Method and device for determining abnormal mode, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses a method and device for determining an abnormal mode, a storage medium and electronic equipment, and the method comprises the steps: firstly obtaining an initial mode, obtaining a plurality of node attribute pairs based on the initial mode and a plurality of attributes, and then determining the abnormal mode according to the plurality of node attribute pairs; determining a first node attribute pair with the maximum mutation gain relative to the initial mode, determining a current attribute combination according to the first node attribute pair, removing the first node attribute pair from the plurality of node attribute pairs, and then determining whether a second node attribute pair exists in the plurality of residual node attribute pairs, according to the scheme, the key attributes which really describe abnormal behaviors of users can be accurately mined, and the abnormal modes of the users can be determined according to the current attribute combination which is updated according to the second node attribute pair when the key attributes exist. And the recall rate and accuracy of abnormal modes in batch risk prevention and control are effectively improved.

Description

Technical Field

[0001] The present invention relates to computer technology, and in particular, to a method, apparatus, storage medium, and electronic device for determining an abnormal pattern. Background Art

[0002] With the development of the times, the Internet has penetrated all aspects of people's lives. However, while bringing convenience to people, the Internet has also given rise to cyber black and gray industries. With the booming development of the digital economy, the black and gray industries have shown new, concealed, and intelligent phenomena. How to find the attack patterns of the black and gray industries has become a difficult point in risk prevention and control against cyber black and gray industries. Summary of the Invention

[0003] The purpose of the embodiments of this specification is to provide a method, apparatus, storage medium, and electronic device for determining an abnormal pattern.

[0004] The embodiments of this specification provide a method for determining an abnormal pattern. By finding the attribute combination with the largest mutation gain attribute, the key attributes that truly depict the abnormal behavior of users can be accurately mined, effectively improving the recall rate and accuracy of abnormal patterns in batch risk prevention and control. The method includes:

[0005] Obtain an initial pattern, where the initial pattern includes multiple nodes;

[0006] According to the multiple nodes and multiple attributes, obtain multiple node-attribute pairs, where each attribute includes an attribute name and an attribute value, and each node-attribute pair includes a node and an attribute;

[0007] According to the multiple node-attribute pairs, determine the first node-attribute pair with the largest mutation gain relative to the initial pattern among the multiple node-attribute pairs, determine the current attribute combination according to the first node-attribute pair, and remove the first node-attribute pair from the multiple node-attribute pairs;

[0008] According to the remaining multiple node-attribute pairs after removal, determine whether there is a second node-attribute pair among the remaining multiple node-attribute pairs, where the new attribute combination formed by the second node-attribute pair and the current attribute combination satisfies a preset mutation gain condition; if so, update the current attribute combination according to the second node-attribute pair, remove the second node-attribute pair from the remaining multiple node-attribute pairs, and repeat the above operations based on the updated current attribute combination until the iteration ends when a preset stop condition is met; otherwise, end the iteration;

[0009] Determine an abnormal pattern according to the latest current attribute combination, where the abnormal pattern includes the multiple nodes and at least one attribute corresponding to a node.

[0010] Further, obtaining a plurality of node-attribute pairs based on the plurality of nodes and the plurality of attributes includes:

[0011] Determining a plurality of initial node-attribute pairs composed of the plurality of nodes and the plurality of attributes;

[0012] Filtering out a plurality of node-attribute pairs from the plurality of initial node-attribute pairs.

[0013] Further, filtering out a plurality of node-attribute pairs from the plurality of initial node-attribute pairs includes:

[0014] For each node in the plurality of nodes, filtering out the initial node-attribute pairs that do not meet the preset conditions from the plurality of initial node-attribute pairs corresponding to this node according to the mutation gain of each initial node-attribute pair corresponding to this node relative to the initial pattern, so as to filter out the plurality of node-attribute pairs corresponding to the plurality of nodes.

[0015] Further, filtering out the initial node-attribute pairs that do not meet the preset conditions from the plurality of initial node-attribute pairs corresponding to this node according to the mutation gain of each initial node-attribute pair corresponding to this node relative to the initial pattern includes:

[0016] Filtering out the initial node-attribute pairs with a corresponding mutation gain less than zero from the plurality of initial node-attribute pairs corresponding to this node according to the mutation gain of each initial node-attribute pair corresponding to this node relative to the initial pattern.

[0017] Further, removing the first node-attribute pair from the plurality of node-attribute pairs includes:

[0018] Removing the first node-attribute pair and other node-attribute pairs corresponding to the same node and the same attribute name as the first node-attribute pair from the plurality of node-attribute pairs;

[0019] Wherein, removing the second node-attribute pair from the remaining plurality of node-attribute pairs includes:

[0020] Removing the second node-attribute pair and other node-attribute pairs corresponding to the same node and the same attribute name as the second node-attribute pair from the remaining plurality of node-attribute pairs.

[0021] Further, the preset mutation gain condition includes: the mutation gain corresponding to the new attribute combination is greater than the mutation gain corresponding to other attribute combinations formed by other node-attribute pairs in the remaining plurality of node-attribute pairs and the current attribute combination.

[0022] Further, the preset mutation gain condition further includes at least one of the following:

[0023] The mutation gain of the new attribute combination relative to the current attribute combination is greater than zero;

[0024] The mutation gain of the new attribute combination relative to the initial mode is greater than the mutation gain of the current attribute combination relative to the initial mode.

[0025] Further, the preset stop condition includes at least one of the following:

[0026] The mode acceleration corresponding to the multiple nodes under the current attribute combination reaches a first preset threshold;

[0027] The mutation gain of the multiple node-attribute pairs relative to the initial mode reaches a second preset threshold.

