Network anomaly detection method based on online Tucker decomposition enhanced by meta-learning

Abstract

The present invention discloses a network anomaly detection method based on online Tucker decomposition enhanced by meta-learning. The method comprises the following steps: obtaining a multidimensional network traffic tensor at time t, performing Tucker decomposition to obtain a factor matrix and a core tensor at time t, and then dimensionalizing the data; updating the factor matrix at time t+1 using incremental data at time t+1; performing singular value decomposition on the multidimensional network traffic tensor at time t+1; calculating the cumulative singular values ​​and the minimum number of singular values ​​required to reach 80% of the tensor norm at time t+1 as the low-rank feature representation dimension at time t+1; dynamically determining the rank of each dimension, iteratively optimizing the core tensor until convergence; constructing an anomaly detection framework, using the block coordinate descent method to decouple online network traffic anomaly detection into alternating optimization of the tensor decomposition subproblem and the anomaly detection subproblem, and combining a sparse residual screening mechanism to identify network anomalies based on the updated factor matrix and core tensor. The present invention can accurately and quickly detect abnormal traffic.

Description

Technical Field

[0001] The present invention relates to the fields of meta-learning and network traffic anomaly detection, and in particular to a network anomaly detection method based on meta-learning enhanced online Tucker decomposition. Background Art

[0002] With the rapid development of modern network infrastructure, ensuring the security, reliability, and efficiency of network services has become a core issue in network management. Network traffic anomaly detection, as a key means of identifying malicious behavior, performance degradation, and system failures, plays a vital role in network security and operations management. Faced with the ever-increasing volume and complexity of network data, identifying anomalous patterns in high-dimensional, rapidly changing traffic data in real time has become a major challenge that needs to be addressed. Efficient and accurate anomaly detection not only helps to promptly block potential security threats but also provides important support for intelligent scheduling and service optimization in large-scale networks. Summary of the Invention

[0003] The purpose of the present invention is to provide a network anomaly detection method based on meta-learning enhanced online Tucker decomposition, which can accurately and quickly detect abnormal traffic and improve the anomaly detection effect.

[0004] The technical solution adopted in the present invention is:

[0005] The network anomaly detection method based on meta-learning enhanced online Tucker decomposition includes the following steps:

[0006] Step 1: Obtain the multidimensional network traffic tensor at time t and perform Tucker decomposition to obtain the factor matrix and core tensor at time t, and then expand the dimension of the factor matrix and core tensor;

[0007] Step 2: Use the incremental data of the multidimensional network traffic tensor at time t+1 to update the factor matrix at time t to obtain the factor matrix at time t+1;

[0008] Step 3: Perform singular value decomposition on the multi-dimensional network traffic tensor at time t+1; count the accumulated singular values ​​and the arrival time The minimum number of singular values ​​required to achieve 80% of the tensor norm is used as the low-rank feature representation dimension at time t+1; the rank of each dimension is dynamically determined, and the core tensor is iteratively optimized until convergence is reached;

[0009] Step 4: Build an anomaly detection framework for streaming tensors. Use block coordinate descent to decouple tensor decomposition and anomaly identification tasks into two alternating optimization sub-problems. Combined with the sparse residual screening mechanism, identify network anomalies based on the updated factor matrix and core tensor.

[0010] Furthermore, in step 1, the multidimensional network traffic tensor at time t is obtained And perform Tucker decomposition to obtain the N factor matrices of the multidimensional network traffic tensor at time t and core tensors ; , N is the dimension of the multidimensional network traffic tensor; if the dimension of the multidimensional network traffic tensor at time t+1 increases, the core tensor at time t and the factor matrix of the corresponding dimension are expanded, the increased dimension is filled with random numbers, and the dimension is expanded to the dimension of the tensor at time t+1;

[0011] Specifically, the multidimensional network traffic tensor at time t in step 1 is Any dimension All time increase And each dimension grows by , ; Then the multi-dimensional network traffic tensor at time t+1 is .

[0012] Furthermore, in step 2, the multi-dimensional network traffic tensor at time t+1 is divided into sub-tensors, and divide the sub-tensors of the newly added data at time t+1 into N classes; the sub-tensor data on each class is iteratively updated to obtain the extended factor matrix at time t+1 and fused to generate the meta-factor matrix at time t+1; the meta-factor matrix at time t+1 is concatenated and orthogonalized with the factor matrix at time t to generate the factor matrix at time t+1; where N is the dimension of the multidimensional network traffic tensor.

