Abnormality detection method and device, storage medium and computer equipment

Abstract

The invention provides an anomaly detection method and device, a storage medium and computer equipment. The method comprises the steps that a content anomaly detection model is constructed based on collected data, and a context anomaly detection model is constructed based on a k-means clustering algorithm; judging whether input data is content abnormal data or not through the content abnormal detection model; under the condition that the input data is the content abnormal data, acquiring context information of the input data; and judging whether the content exception data is exceptional data or not based on the context information through the context exception detection model. According to the anomaly detection method and device, the storage medium and the computer equipment provided by the invention, firstly, the data is subjected to anomaly pre-judgment online in real time by utilizing the real-time performance of content anomaly detection, and then the content anomaly data is subjected to context anomaly detection, so that the time cost of system operation is effectively improved, and the system reliability is improved. And meanwhile, the misjudgment efficiency of data anomaly detection is also improved.

Description

technical field [0001] The present application belongs to the technical field of anomaly detection, and in particular relates to an anomaly detection method, device, storage medium and computer equipment. Background technique [0002] Anomaly detection technology is often applied in many fields, such as intrusion detection, fraud detection, fault detection, system health monitoring, sensor network event detection and ecosystem disturbance detection, etc. It is often used in preprocessing to remove outliers from a dataset, significantly improving accuracy. [0003] The existing anomaly detection technology adopts the nearest neighbor algorithm. The nearest neighbor algorithm is mainly based on the assumption that normal data objects are relatively concentrated, while anomalies are often far away from their neighbors. In the nearest neighbor algorithm, the distance from the test object to its kth nearest neighbor is used as the score of abnormality. The basic mechanism of th...

AI Technical Summary

Problems solved by technology

In practical applications, the scale of anomalies is usually not uniform, that is to say, the anomalies are sometimes very isolated, and sometimes they are small groups, which leads to the high misjudgment efficiency of the existing anomaly detection algorithm based on the nearest neighbor.

Images