[0028] The embodiments of this specification also provide a device for determining an abnormal mode, including:

[0029] A first acquisition module, configured to acquire an initial mode, where the initial mode includes multiple nodes;

[0030] A second acquisition module, configured to acquire multiple node-attribute pairs according to the multiple nodes and multiple attributes, where each attribute includes an attribute name and an attribute value, and each node-attribute pair includes a node and an attribute;

[0031] A first determination module, configured to determine, according to the multiple node-attribute pairs, a first node-attribute pair with the largest mutation gain relative to the initial mode among the multiple node-attribute pairs, determine a current attribute combination according to the first node-attribute pair, and remove the first node-attribute pair from the multiple node-attribute pairs;

[0032] A second determination module, configured to determine whether there is a second node-attribute pair among the remaining multiple node-attribute pairs after removal, where the new attribute combination formed by the second node-attribute pair and the current attribute combination satisfies a preset mutation gain condition; if so, update the current attribute combination according to the second node-attribute pair, remove the second node-attribute pair from the remaining multiple node-attribute pairs, and repeatedly execute the above operations based on the updated current attribute combination until the preset stop condition is met and the iteration ends; otherwise, end the iteration;

[0033] A third determination module, configured to determine an abnormal mode according to the latest current attribute combination, where the abnormal mode includes the multiple nodes and at least one attribute corresponding to a node.

[0034] The embodiments of this specification also provide a storage medium, where the storage medium stores a computer program, and the computer program is suitable for being loaded and executed by a processor to perform the steps of the above method.

[0035] An embodiment of this specification also provides an electronic device, including: a processor and a memory; wherein, the memory stores a computer program, and the computer program is adapted to be loaded and executed by the processor to perform the steps of the above method.

[0036] An embodiment of this specification also provides a computer program product, on which at least one instruction is stored, and characterized in that, when the at least one instruction is executed by a processor, the steps of the above method are implemented.

[0037] According to the solution of the embodiment of this specification, by first obtaining an initial mode, and obtaining a plurality of node-attribute pairs based on the initial mode and a plurality of attributes, then according to the plurality of node-attribute pairs, determining a first node-attribute pair with the largest mutation gain relative to the initial mode, determining a current attribute combination according to the first node-attribute pair, and removing the first node-attribute pair from the plurality of node-attribute pairs, and then determining whether there is a second node-attribute pair in the remaining plurality of node-attribute pairs, and when there is, updating the current attribute combination according to the second node-attribute pair, thereby iteratively obtaining a current attribute combination with the largest mutation gain to determine an abnormal mode. This solution can accurately mine the key attributes that truly characterize the abnormal behavior of users, and effectively improve the recall rate and accuracy of abnormal modes in batch risk prevention and control. Description of the Drawings

[0038] Figure 1 It is a schematic flowchart of a method for determining an abnormal mode provided by an embodiment of this specification.

[0039] Figure 2 It is a schematic diagram of an example for screening a plurality of node-attribute pairs provided by an embodiment of this specification.

[0040] Figure 3 It is a schematic diagram of an example for determining a relatively optimal attribute combination based on greedy search provided by an embodiment of this specification.

[0041] Figure 4 It is a schematic structural diagram of a device for determining an abnormal mode provided by an embodiment of this specification.

[0042] Figure 5 It is a schematic structural diagram of an electronic device provided by an embodiment of this specification. Detailed Embodiments

[0043] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, rather than all of them. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this specification without creative efforts fall within the scope of protection of this specification.

[0044] Please refer to Figure 1 , which is a schematic flowchart of a method for determining an abnormal mode provided by an embodiment of this specification. In the embodiments of this specification, the method for determining an abnormal mode is applied to a device for determining an abnormal mode (hereinafter simply referred to as the "abnormal mode determination device") or an electronic device configured with an abnormal mode determination device. The following will elaborate in detail on the Figure 1 flow shown. The method for determining an abnormal mode may specifically include the following steps:

[0045] S102. Obtain an initial mode, where the initial mode includes multiple nodes.

[0046] In some embodiments, the initial pattern refers to the rules or structures identified based on data, phenomena, or behaviors, which can be used to characterize the discovery of patterns and rules of group behaviors. In some embodiments, the initial pattern can be determined by identifying a user behavior sequence or a risk control causal event set. The user behavior sequence refers to the record of a series of operations or actions performed by a user within a specific time period. Such behaviors may include web page browsing, search queries, clicks, purchases, comments, etc. By recording and analyzing the user behavior sequence, information about user preferences, interests, behavior patterns, and purchase intentions can be obtained, and potential risk information can also be analyzed. The behavior sequence emphasizes the chronological relationship between behaviors or events and the patterns or causal relationships that these sequences may explain. The causal event set refers to a series of behaviors or events that occur in chronological order, where some events (referred to as "cause" events) are considered the causes of subsequent events (referred to as "result" events). Usually, there is a succession in time and a logical causal relationship. In the risk control scenario, the attacks of black and gray production often cannot avoid certain event causal relationships with logical sequence. Through the constraint of the causal event set, the interference of noise sequences can be reduced and the computational magnitude can be significantly reduced. In some embodiments, the initial pattern input by the user can be obtained, or the initial pattern provided by other devices can be obtained. In some embodiments, each node in the initial pattern represents a behavior or an event. As an example, the initial pattern includes four nodes N1, N2, N3, and N4. Among them, node N1 represents the login event, node N2 represents the create trade event, node N3 represents the high risk action event, and node N4 represents the pay by account event.

[0047] S104. Obtain a plurality of node-attribute pairs according to the plurality of nodes and the plurality of attributes, where each attribute includes an attribute name and an attribute value, and each node-attribute pair includes a node and an attribute.

