39results about How to "Improve anomaly detection performance" patented technology

The invention relates to a large-scale data abnormity detection method comprising the steps that A. data preprocessing and feature extraction are performed; B. hyperplane calculation based on twin support vector machines is performed, and a hyperplane standard function of partition data space is constructed; C. an isolation tree is formed: the isolation tree is established through the partition criterion of the hyperplane of the twin support vector machines; D. an isolation forest is formed: the step C is repeated, and multiple isolation trees are constructed so as to form the isolation forest; and E. the isolation forest is traversed and the abnormity score is calculated: the isolation forest is traversed through the data under abnormity detection and the abnormity score is calculated to act as the standard for judging the degree of abnormity score, and existence of the abnormal data in the original data is judged according to the standard. The detection data volume can be effectively reduced so that the calculation workload can be reduced, the abnormity detection accuracy can be enhanced without significant increasing of time consumption and the abnormity detection performance for the high dimensional data can be greatly enhanced.

The invention discloses a multi-region variable-scale 3D-HOF based surveillance video anomaly detection method, which comprises the steps of firstly acquiring surveillance video to serve as input, performing partition processing on the video, then extracting variable-scale 3D-HOF features and optical flow direction information entropy in each sub-region, combining the variable-scale 3D-HOF features and the optical flow direction information entropy into final detection features, finally learning an initial sparse combination set in each sub-region by using a sparse combination learning algorithm, judging whether the new data is abnormal or not through a reconstruction error, and updating the sparse combination set online by using normal data. The application of the invention not only solves a problem of perspective distortion existing in the surveillance video, but also makes full use of the difference of motion information in different optical flow amplitude intervals, and can acquiremore accurate moving speed information. The method disclosed by the invention is applicable to anomaly detection for the surveillance video, low in calculation complexity, accurate in detection result and good in algorithm robustness. The method has extensive applications in the technical field of video analysis.

An anomaly detection method of industrial control network signal based on depth learning structure relates to the technical field of outlier detection in industrial control network data. The present invention aims at solving the problem that it is difficult to detect a small amount of abnormal values because the normal data and the abnormal values need to be defined artificially in the existing method. The normalized calibrated data are obtained by data normalization and the normalized calibrated data are formed by adding some false sample values to the normalized calibrated data with the dataenhancement algorithm. The normal data and the detected data are input into a self-encoder compression network for training, and the trained data are obtained respectively; the distance between the normal data and the detected data is calculated by the depth neural network, and the classifier is used to judge the abnormal value of the detected data according to the distance. It is used for signalanomaly detection.

The invention discloses a monitor image anomaly detection method and device, and belongs to the field of video monitoring. The method comprises the steps: foreground pixel points in a target monitor image are determined based on a mixture Gaussian background model; the amount of the foreground pixel points in the target monitor image can be counted to obtain first pixel amount; second pixel amount can be determined based on an edge detection algorithm, and the second pixel amount is the amount of pixel points of which edge detection values in the target monitor image are greater than a first preset threshold value and positions in the target monitor image do not belong to a plurality of specific positions contained by an edge model; weighting and combining are performed on the first pixel amount and the second pixel amount, and a weighted statistical value is obtained; and when the value is greater than a second preset threshold value, the target monitor image is determined as an abnormal image. According to the invention, a way of combing foreground information and edge information is adopted to perform anomaly detection on a monitor image, and the accuracy and stability of the anomaly detection can be improved.

The invention is applicable to the technical field of water quality detection, and provides a water quality abnormity detection method and device and terminal equipment. The method comprises the following steps of acquiring time sequence measurement data within a first duration of a to-be-detected water area monitoring node, and inputting the time sequence measurement data into a UV254 predictionmodel based on a recurrent neural network (RNN) to obtain UV254 prediction data in the first duration of the to-be-detected water area monitoring node; computing a difference by using the UV254 measurement data and the UV254 prediction data, obtaining a residual error, and generating a confidence interval according to the residual error distribution; if the residual error is within the confidenceinterval, determining as a normal point; if the residual error is not within the confidence interval, determining as an abnormal point; and representing a cumulative probability of the water quality abnormity probabilities in a second time window for all measurement moments in the second time window in the first duration, and if the cumulative probability is larger than a preset probability threshold value, judging that a water quality abnormality event occurs in the second time window. According to the method, the device and the terminal equipment, the water quality abnormity detection effectis greatly reduced.

