device, the storage device and the first alarm device are connected with one another and correspondingly arranged near a substation monitoring point; the processing device is used for preprocessing, matching and identifyingthe image data acquired by the external monitoring device; and the storage device is in wireless connection with the supervision platform, and the supervision platform comprises a database, a secondalarm device and a display terminal. High-quality image resources are obtained, detection and recognition of various different parts and defects are achieved, various factors of the transformer substation are comprehensively monitored, an alarm is given in time and backed up to a supervision platform, and the computing pressure of a cloud processing center is relieved.

The invention provides an industrial control equipment monitoring method and device, wherein the method comprises the steps: simulating and generating a plurality of virtual industrial control equipment, respectively obtaining the communication data of the virtual industrial control equipment and the industrial control equipment, carrying out the matching of the communication data with the pre-stored analysis data, generating a corresponding matching result, and when the abnormality of the matching result is detected, carrying out the monitoring of the industrial control equipment, and generating corresponding alarm information. According to the method and the device, the probability that the industrial control equipment is attacked is reduced by simulating and generating a plurality of virtual industrial control equipment, the communication data of the virtual industrial control equipment and the industrial control equipment are respectively acquired and are matched with the pre-stored analysis data, and the corresponding alarm information is generated when the communication data is detected to be abnormal, so that the abnormal detection efficiency of the industrial control equipment is improved, and the safety of the industrial control network is ensured.

The invention relates to a power consumption data anomaly detection method and device, computer equipment and a storage medium. The method comprises the steps of obtaining a power consumption data sequence; inputting the electricity consumption data sequence into a pre-constructed electricity consumption prediction model to obtain electricity consumption prediction data; determining a difference value between the electricity consumption prediction data and the electricity consumption real data, and if the difference value is greater than a preset threshold value, identifying the electricity consumption real data as candidate abnormal data; when the candidate abnormal data reaches a preset abnormal condition, determining that the current power consumption data abnormal detection result is in an abnormal state. According to the invention, the power consumption data sequence is identified through the pre-constructed power consumption prediction model to obtain the power consumption prediction data, whether the prediction data is abnormal data is identified according to the difference value between the prediction data and the real data, and when the abnormal data reaches the preset condition, generation of the abnormal detection result is triggered, so that the effect of detecting the abnormal power consumption data without manually marking the features is achieved, and the power consumption data anomaly detection efficiency is improved.

The invention discloses a template-oriented Word2vec-based log anomaly detection method and device, and the method comprises the following steps: carrying out the preprocessing of an original log, obtaining a log template, and carrying out the segmentation of the log template, so as to obtain a log sequence; solving a feature vector of the log template based on Word2vec, wherein the ID serial number of the log template is used as the input of the Word2vec; solving a feature vector of the log sequence according to the feature vector of the log template; and performing machine learning on the feature vector of the log sequence to obtain an anomaly detection model, and performing detection according to the anomaly detection model. Starting from a Word2vec processing object as a template, thescale of training data can be reduced. Moreover, the original log is preprocessed, and the time consumed by log anomaly detection is reduced through preprocessing so as to avoid affecting the final anomaly detection result.

The invention discloses a motion detecting method, a motion detecting device and a computer readable storage medium, which are applied to the field of smart cities. The method comprises the followingsteps: measuring first motion parameters of a robot, wherein the first motion parameters comprise linear speed and angular speed, and the linear speed is linear speed of a mass centre of the robot; utilizing the first motion parameters to calculate second motion parameters of the robot, wherein the second motion parameters comprise linear speed of a left front wheel of the robot and linear speed of a right front wheel of the robot; separately comparing the first motion parameters and the second motion parameters with a corresponding threshold range; and if any one of the first motion parameters and the second motion parameters is not within the corresponding threshold range, prompting first caution information. Multiple motion parameters of the robot are obtained by direct measurement andcalculation for judging whether the robot is in an abnormal motion state or not according to a condition whether any motion parameter of the robot is within the threshold range or not.

The embodiment of the invention provides a network anomaly detection method and device, relates to the technical field of the Internet, the method and the device are used for anomaly detection of a network system, and can improve the accuracy of anomaly detection. The method comprises the steps of obtaining multiple pieces of first log information of a target system in a first time period; whereinthe first log information is used for indicating the running state of the system; determining a target category corresponding to the first log information according to a classification algorithm; wherein the classification algorithm is used for classifying according to the distance and part-of-speech sequence of the first log information; if the different numbers of the target categories and theprediction categories are greater than a threshold value, determining that the target system is abnormal; wherein the prediction category is determined according to a prediction algorithm and a targetcategory corresponding to the first log information. The method is used for anomaly detection of the network system.

The embodiment of the invention provides an abnormal data detection method based on a time sequence. The abnormal data detection method comprises the steps: obtaining monitoring data of at least one first monitoring quantity and monitoring data of at least one second monitoring quantity; obtaining prediction of the second monitoring quantity based on a specific time series data prediction model and the monitoring data of the at least one first monitoring quantity; and if the monitoring data of the second monitoring quantity does not correspond to the prediction, determining that the monitoringdata of the second monitoring quantity is abnormal data. The method provided by the invention can improve the data exception detection efficiency. In addition, the embodiment of the invention provides an abnormal data detection device based on the time sequence, a medium and computing equipment.

The invention relates to a data processing technology, and discloses an anomaly detection method for a micro-service system. The method comprises the following steps: acquiring historical time seriesdata of an object monitoring index in the micro-service system, calculating a threshold parameter of the historical time series data, and performing anomaly detection on the acquired real-time time series data by using the threshold parameter to obtain anomaly detection data; determining a time consumption record of the exception detection data by utilizing a preset entrance service index, comparing the time consumption record with a preset time consumption record library to obtain a data exception frequency, sorting the data exception frequency according to a preset sorting rule, and outputting the sorted data exception frequency to obtain an exception detection result. In addition, the invention also relates to a blockchain technology, and the time-consuming record library can be storedin a node of a blockchain. The invention further provides an exception detection device of the micro-service system, electronic equipment and a computer readable storage medium. According to the invention, the problems of low anomaly detection efficiency and poor pertinence can be solved.

The invention provides a server anomaly detection method and device. The method comprises the steps that a video image for representing the state of a server is acquired; image recognition is performed on the video image; and if an anomaly of the server is recognized, the anomaly is handled. Since equipment can perform image recognition according to the acquired video image, through image recognition, whether the server is abnormal or not is automatically recognized, the type of the server anomaly is also automatically recognized, and the anomaly is automatically handled. Through the automaticand intelligent technology, server anomaly detection efficiency is greatly improved, and meanwhile user experience is greatly improved.