[0048] In some embodiments, the attribute corresponding to a node is an attribute that may cause a mutation in the behavior or event represented by the node; in some embodiments, nodes are mined based on the user behavior sequence or the risk control causal event set, and the user pattern is characterized by combining conflicting attributes, so as to recall the abnormal risk pattern based on the mutation of the number of users or events within a certain time window. Wherein the attribute value refers to the value of the attribute name corresponding to the node. For example, a node attribute pair is represented as (N1, attribute 1), N1 represents the login event, and attribute 1 includes the attribute name "login type" and the attribute value "password-free", where "password-free" is a specific way (or value) of "login type". In the context, for the convenience of understanding, the node attribute pair may also be represented in the form of (node name, attribute name, attribute value) or (node name, (attribute name, attribute value)). In some embodiments, the same node may correspond to one or more attributes, different nodes correspond to different attributes, and a node may not correspond to any attribute; in some embodiments, the attribute names corresponding to different nodes may be the same or different; for example, the attribute names corresponding to two nodes in the initial pattern are the same but the attribute values are different; it should be noted that in some embodiments of this specification, the situations where the attribute names are different or the attribute names are the same but the attribute values are different are all regarded as different attributes. In some embodiments, assuming the number of nodes is m and the number of attributes in the attribute pool (which can be regarded as a set of multiple attributes) is n, then each node has 2 n different attribute combination methods (for example, the attribute pool includes attribute 1 and attribute 2, and the attribute combination methods corresponding to node N1 include: N1, N1 + attribute 1, N1 + attribute 2, N1 + attribute 1 + attribute 2), then the total number of attribute combination methods corresponding to m nodes is (2 n ) m types (that is, 2 nm types). In some embodiments, identification information, such as an index, can be set for each node attribute pair to facilitate attribute selection.

[0049] In some embodiments, based on multiple nodes in the initial pattern and the attributes associated with each node, a plurality of node-attribute pairs are established; in some embodiments, first, based on multiple nodes in the initial pattern and the attributes associated with each node, an initial plurality of node-attribute pairs are established, and then corresponding processing operations (such as filtering, modifying, etc.) are performed on the initial plurality of node-attribute pairs to obtain the plurality of node-attribute pairs. In some embodiments, the plurality of node-attribute pairs include node-attribute pairs corresponding to each of the multiple nodes. For example, the initial pattern includes four nodes N1, N2, N3, and N4, and the plurality of node-attribute pairs include at least one node-attribute pair corresponding to each node; in some embodiments, the plurality of node-attribute pairs only include node-attribute pairs corresponding to some of the multiple nodes. For example, the initial pattern includes four nodes N1, N2, N3, and N4, and the plurality of node-attribute pairs include 2 node-attribute pairs corresponding to N1, 3 node-attribute pairs corresponding to N2, and 1 node-attribute pair corresponding to N4, that is, it does not include the node-attribute pair corresponding to N3 (N3 may not have associated attributes, or although N3 has relevant attributes, its corresponding node-attribute pair has been filtered out because it does not meet the conditions). As an example, the initial pattern includes four nodes N1, N2, N3, and N4, at least one attribute associated with each node is obtained, and the following 6 node-attribute pairs are obtained based on these 4 nodes and at least one attribute associated with each node: (N1, attribute 1), (N1, attribute 2), (N2, attribute 3), (N3, attribute 4), (N4, attribute 5), (N4, attribute 6).

[0050] S106. According to the plurality of node-attribute pairs, determine a first node-attribute pair with the largest mutation gain relative to the initial pattern among the plurality of node-attribute pairs, determine a current attribute combination according to the first node-attribute pair, and remove the first node-attribute pair from the plurality of node-attribute pairs.

[0051] In some embodiments, the mutation gain brought by the first node-attribute pair to the initial pattern is greater than 0. In some embodiments, after determining the first node-attribute pair, directly use the first node-attribute pair as the current attribute combination. In some embodiments, determine the current attribute combination according to the multiple nodes and the first node-attribute pair. Continuing with the above example, the first node-attribute pair with the largest mutation gain relative to the initial pattern determined from the 6 node-attribute pairs is (N3, attribute 4), then a current attribute combination is generated based on these 4 nodes and the first node-attribute pair, which can be expressed as (N1, N2, N3 + attribute 4, N4), that is, the node N3 is attached with the attribute 4, and the other 3 nodes are not attached with attributes.

[0052] In some embodiments, the first node-attribute pair with the largest mutation gain relative to the initial pattern among the multiple node-attribute pairs is found by calculating the acceleration. As an example, let P represent the initial pattern, and A = {A1, A2,..., An} represent the entire set of all attributes. Each node-attribute pair obtained based on P and A corresponds to a new pattern different from P (i.e., a new pattern obtained by adding an attribute to P). Then, the mutation gain can be defined as a metric function G for the acceleration improvement, as follows:

[0053] G(A') = Δ acc_speed(P —> P+A')

[0054] The mutation-gain attribute set A* can be defined as follows:

[0055]

[0056] where Δ represents the difference, A' is the subset of A that satisfies G(A') > 0, P+A' is the new pattern obtained by attaching A' to P, acc_speed represents the acceleration, and the calculation method is the average change rate of the pattern frequency compared to the first day within a certain time window (daily level). The calculation formula is:

[0057]

[0058] where n represents the number of time slices, ΔT i represents the time difference between the ith day and the first day within the time window, i = 0, 1,..., n, and speed i represents the pattern-frequency speed corresponding to the ith time slice. The calculation formula for speed i is as follows:

[0059] speed i = (snapshot_cnt i - snapshot_cnt0) / (snapshot_cnt0)

[0060] where snapshot_cnt i represents the number of people or the number of events in the pattern at the ith time slice. Then, finding a subset such that the value of the mutation gain G target is maximized on this subset can be represented by the objective function:

[0061]

[0062] argmax represents the parameter that maximizes the objective function. Based on this example, the process of determining the first node attribute pair by the above algorithm can be based on the following hypothetical theorem: 1) If A0' does not belong to the mutant gain attribute set A*, any parent set A0 of A0' also does not belong to A*; 2) For any mutant gain attribute set A' in A*, any subset A” of A' also belongs to A*.