The invention discloses an industrial control flow anomaly detection method and system based on a convolution time sequence network, and the method comprises the steps: taking industrial control protocol flow as an input, splitting the industrial control protocol flow according to a read-write function, combining, normalizing and grouping split data packets according to a unit time window, and enabling the data packets to be used for a prediction model for learning; forming a data set by taking the flow data as input, and obtaining a flow data prediction model capable of predicting next window data by utilizing the current window data by utilizing a neural network model with a ConvLSTM layer and an encoding and decoding architecture; predicting the flow data packet to be detected by using the obtained prediction model to obtain a distance difference between prediction data and real data; calculating a normalized score of the intra-group difference information to obtain distribution of the window and the score; fusing score distribution of the read-write model by using a weighting mode, and detecting abnormal data traffic by using distribution information. According to the method, a deep learning model for prediction of a decoding and coding structure is adopted, a ConvLSTM module is introduced, and time and space features of industrial control flow are effectively learned.

The invention discloses a picture data set-oriented picture anomaly detection method based on deep learning. According to the method, normal picture category data is used as input data; a picture anomaly detection model based on deep learning is constructed and includes two submodules, one representation module is used for learning features of a picture data set of a normal category; one detectionmodule is used for predicting the probability that the input picture belongs to an abnormal picture category; in addition, confidence estimation is used for improving prediction accuracy, the two modules adopt an adversarial training method, the representation module can better learn features of a normal category picture data set, and the detection module can give a prediction result with higherconfidence and higher accuracy. For four common data sets in the field of anomaly detection, the method overcomes the problem that abnormal types of pictures are various in types and difficult to collect, only normal types of pictures are needed as training data, and meanwhile, the effect is remarkably superior to that of other existing anomaly detection methods for picture data sets.

The invention aims to provide a flow monitoring method for multi-protocol attack data, the multi-protocol attack data is multi-protocol network flow data, and the flow monitoring method comprises thefollowing steps: training data structure information and data time sequence information of network flow sample data to establish a flow identification model; identifying the current network flow dataaccording to the flow identification model, and obtaining a plurality of flow characteristic values in the current network flow data; acquiring multi-protocol type information in the current network transmission data according to the plurality of flow characteristic values and the characteristic values of the plurality of transmission protocols; dividing the flow data of the network flow data intoa plurality of data flow segments according to the detection period; obtaining an autocorrelation function rhok value of the flow in the data segment sequence; judging whether the multi-protocol typeinformation is set protocol type information or not; and combining the continuity of network transmission data traffic and the judgment of a network transmission protocol. Network transmission data traffic is accurately monitored in real time.

The invention relates to a real-time anomaly detection method based on a generative adversarial network, and the method comprises the steps: offline training and real-time detection; the offline training comprises the following steps: inputting batch historical normal data acquired from production equipment into a generative adversarial network model after data cleaning, the adversarial network model generating abnormal data and performing identification detection, and deploying the adversarial network model to a real-time detection environment after training is completed; the real-time detection comprises the following steps: collecting real-time data from production equipment, synchronously storing the data into a historical database, and inputting the real-time data into a generative adversarial network model for anomaly detection after data cleaning; when the detection result is normal, marking the real-time data as normal data, and inputting the normal data into the adversarial network model in a backflow manner for incremental training; and when the detection result is abnormal, triggering an abnormal alarm, waiting for manual processing, marking the real-time data as abnormal data when the detection result is confirmed as an abnormal result, and returning the abnormal data to the identification network part of the model for incremental training.

The invention relates to an electric power Internet-of-things equipment anomaly detection method based on a graph neural network. The method comprises the following steps of: S1, collecting the flow data and business data of different electric power Internet-of-things equipment through a data collection tool; S2, carrying out Koopman analysis on the collected data; S3, constructing a graph structure of an electric power Internet of things; S4, constructing a graph neural network model by taking a graph model as input, and updating the feature state of a node by utilizing graph convolution and a graph attention network; and S5, performing anomaly detection on the node at a certain moment by using K-Means clustering. According to the method, through introducing Koopman analysis, nonlinear dynamic characteristics of data of the electric power Internet of things are captured; and a graph convolutional neural network is introduced to extract the spatial features of the electric power Internet of things, the attributes of the device nodes and the information of the neighborhood device nodes in the topological structure of the electric power Internet of things are fused to achieve anomaly detection of the electric power Internet of things, and the accuracy and stability of detection are effectively improved.

The invention relates to a network abnormal traffic automatic detection method based on time sequence mining. The method belongs to the technical field of data mining, big data analysis and pattern recognition. The method comprises the steps of importing data, forming an initial time sequence model, segmenting the data to obtain data sub-sequences, obtaining optimal front and back relaxation spaces of the to-be-detected data sub-sequences by utilizing a rapid learning method, calculating distances among the data sub-sequences, obtaining a data sub-sequence similarity matrix, calculating abnormal degree scores, performing comparing and determining and the like. By a standard data access interface, a data import module reads the data value of the standard network traffic data so that data import and data standardization are conveniently realized, and the data is converted into a time sequence model and a data acquisition mode is simplified. The abnormal traffic sequence is researched andanalyzed from a plurality of data dimensions by utilizing the provided time sequence abnormal data detection method, so that the complexity of the data is reduced, and meanwhile, the time correlationcharacteristic of the original data of the network traffic is reserved.