[0013] Furthermore, step 2 specifically includes the following steps:

[0014] Step 2-1, divide the multi-dimensional network traffic tensor at time t+1 into subtensors;

[0015] Step 2-2, follow the preset rules to The sub-tensors belonging to incremental data in the sub-tensors are divided into N classes of block sub-tensors;

[0016] Step 2-3, use the sub-tensor data on the block sub-tensor of each class to iteratively update and obtain the expansion factor matrix at time t+1;

[0017] Steps 2-4: In the meta-update phase, the expanded factor matrix updated based on the block sub-tensors of N classes at time t+1 is fused to obtain the meta-factor matrix at time t+1. The meta-factor matrix at time t+1 and the factor matrix at the previous time (time t) are concatenated and orthogonalized to generate the factor matrix at time t+1, enabling the model to adapt and migrate to the newly added structure.

[0018] Furthermore, the multidimensional network traffic tensor at time t+1 in step 2-1 Divided into Subtensors , is an N-item tuple; when = 0, the sub-tensor , the rest The sub-tensor is the incremental data at time t+1;

[0019] Further, in step 2-2, according to The number of values ​​​​taken as 1 will be The sub-tensors are divided into N categories, denoted as .

[0020] Furthermore, step 3 specifically includes the following steps:

[0021] Step 3-1, convert the tensor Tucker decomposition into the following form: , we get the inequality ; Substitution , and then get , where the tensor The expression is as follows: ;

[0022] Step 3-2, based on the matrix The singular value calculation of the multidimensional network traffic tensor at time t+1 Multilinear rank , the specific expression is as follows:

[0023] ;

[0024] Among them, the matrix is a tensor of Mold expansion, yes The singular values ​​of The optimal solution is Before The left singular eigenvectors corresponding to the singular values ​​are composed, and then the Multilinear rank set ;

[0025] Step 3-3, core tensor initialized at time t+1 Update process,

[0026] ;

[0027] when And at that time, ;when hour, , ;

[0028] Step 3-4, determine whether it is satisfied ; If yes, complete the core tensor iteration; otherwise, continue iterating and executing steps 2-3.

[0029] Specifically, taking the modal number as 3 as an example, the core tensor The update expression is:

[0030]

[0031] Furthermore, step 4 specifically includes the following steps:

[0032] Step 4-1: Use the block coordinate descent strategy to decouple online network traffic anomaly detection into alternating optimization of tensor decomposition subproblems and anomaly detection subproblems;

[0033] Tensor decomposition subproblem:

[0034] ;

[0035] (3-1)

[0036] Anomaly detection sub-problem:

[0037] ;

[0038] (3-2)

[0039] in, is the noisy network traffic tensor collected from sensors, is the network traffic tensor obtained from the tensor decomposition subproblem in the previous step, is the factor matrix at time t+1, is the core tensor at time t+1, is the tensor rank at time t+1;

[0040] Step 4-2, alternately solve the tensor decomposition subproblem and the anomaly detection subproblem until the solutions of the tensor decomposition subproblem and the anomaly detection subproblem converge;

[0041] Among them, in the anomaly detection sub-problem, according to the error tensor Update outliers , and solves to:

[0042] (3-3)

[0043] in, , yes Middle Large value, is an outlier Elements, is the error tensor Elements of

[0044] In each iteration, the maximum The errors are considered outliers and are placed in The middle ones are excluded from the next round of low-rank fitting;

[0045] Step 4-3, when the anomaly detection sub-problem converges and obtains After that, use Detect abnormal entries in the current monitoring data.

[0046] The present invention adopts the above technical solution, and compared with the existing technology, the beneficial effects include: 1) Proposing an online Tucker decomposition model that integrates a meta-learning mechanism. Aiming at the structural characteristics of the expansion of the streaming network traffic tensor in multiple dimensions, the new tensor is divided into multiple local expansion subtasks. The algorithm learns the adaptive factor matrix in the expanded dimension field and generates a global expanded meta-factor matrix through meta-update, thereby achieving rapid adaptation and structural migration of the newly added dimensions, improving the efficiency and stability of online modeling. 2) Introducing a dynamic rank selection mechanism based on singular value features. The present invention transforms the rank selection problem of the multimodal tensor into a singular value analysis of its subspace representation after linear projection in each modal direction, and by setting the lower bound threshold of the sum of the singular values, it realizes the dynamic estimation of the effective rank of each modality and adaptively adjusts the multilinear rank of each modality. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments;

[0048] Figure 1 Schematic diagram of the flow of the network anomaly detection method based on meta-learning enhanced online Tucker decomposition of the present invention. DETAILED DESCRIPTION