[0063] S108. According to the remaining multiple node attribute pairs after elimination, determine whether there is a second node attribute pair among the remaining multiple node attribute pairs, where the new attribute combination formed by the second node attribute pair and the current attribute combination satisfies a preset mutant gain condition; if so, update the current attribute combination according to the second node attribute pair, eliminate the second node attribute pair from the remaining multiple node attribute pairs, and repeat the above operations based on the updated current attribute combination until the iteration ends when the preset stop condition is met; otherwise, end the iteration. In some embodiments, the process of determining the second node attribute pair is also the process of determining which node attribute pair among the currently remaining multiple node attribute pairs has the largest mutant gain corresponding to the new attribute combination formed by the second node attribute pair and the current attribute combination. Thus, through continuous iteration, an attribute combination with the largest mutant gain can be determined. In some embodiments, the mutant gain condition includes any condition for indicating how to determine the second node attribute pair. In some embodiments, after determining that there is a second node attribute pair among the currently remaining multiple node attribute pairs, update the current attribute combination based on this second node attribute pair. For example, if the current attribute combination is represented as (N1 + attribute 1, N2 + attribute 2), and if it is determined that there is a second node attribute pair (N1 + attribute 3), then based on this second node attribute pair, the current attribute combination can be updated to (N1 + attribute 1 + attribute 3, N2 + attribute 2), and this updated attribute combination is also the new attribute combination formed by the second node attribute pair and the current attribute combination. The process of executing step S106 and step S108 can also be regarded as a process of finding a better solution for the attribute combination by using a greedy algorithm and setting relevant conditions or thresholds.

[0064] S110. Determine an abnormal pattern according to the latest current attribute combination, where the abnormal pattern includes the multiple nodes and the attributes corresponding to at least one node. In some embodiments, based on the latest current attribute combination at the end of the iteration, the abnormal pattern can be determined. In some embodiments, all nodes in the abnormal pattern may be attached with attributes, or only some nodes may be attached with attributes. In some embodiments, the latest current attribute combination can be directly determined as the abnormal pattern. In some embodiments, only some nodes in the initial pattern are included in the latest current attribute combination, and other nodes in the initial pattern can be added to the current attribute combination to determine the final abnormal pattern. As an example, the initial pattern includes four nodes N1, N2, N3, and N4. By performing step S104, step S106, and step S108, the latest current attribute combination obtained is (N1 + attribute 1, N2 + attribute 2, N3, N4 + attribute 4). Since this current attribute combination includes the four nodes in the initial pattern, this current attribute combination can be determined as the abnormal pattern. As another example, the initial pattern includes four nodes N1, N2, N3, and N4. By performing step S104, step S106, and step S108, the latest current attribute combination obtained is (N1 + attribute 1, N2 + attribute 2). This current attribute combination does not include N3 and N4, that is, the mutation gain is the largest when N1 is attached with attribute 1, N2 is attached with attribute 2, and N3 and N4 are not attached with any attributes. Thus, based on this current attribute combination, the abnormal pattern can be determined as (N1 + attribute 1, N2 + attribute 2, N3, N4). As a special example, in step S106, it may not be possible to find the first node-attribute pair with the largest mutation gain (that is, no matter what attribute is attached, the mutation gain is less than or equal to 0). This indicates that the acceleration is the largest when no attributes are attached to each node. In this case, it may be considered that there is no abnormal pattern, or the initial pattern is the abnormal pattern.

[0065] According to the solution of the embodiments of this specification, first obtain an initial mode, and obtain multiple node-attribute pairs based on the initial mode and multiple attributes. Then, according to the multiple node-attribute pairs, determine the first node-attribute pair with the largest mutation gain relative to the initial mode. Determine the current attribute combination according to the first node-attribute pair, and remove the first node-attribute pair from the multiple node-attribute pairs. Then, determine whether there is a second node-attribute pair among the remaining multiple node-attribute pairs, and update the current attribute combination according to the second node-attribute pair when it exists, so as to iteratively obtain the current attribute combination with the largest mutation gain to determine the abnormal mode. This solution can accurately mine the key attributes that truly characterize the abnormal behavior of users, and effectively improve the recall rate and accuracy of abnormal modes in batch risk prevention and control. This solution can characterize the user mode based on the user behavior sequence or the risk control causal event set and the conflict attributes, and recall the abnormal risk mode based on the mutation of the number of users or events in the mode within a certain time window. When characterizing the risk mode, mine the sequence nodes based on the causal event set, rely on the mutation gain attribute combination search algorithm proposed in this solution to mine the key attributes, and reduce the calculation level through algorithms such as pruning to achieve practical implementation, thereby improving the recall rate and accuracy of the abnormal risk mode in the Alipay risk control scenario.