The invention discloses a BERT anomaly detection method and equipment based on a template sequence or a word sequence. The method comprises the steps: firstly converting an original log message into the template sequence or the word sequence, taking the template sequence or the word sequence as the input of a BERT model, and achieving the training of the BERT model, and finally, anomaly detection on the to-be-detected template sequence or word sequence is realized by utilizing the trained BERT model, a good anomaly detection effect can be realized by only needing fewer training labels, and compared with the prior art, the training cost is greatly reduced, and the anomaly detection effect is improved.

The invention discloses a drilling process abnormity early warning model based on dynamic principal component analysis. The method comprises the steps of obtaining original data;, performing standardized preprocessing on the original data; forming an augmented matrix according to the standardized and preprocessed original data; forming an initial model according to a dynamic principal component analysis method and the augmented matrix, using the initial model to monitor abnormal data; if the detected data is normal, updating the initial modelaccording to the moving window principle, and if thedetected data is abnormal, analyzing and judging the fault cause according to the residual contribution rate. According to the technical scheme provided by the invention, the accuracy of abnormity detection is improved, and the early warning time delay is reduced, so that the problem of low abnormity early warning precision in the drilling process in the prior art is solved, and the effective early warning of abnormity in the drilling process is realized. Moreover, according to the technical scheme provided by the invention, real dynamic detection is realized, the method has adaptability, andthe abnormal detection effect is improved.

The invention provides a software anomaly detection method and device and electronic equipment. The method comprises the following steps: waking up a target thread every preset time unit; determining a timeout event of a to-be-tested function in the software based on the time wheel through the target thread; executing the event processing function corresponding to the to-be-tested function. In the mode, the function anomaly detection is realized based on the time wheel algorithm, the software anomaly detection performance can be improved, the software anomaly detection time precision can be increased, the detected performance loss is irrelevant to the number of tasks to be detected, and the detection of a large number of to-be-tested functions can be supported.

The invention belongs to the technical field of wireless communication networks, and discloses a data clustering method for an abnormal detection system, and a wireless communication network terminal.The method comprises the steps of uniformly calculating the similarity between classification attributes and numerical attributes; randomly selecting k clustering centers, distributing each point tothe nearest cluster according to similarity measurement, and updating the clustering center after each point is distributed; recalculating the distance between each point and each clustering center until no point is changed; calculating two entropy indexes; measuring the importance degree of each attribute according to the two entropy indexes, and calculating and updating the weight of each attribute; and recalculating the distance between each point and the clustering center according to the similarity measurement after the weight is updated, and allocating each point to the cluster closest to the point. The method has the advantages of high accuracy, low overhead and the like, can be used for data clustering in an anomaly detection system, realizes mixed data clustering containing classification attributes and numerical attributes, and considers the importance degree of each attribute.

Disclosed is a method for training an anomaly detection model of an unmanned moving object utilizing a message ID sequence, which includes: collecting packet data generated from the unmanned moving object; pre-processing the collected packet data; generating converted data for a message ID sequence of the packet data by inputting the preprocessed packet data into a language model; generating similar data similar to the message ID sequence of the packet data by inputting the preprocessed packet data into a first neural network model; training and evaluating the first neural network model by inputting the converted data of the language model and the similar data of the first neural network model into a training model; and predicting and training a symptom of the unmanned moving object by inputting the preprocessed packet data and the similar data of the first neural network model into a second neural network model.

The embodiment of the invention discloses a video data exception recovery method and device, a storage medium and a camera, and the method comprises the steps: obtaining first video data outputted byan image sensor of the camera, and reading a first frame rate of the first video data; when the first frame rate is not matched with a preset frame rate, determining that the first video data is abnormal; and performing recovery processing on the first video data. By adoption of the embodiment of the invention, a frame rate detection mechanism is added to carry out anomaly detection on output video data, and recovery processing is carried out when anomaly occurs, so that power-off recovery does not need to be carried out after an output image is abnormal, and the reliability of a product is improved.

The present disclosure describes systems, non-transitory computer-readable media, and methods for determining latent components of a metrics time series and identifying anomalous data within the metrics time series based on one or both of spikes/dips and level changes from the latent components satisfying significance thresholds. To identify such latent components, in some cases, the disclosed systems account for a range of value types by intelligently subjecting real values to a latent-component constraint for decomposing the time series and intelligently excluding non-real values from the latent-component constraint. The disclosed systems can further identify significant anomalous data values from latent components of the metrics time series by jointly determining whether one or both of a subseries of a spike-component series and a level change from a level-component series satisfy significance thresholds.