[0049] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0050] like Figure 1 As shown, the present invention discloses a network anomaly detection method based on meta-learning enhanced online Tucker decomposition, which includes the following steps:

[0051] Step 1: Obtain the multidimensional network traffic tensor at time t and perform Tucker decomposition to obtain the factor matrix and core tensor at time t, and then expand the dimension of the factor matrix and core tensor;

[0052] Step 2: Use the incremental data of the multidimensional network traffic tensor at time t+1 to update the factor matrix at time t to obtain the factor matrix at time t+1;

[0053] Step 3: Perform singular value decomposition on the multi-dimensional network traffic tensor at time t+1; count the accumulated singular values ​​and the arrival time The minimum number of singular values ​​required to achieve 80% of the tensor norm is used as the low-rank feature representation dimension at time t+1; the rank of each dimension is dynamically determined, and the core tensor is iteratively optimized until convergence is reached;

[0054] Step 4: Build an anomaly detection framework for streaming tensors. Use block coordinate descent to decouple tensor decomposition and anomaly identification tasks into two alternating optimization sub-problems. Combined with the sparse residual screening mechanism, identify network anomalies based on the updated factor matrix and core tensor.

[0055] Furthermore, in step 1, the multidimensional network traffic tensor at time t is obtained And perform Tucker decomposition to obtain the N factor matrices of the multidimensional network traffic tensor at time t and core tensors ; , N is the dimension of the multidimensional network traffic tensor; if the dimension of the multidimensional network traffic tensor at time t+1 increases, the core tensor and the factor matrix of the corresponding dimension are expanded, the increased dimension is filled with random numbers, and the dimension is expanded to the dimension of the tensor at time t+1;

[0056] Specifically, the multidimensional network traffic tensor at time t in step 1 is Any dimension All time increase And each dimension grows by , ; Then the multi-dimensional network traffic tensor at time t+1 is .

[0057] Furthermore, in step 2, the multi-dimensional network traffic tensor at time t+1 is divided into sub-tensors, and divide the sub-tensors of the newly added data at time t+1 into N classes; use the sub-tensor data on each class to iteratively update the expanded factor matrix at time t+1 and fuse them to generate the meta-factor matrix at time t+1, and concatenate the meta-factor matrix at time t with the factor matrix at time t to orthogonalize and generate the factor matrix at time t+1.

[0058] Furthermore, step 2 specifically includes the following steps:

[0059] Step 2-1, divide the multi-dimensional network traffic tensor at time t+1 into subtensors;

[0060] Step 2-2, follow the preset rules to The sub-tensors belonging to incremental data in the sub-tensors are divided into N classes of block sub-tensors;

[0061] Step 2-3, use the sub-tensor data on the block sub-tensor of each class to iteratively update and obtain the expansion factor matrix at time t+1;

[0062] Steps 2-4: In the meta-update phase, the expanded factor matrix updated based on the block sub-tensors of N classes at time t+1 is fused to obtain the meta-factor matrix at time t+1. The meta-factor matrix at time t+1 and the factor matrix at the previous time (time t) are concatenated and orthogonalized to generate the factor matrix at time t+1, enabling the model to adapt and migrate to the newly added structure.

[0063] Furthermore, the multidimensional network traffic tensor at time t+1 in step 2-1 Divided into Subtensors , is an N-item tuple; when = 0, the sub-tensor , the rest The sub-tensor is the incremental data at time t+1;

[0064] Further, in step 2-2, according to The number of values ​​​​taken as 1 will be The sub-tensors are divided into N categories, denoted as .

[0065] Furthermore, step 3 specifically includes the following steps:

[0066] Step 3-1, convert the tensor Tucker decomposition into the following form: , we get the inequality ; Substitution , and then get , where the tensor The expression is as follows: ;

[0067] Step 3-2, based on the matrix The singular value calculation of the multidimensional network traffic tensor at time t+1 Multilinear rank , the specific expression is as follows:

[0068] ;

[0069] Among them, the matrix is a tensor of Mold expansion, yes The singular values ​​of The optimal solution is Before The left singular eigenvectors corresponding to the singular values ​​are composed, and then the Multilinear rank set of ;

[0070] Step 3-3, core tensor initialized at time t+1 Update process,

[0071] ;

[0072] when And at that time, ;when hour, , ;

[0073] Specifically, continuing the above example, taking the modal number as 3 as an example, the core tensor The update expression is:

[0074] .