[0066] In some embodiments, obtaining multiple node-attribute pairs according to the multiple nodes and multiple attributes includes: determining multiple initial node-attribute pairs composed of the multiple nodes and multiple attributes; screening out multiple node-attribute pairs from the multiple initial node-attribute pairs. In some embodiments, based on a preset screening rule, filter out the node-attribute pairs that do not meet the conditions from the multiple initial node-attribute pairs, and use the node-attribute pairs that meet the conditions for subsequent steps. In some embodiments, the attributes in the node-attribute pairs that do not meet the conditions are attributes with low discrimination and relatively general. In some embodiments, if the number of initial node-attribute pairs is greater than a preset threshold, screen out multiple node-attribute pairs from the multiple initial node-attribute pairs, which can further reduce the calculation amount while mining the key attributes. The above screening operation is also equivalent to a pruning operation performed on the attributes. Since there are usually a large number of attributes in the actual application scenario, by performing screening or pruning algorithms, the calculation level can be effectively reduced and the calculation efficiency can be improved; based on the pruning of attributes that have a gain in characterizing mode mutation and the search for better attribute combinations, the key attributes that truly characterize the batch attacks of black and gray production users can be mined.

[0067] In some embodiments, screening out a plurality of node attribute pairs from the plurality of initial node attribute pairs includes: for each node in the plurality of nodes, filtering out the initial node attribute pairs that do not meet the preset conditions from the plurality of initial node attribute pairs corresponding to the node according to the mutation gain of each initial node attribute pair corresponding to the node relative to the initial pattern, so as to screen out the plurality of node attribute pairs corresponding to the plurality of nodes. The implementation manner of calculating the mutation gain has been described in the foregoing embodiments and will not be elaborated herein. In some embodiments, the preset conditions are preset based on the requirements of the actual application scenario; in some embodiments, each node may correspond to the same preset condition or different preset conditions. For example, dedicated preset conditions can be set for special types of nodes, while general preset conditions can be set for other types of nodes; for example, the general preset condition is to filter out the initial node attribute pairs corresponding to the node whose corresponding mutation gain is less than or equal to zero from the plurality of initial node attributes corresponding to the node; the dedicated preset condition corresponding to a certain specific type of node is to filter out the initial node attribute pairs including specific attributes for this type of node.

[0068] In some embodiments, filtering out the initial node attribute pairs that do not meet the preset conditions from the plurality of initial node attribute pairs corresponding to the node according to the mutation gain of each initial node attribute pair corresponding to the node relative to the initial pattern includes: filtering out the initial node attribute pairs whose corresponding mutation gain is less than zero from the plurality of initial node attribute pairs corresponding to the node according to the mutation gain of each initial node attribute pair corresponding to the node relative to the initial pattern. As an example, the mutation gain corresponding to node attribute pair A1 is -0.12, the mutation gain corresponding to node attribute pair A2 is 0.24, the mutation gain corresponding to node attribute pair A3 is 0.56, the mutation gain corresponding to node attribute pair A4 is 0.32, and the mutation gain corresponding to node attribute pair A5 is -0.21. Then, filter out the initial node attribute pairs A1 and A5 whose corresponding mutation gain is less than zero, and retain node attribute pairs A2, A3, and A4. After that, step S106 can be executed to determine the first node attribute pair A3 from A2, A3, and A4. Then, execute step S108 to determine that the mutation gain corresponding to A3+A4 is greater than the mutation gain corresponding to A3+A2. Then, determine A3+A4 as the current attribute combination. After that, repeat step S108 to continue the iteration, and finally determine that A3+A4+A2 is the attribute combination that can bring the maximum mutation gain.

[0069] In some embodiments, removing the first node-attribute pair from the multiple node-attribute pairs includes: removing the first node-attribute pair and other node-attribute pairs corresponding to the same node and the same attribute name as the first node-attribute pair from the multiple node-attribute pairs; wherein, removing the second node-attribute pair from the remaining multiple node-attribute pairs includes: removing the second node-attribute pair and other node-attribute pairs corresponding to the same node and the same attribute name as the second node-attribute pair from the remaining multiple node-attribute pairs. In some embodiments, one attribute name may correspond to multiple attribute values. When a node-attribute pair is removed, other node-attribute pairs with the same node and the same attribute name but different attribute values may be removed synchronously, that is, it is considered that the mutation gains brought by attribute pairs with the same attribute name but different attribute values to the same node are different, and only one attribute value corresponding to the same attribute name associated with the same node is required in the final attribute combination.

[0070] In some embodiments, the preset mutation gain condition includes: the mutation gain corresponding to the new attribute combination is greater than the mutation gain corresponding to other attribute combinations formed by other node-attribute pairs in the remaining multiple node-attribute pairs and the current attribute combination. In some embodiments, the preset mutation gain condition further includes at least one of the following: the mutation gain of the new attribute combination relative to the current attribute combination is greater than zero; the mutation gain of the new attribute combination relative to the initial mode is greater than the mutation gain of the current attribute combination relative to the initial mode. In some embodiments, for each remaining node-attribute pair, calculate the mutation gain corresponding to the attribute combination formed by the node-attribute pair for the current attribute combination, and select the node-attribute pair with the largest corresponding mutation gain as the second node-attribute pair. In some embodiments, if the mutation gains corresponding to all attribute combinations formed by each remaining node-attribute pair and the current attribute combination are all less than zero, it is considered that all the remaining node-attribute pairs cannot bring positive mutation gain to the current attribute combination, and the iteration ends.

[0071] In some embodiments, the preset stop condition includes at least one of the following: the mode acceleration corresponding to the multiple nodes under the current attribute combination reaches a first preset threshold; the mutation gain relative to the initial mode among the multiple node attribute pairs reaches a second preset threshold. In some embodiments, the first preset threshold and / or the second preset threshold can be set based on empirical values. In some embodiments, the first preset threshold and / or the second preset threshold can be dynamically adjusted based on the number of iterations, the number of attributes in the final attribute combination, etc. Continuing with the above example, the second preset threshold is 2. If it is calculated that A3 + A4 + A2 satisfies the mutation gain condition, but the corresponding mutation rate is 2.3, which is greater than the second preset threshold, then the preset stop condition is satisfied, the iteration ends, and the final current attribute combination is A3 + A4 + A2.

[0072] Figure 2 Schematic diagram of an example provided by an embodiment of this specification for screening multiple node attribute pairs. As Figure 2 shown, node B is a node in the initial mode, and the attribute pool includes n attributes, namely attribute 1, attribute 2,..., attribute n. Then, mutation gain attribute screening can be performed first, which specifically includes the following steps: 1) Single-node attribute combination, combining B with each attribute in the attribute pool; 2) Attribute acceleration calculation, specifically calculating the acceleration corresponding to the combination of B and each attribute. As Figure 2 shown, the acceleration corresponding to B + attribute 1 is -0.7, the acceleration corresponding to B + attribute 1 is 0.7, and the acceleration corresponding to B + attribute n is -0.8. Among them, the binary classification acceleration of B without adding any attributes is -0.8; 3) Mutation gain attribute sorting and screening. Using X to represent the combination of B and each attribute, and the mutation gain corresponding to each combination is represented as y. Then, the y value corresponding to each combination in X can be calculated. As Figure 2 shown, the mutation gain corresponding to "B + attribute 2" is +1.5 (the calculation method is the acceleration of B + attribute 2 (0.7) minus the binary classification acceleration of B (-0.8). The calculation methods of other y values are the same and will not be elaborated below). The mutation gain corresponding to "B + attribute 1" is +0.1, and the mutation gain corresponding to "B + attribute n" is -0.0. Figure 2 In n ) m X has been sorted from largest to smallest according to the corresponding y value. Thus, X with a corresponding y value less than 0 can be filtered out. It should be noted that if the number of nodes is m and the number of attributes is n, then the total number of attribute combination methods is (2 0.4n ) m . Assuming that 60% of the non-discriminative attributes can be filtered out for each node, the optimized number of mode combinations is (2 n ). Taking the average node length as 4 for example, the optimized number of mode combinations is reduced from 16 n to 3n , It can be seen that the computational magnitude optimization can be achieved through screening or pruning.

[0073] Figure 3 It is a schematic diagram of determining a better attribute combination based on greedy search provided by an embodiment of this specification, specifically including: 1) Initializing the attribute combination, establishing an empty attribute combination; 2) Performing greedy selection, specifically including adding the currently selected attribute combination, adding new attributes that can optimize the acceleration target, and updating the attribute combination until convergence. 3) The stop conditions for determining whether to converge include: the acceleration target reaches the threshold, and adding any new attributes no longer optimizes. Thus, through greedy selection, from local optimization to global optimization, the goal of finding the combination of nodes + key attributes in the mode that maximizes acceleration can be achieved.

[0074] Figure 4 It is a schematic structural diagram of a device for determining an abnormal mode provided by an embodiment of this specification. The device for determining an abnormal mode (hereinafter simply referred to as "abnormal mode determination device 1") can be implemented as all or part of an electronic device through software, hardware, or a combination of both. According to some embodiments, the abnormal mode determination device 1 includes a first acquisition module 11, a second acquisition module 12, a first determination module 13, a second determination module 14, and a third determination module 15.

[0075] The first acquisition module 11 is used to acquire an initial mode, and the initial mode includes multiple nodes.

[0076] The second acquisition module 12 is used to acquire multiple node-attribute pairs according to the multiple nodes and multiple attributes, where each attribute includes an attribute name and an attribute value, and each node-attribute pair includes a node and an attribute.

[0077] The first determination module 13 is used to determine, according to the multiple node-attribute pairs, a first node-attribute pair with the largest mutation gain relative to the initial mode among the multiple node-attribute pairs, determine the current attribute combination according to the first node-attribute pair, and remove the first node-attribute pair from the multiple node-attribute pairs.

[0078] The second determination module 14 is used to determine whether there is a second node-attribute pair among the remaining multiple node-attribute pairs according to the remaining multiple node-attribute pairs after removal, where the new attribute combination formed by the second node-attribute pair and the current attribute combination satisfies a preset mutation gain condition; if so, update the current attribute combination according to the second node-attribute pair, remove the second node-attribute pair from the remaining multiple node-attribute pairs, and repeat the above operations based on the updated current attribute combination until the iteration ends when the preset stop condition is met; otherwise, end the iteration.

[0079] A third determination module 15, configured to determine an abnormal pattern according to the latest current attribute combination, where the abnormal pattern includes the multiple nodes and attributes corresponding to at least one node.

[0080] In some embodiments, the second obtaining module 12 is configured to: determine a plurality of initial node-attribute pairs composed of the multiple nodes and multiple attributes; and screen out a plurality of node-attribute pairs from the plurality of initial node-attribute pairs.

[0081] In some embodiments, screening out a plurality of node-attribute pairs from the plurality of initial node-attribute pairs includes: for each node in the plurality of nodes, filtering out initial node-attribute pairs that do not meet a preset condition from the plurality of initial node-attribute pairs corresponding to the node according to the mutation gain of each initial node-attribute pair corresponding to the node relative to the initial pattern, so as to screen out the plurality of node-attribute pairs corresponding to the plurality of nodes.

[0082] In some embodiments, filtering out initial node-attribute pairs that do not meet a preset condition from the plurality of initial node-attribute pairs corresponding to the node according to the mutation gain of each initial node-attribute pair corresponding to the node relative to the initial pattern includes: filtering out initial node-attribute pairs with a corresponding mutation gain less than zero from the plurality of initial node-attribute pairs corresponding to the node according to the mutation gain of each initial node-attribute pair corresponding to the node relative to the initial pattern.