[0075] Step 3-4, determine whether it is satisfied ; If yes, complete the core tensor iteration; otherwise, continue iterating and executing steps 2-3.

[0076] Furthermore, step 4 specifically includes the following steps:

[0077] Step 4-1: Use the block coordinate descent strategy to decouple online network traffic anomaly detection into alternating optimization of tensor decomposition subproblems and anomaly detection subproblems;

[0078] Tensor decomposition subproblem:

[0079] ;

[0080] (3-1)

[0081] Anomaly detection sub-problem:

[0082] ;

[0083] (3-2)

[0084] in, is the noisy network traffic tensor collected from sensors, is the network traffic tensor obtained from the tensor decomposition subproblem in the previous step, is the factor matrix at time t+1, is the core tensor at time t+1, is the tensor rank at time t+1;

[0085] Step 4-2, alternately solve the tensor decomposition subproblem and the anomaly detection subproblem until the solutions of the tensor decomposition subproblem and the anomaly detection subproblem converge;

[0086] Among them, in the anomaly detection sub-problem, according to the error tensor Update outliers , and solves to:

[0087] (3-3)

[0088] in, , yes Middle Large value, is an outlier Elements, is the error tensor Elements of

[0089] In each iteration, the maximum The errors are considered outliers and are placed in The middle ones are excluded from the next round of low-rank fitting;

[0090] Step 4-3, when the anomaly detection sub-problem converges and obtains After that, use Detect abnormal entries in the current monitoring data.

[0091] The following example uses the modality number N as 3 to illustrate an online Tucker decomposition network anomaly detection method based on meta-learning enhancement, which includes the following steps:

[0092] S1: First, at each moment, the newly arrived three-dimensional network traffic tensor is divided into 8 sub-tensors, and the corresponding newly added dimension is divided into three parts. The expansion factor matrix is ​​iteratively updated on each part. In the meta-update phase, the expansion factor matrix is ​​fused to obtain the meta-factor matrix. The new global factor matrix is ​​generated by splicing the meta-factor matrix with the factor matrix of the previous moment, realizing the adaptation and migration of the model to the newly added structure. The details are as follows:

[0093] S101, set time The network traffic tensor , where the dimension All time Growth, and , ; at the moment , the newly arrived network traffic tensor ,in , Is the length of each dimension growth; the tensor Decompose into Subtensors ,in , special , the remaining sub-tensors are moments Newly added data;

[0094] S102, divide the sub-tensor into three parts, namely , and , proceed to the next expansion dimension adaptation step.

[0095] S103, pair matrix Initialize, in the task Each sub-tensor in the part According to formula (1-1), The expansion factor matrix of dimensions Update, then fix other matrices Under the premise of completing an iterative optimization process,

[0096] (1-1)

[0097] when hour, is time t The factor matrix of Tucker decomposition is hour, ;

[0098] In the meta-update step, the matrix is ​​updated according to formula 1-2 ,

[0099] (1-2)

[0100] in, ,when hour, is time t The Tucker decomposition factor matrix, when hour, ,here Corresponding to The generated expansion factor matrix; the matrix With the matrix Splice and orthogonalize along, and we get The factor matrix at time .

[0101] S2: A dynamic rank selection mechanism based on singular values ​​is introduced in the online decomposition to obtain the time Tensor, and perform singular value decomposition on it, count the cumulative singular values ​​and the time of arrival The minimum number of singular values ​​required for 80% of the tensor norm is used as the low-rank feature representation dimension at that moment. The rank of each dimension is dynamically determined, and the core tensor is iteratively optimized until convergence is reached. Specifically:

[0102] S201. Let the matrix , calculated according to formula 2-1 The multilinear rank of :

[0103] (2-1)

[0104] in, yes The singular values ​​of The optimal solution is Before The left singular eigenvectors corresponding to the singular values ​​are composed, and then the Rank ;

[0105] S202. Core Tensor The update process,

[0106] (2-2)

[0107] when hour, ,when hour, If you are not satisfied , then continue to iterate.

[0108] S3: Build an anomaly detection framework for streaming tensors, use block coordinate descent to decouple tensor decomposition and anomaly identification tasks into two alternating optimization sub-problems, and combine sparse residual screening mechanism to realize outlier identification.

[0109] Specifically, the block coordinate descent strategy is adopted to divide the original problem of online network traffic anomaly detection into two sub-problems: the tensor decomposition sub-problem in formula (3-1) and the anomaly detection sub-problem in formula (3-2). These two sub-problems are solved alternately until the solution converges.