[0083] In some embodiments, removing the first node-attribute pair from the plurality of node-attribute pairs includes: removing the first node-attribute pair and other node-attribute pairs corresponding to the same node and the same attribute name as the first node-attribute pair from the plurality of node-attribute pairs; where removing the second node-attribute pair from the remaining plurality of node-attribute pairs includes: removing the second node-attribute pair and other node-attribute pairs corresponding to the same node and the same attribute name as the second node-attribute pair from the remaining plurality of node-attribute pairs.

[0084] In some embodiments, the preset mutation gain condition includes: the mutation gain corresponding to the new attribute combination is greater than the mutation gain corresponding to other attribute combinations formed by other node-attribute pairs in the remaining plurality of node-attribute pairs and the current attribute combination.

[0085] In some embodiments, the preset mutation gain condition further includes at least one of the following: the mutation gain of the new attribute combination relative to the current attribute combination is greater than zero; the mutation gain of the new attribute combination relative to the initial pattern is greater than the mutation gain of the current attribute combination relative to the initial pattern.

[0086] In some embodiments, the preset stop condition includes at least one of the following: the pattern acceleration corresponding to the multiple nodes under the current attribute combination reaches a first preset threshold; the mutation gain relative to the initial pattern in the multiple node attribute pairs reaches a second preset threshold.

[0087] The above device embodiments correspond to the method embodiments. For specific descriptions, reference can be made to the descriptions in the method embodiment section, which will not be elaborated here. The device embodiments are obtained based on the corresponding method embodiments and have the same technical effects as the corresponding method embodiments. For specific descriptions, reference can be made to the corresponding method embodiments.

[0088] Embodiments of this specification also provide a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor to implement the method of the embodiments of this specification.

[0089] Embodiments of this specification also provide a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor to implement the method of the embodiments of this specification.

[0090] Embodiments of this specification also provide Figure 5 a schematic structural diagram of the electronic device shown. As Figure 5 , at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory. Of course, it may also include other hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to implement the above method.

[0091] Of course, in addition to the software implementation, this specification does not exclude other implementation manners, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, and can also be hardware or a logic device.

[0092] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to circuit structures such as diodes, transistors, switches, etc.) or software improvements (improvements to method flows). However, with the development of technology, many method flow improvements today can be regarded as direct improvements to hardware circuit structures. Almost all designers obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement to a method flow cannot be implemented using a hardware entity module. For example, a Programmable Logic Device (PLD) (e.g., a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logical function is determined by a user's programming of the device. Designers can program themselves to "integrate" a digital system onto a single PLD, without having to ask a chip manufacturer to design and fabricate a dedicated integrated circuit chip. Moreover, nowadays, instead of manually fabricating integrated circuit chips, this programming is mostly implemented using "logic compiler" software, which is similar to the software compiler used in program development and writing. The original code before compilation also has to be written in a specific programming language, which is called a Hardware Description Language (HDL). There is not just one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones currently are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also be aware that by simply performing a little logical programming on the method flow using the above-mentioned several hardware description languages and programming it into an integrated circuit, it is easy to obtain the hardware circuit that implements the logical method flow.

[0093] The controller can be implemented in any suitable manner. For example, the controller can take the form of, for example, a microprocessor or a processor and a computer-readable medium storing computer-readable program code (such as software or firmware) executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of the controller include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in the form of pure computer-readable program code, it is entirely possible to logically program the method processing steps to enable the controller to be implemented in the form of logic gates, switches, application specific integrated circuits, programmable logic controllers, embedded microcontrollers, etc. to achieve the same functions. Therefore, such a controller can be considered a hardware component, and the devices included therein for implementing various functions can also be regarded as the structures within the hardware component. Or even, the devices for implementing various functions can be regarded as either software modules for implementing the method or the structures within the hardware component.

[0094] The systems, devices, modules, or units illustrated in the above embodiments can be specifically implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0095] For the convenience of description, when describing the above devices, they are described separately as various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0096] Those skilled in the art should understand that the embodiments of this specification can be provided as a method, a system, or a computer program product. Therefore, this specification can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk memory, CD-ROM, optical memory, etc.) containing computer-usable program code.

[0097] This specification is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to embodiments of the specification. It should be understood that each flow and / or block in the flowchart and / or block diagram, and the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processors of general-purpose computers, special-purpose computers, embedded processors, or other programmable data processing devices to generate a machine, such that the instructions executed by the processors of the computer or other programmable data processing devices produce means for implementing the functions specified in one or more of the flows Figure 1 one or more of the flows and / or blocks Figure 1 or means for implementing the functions specified in one or more of the blocks.

[0098] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory produce a manufactured article including instruction means that implement the functions specified in one or more of the flows Figure 1 one or more of the flows and / or blocks Figure 1 or means for implementing the functions specified in one or more of the blocks.

[0099] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation processing steps are executed on the computer or other programmable device to generate a computer-implemented process, and thus the instructions executed on the computer or other programmable device provide processing steps for implementing the functions specified in one or more of the flows Figure 1 one or more of the flows and / or blocks Figure 1 or means for implementing the functions specified in one or more of the blocks.

[0100] In a typical configuration, a computing device includes one or more processors (CPUs), an input / output interface, a network interface, and a memory.

[0101] The memory may include non-permanent memory in the form of computer-readable media, random access memory (RAM), and / or non-volatile memory such as read-only memory (ROM) or flash memory (flash RAM). The memory is an example of computer-readable media.

[0102] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0103] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0104] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0106] Each embodiment in this specification is described in a progressive manner. For the same or similar parts among the embodiments, reference can be made to each other, and the key point of each embodiment is to illustrate the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and for the relevant parts, reference can be made to the corresponding description in the method embodiment.

[0107] The above description is only for the embodiments of this specification and is not intended to limit this specification. For those skilled in the art, various modifications and changes can be made to this specification. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of this specification shall be included within the scope of the claims of this specification.

Claims

1. A method for determining an abnormal pattern, comprising: Obtaining an initial pattern, where the initial pattern includes a plurality of nodes; Obtaining a plurality of node-attribute pairs according to the plurality of nodes and a plurality of attributes, where each attribute includes an attribute name and an attribute value, and each node-attribute pair includes a node and an attribute; Determining a first node-attribute pair with the largest mutation gain relative to the initial pattern among the plurality of node-attribute pairs according to the plurality of node-attribute pairs, determining a current attribute combination according to the first node-attribute pair, and removing the first node-attribute pair from the plurality of node-attribute pairs; Determining whether there is a second node-attribute pair among the remaining plurality of node-attribute pairs after removal according to the remaining plurality of node-attribute pairs after removal, where the new attribute combination formed by the second node-attribute pair and the current attribute combination satisfies a preset mutation gain condition; if so, updating the current attribute combination according to the second node-attribute pair, removing the second node-attribute pair from the remaining plurality of node-attribute pairs, and repeating the above operations based on the updated current attribute combination until the iteration ends when a preset stop condition is satisfied; otherwise, ending the iteration; Determining an abnormal pattern according to the latest current attribute combination, where the abnormal pattern includes the plurality of nodes and at least one attribute corresponding to a node.

2. The method according to claim 1, where the obtaining a plurality of node-attribute pairs according to the plurality of nodes and a plurality of attributes includes: Determining a plurality of initial node-attribute pairs formed by the plurality of nodes and the plurality of attributes; Filtering out a plurality of node-attribute pairs from the plurality of initial node-attribute pairs.

3. The method according to claim 2, where the filtering out a plurality of node-attribute pairs from the plurality of initial node-attribute pairs includes: For each node among the plurality of nodes, filtering out the initial node-attribute pairs that do not satisfy a preset condition from the plurality of initial node-attribute pairs corresponding to the node according to the mutation gain of each initial node-attribute pair corresponding to the node relative to the initial pattern, so as to filter out a plurality of node-attribute pairs corresponding to the plurality of nodes.

4. The method according to claim 3, where the filtering out the initial node-attribute pairs that do not satisfy a preset condition from the plurality of initial node-attribute pairs corresponding to the node according to the mutation gain of each initial node-attribute pair corresponding to the node relative to the initial pattern includes: Filtering out the initial node-attribute pairs with a corresponding mutation gain less than zero from the plurality of initial node-attribute pairs corresponding to the node according to the mutation gain of each initial node-attribute pair corresponding to the node relative to the initial pattern.

5. The method according to claim 1, where the removing the first node-attribute pair from the plurality of node-attribute pairs includes: Removing the first node-attribute pair and other node-attribute pairs with the same node and the same attribute name corresponding to the first node-attribute pair from the plurality of node-attribute pairs; Wherein, the removing the second node-attribute pair from the remaining plurality of node-attribute pairs includes: Eliminate the second node attribute pair and other node attribute pairs with the same node and the same attribute name as the second node attribute pair from the remaining multiple node attribute pairs.

6. The method according to claim 1, wherein the preset mutation gain condition comprises: The mutation gain corresponding to the new attribute combination is greater than the mutation gains corresponding to other attribute combinations formed by other node attribute pairs in the remaining multiple node attribute pairs and the current attribute combination.

7. The method according to claim 6, wherein the preset mutation gain condition further comprises at least one of the following: The mutation gain of the new attribute combination relative to the current attribute combination is greater than zero; The mutation gain of the new attribute combination relative to the initial pattern is greater than the mutation gain of the current attribute combination relative to the initial pattern.

8. The method according to claim 1, wherein the preset stop condition comprises at least one of the following: The pattern acceleration corresponding to the multiple nodes under the current attribute combination reaches a first preset threshold; The mutation gain relative to the initial pattern in the multiple node attribute pairs reaches a second preset threshold.

9. An apparatus for determining an abnormal pattern, comprising: A first obtaining module, configured to obtain an initial pattern, where the initial pattern includes multiple nodes; A second obtaining module, configured to obtain multiple node attribute pairs according to the multiple nodes and multiple attributes, where each attribute includes an attribute name and an attribute value, and each node attribute pair includes a node and an attribute; A first determining module, configured to determine a first node attribute pair with the largest mutation gain relative to the initial pattern among the multiple node attribute pairs according to the multiple node attribute pairs, determine a current attribute combination according to the first node attribute pair, and eliminate the first node attribute pair from the multiple node attribute pairs; A second determining module, configured to determine whether there is a second node attribute pair among the remaining multiple node attribute pairs after elimination, where the new attribute combination formed by the second node attribute pair and the current attribute combination satisfies a preset mutation gain condition; if so, update the current attribute combination according to the second node attribute pair, eliminate the second node attribute pair from the remaining multiple node attribute pairs, and repeatedly execute the above operations based on the updated current attribute combination until the iteration ends when the preset stop condition is satisfied; otherwise, end the iteration; A third determining module, configured to determine an abnormal pattern according to the latest current attribute combination, where the abnormal pattern includes the multiple nodes and at least one attribute corresponding to a node.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

11. An electronic device, characterized in that, Comprising: A processor and a memory; wherein, the memory stores a computer program, and the computer program is adapted to be loaded and executed by the processor to implement the steps of the method according to any one of claims 1 to 8.

12. A computer program product having at least one instruction stored thereon, characterized in that, When the at least one instruction is executed by the processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images