[0110] S301. Tensor decomposition subproblem

[0111]

[0112] (3-1)

[0113] S302. Anomaly Detection Subproblem

[0114]

[0115] (3-2)

[0116] in, is the network traffic tensor with noise, is the recovered network traffic tensor;

[0117] In the anomaly detection subproblem formula (3-2), according to the error tensor Update outliers ; The solution to this problem is:

[0118] (3-3)

[0119] in , yes Middle Large value; in each round of iteration, the largest The errors are considered outliers and are placed in to exclude it from the next round of low-rank fitting; when formula 3-2 converges and obtains After that, you can use Detect abnormal entries in the current monitoring data.

[0120] The present invention adopts the above technical solution, and compared with the existing technology, the beneficial effects include: 1) Proposing an online Tucker decomposition model that integrates a meta-learning mechanism. Aiming at the structural characteristics of the expansion of the streaming network traffic tensor in multiple dimensions, the new tensor is divided into multiple local expansion subtasks. The algorithm learns the adaptive factor matrix in the expanded dimension field and generates a global expanded meta-factor matrix through meta-update, thereby achieving rapid adaptation and structural migration of the newly added dimensions, improving the efficiency and stability of online modeling. 2) Introducing a dynamic rank selection mechanism based on singular value features. The present invention transforms the rank selection problem of the multimodal tensor into a singular value analysis of its subspace representation after linear projection in each modal direction, and by setting the lower bound threshold of the sum of the singular values, it realizes the dynamic estimation of the effective rank of each modality and adaptively adjusts the multilinear rank of each modality.

[0121] Obviously, the described embodiments are part of the embodiments of the present application, rather than all of the embodiments. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other. The components of the embodiments of the present application generally described and shown in the drawings here can be arranged and designed in various different configurations. Therefore, the detailed description of the embodiments of the present application is not intended to limit the scope of the application for protection, but merely represents the selected embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

Claims

1. A network anomaly detection method based on online Tucker decomposition enhanced by meta-learning, characterized by: It includes the following steps: Step 1: Obtain the multidimensional network traffic tensor at time t and perform Tucker decomposition to obtain the factor matrix and core tensor at time t, and then expand the dimension of the factor matrix and core tensor; Step 2: Use the incremental data of the multidimensional network traffic tensor at time t+1 to update the factor matrix at time t to obtain the factor matrix at time t+1; The specific steps include: Step 2-1, divide the multi-dimensional network traffic tensor at time t+1 into sub-tensors; that is, the multidimensional network traffic tensor at time t+1 Divided into Subtensors , is an N-item tuple; when = 0, the sub-tensor , the rest The sub-tensor is the incremental data at time t+1; Step 2-2, follow the preset rules to The sub-tensors belonging to incremental data in the sub-tensors are divided into N classes of block sub-tensors; Step 2-3, use the sub-tensor data on the block sub-tensor of each class to iteratively update and obtain the expansion factor matrix at time t+1; Steps 2-4: In the meta-update phase, the extended factor matrix updated based on the block sub-tensors of N classes at time t+1 is fused to obtain the meta-factor matrix at time t+1. The meta-factor matrix at time t+1 and the factor matrix at time t are concatenated and orthogonalized to generate the factor matrix at time t+1, enabling the model to adapt and migrate to the newly added structure. Step 3: Perform singular value decomposition on the multi-dimensional network traffic tensor at time t+1; count the accumulated singular values ​​and the arrival time The minimum number of singular values ​​required to achieve 80% of the tensor norm is used as the low-rank feature representation dimension at time t+1; the rank of each dimension is dynamically determined, and the core tensor is iteratively optimized until convergence is reached. Specifically, the following steps are included: Step 3-1, convert the tensor Tucker decomposition into the following form: , to obtain the inequality ; Then substitute get , where the tensor The expression is as follows: ; Step 3-2, based on the matrix The singular value calculation of the multidimensional network traffic tensor at time t+1 Multilinear rank , the specific expression is as follows: ； Among them, the matrix is a tensor of Mold expansion, yes The singular values ​​of The optimal solution is Before The left singular eigenvectors corresponding to the singular values ​​are composed to determine Multilinear rank set of ; Step 3-3, core tensor initialized at time t+1 The update process is as follows, ； when And at that time, ;when hour, , ,in represents the element matrix; Step 3-4, determine whether it is satisfied ; If yes, complete the core tensor iteration; otherwise, continue to iterate and execute steps 2-3; Step 4: Build an anomaly detection framework for streaming tensors. Use block coordinate descent to decouple online network traffic anomaly detection into alternating optimization of tensor decomposition subproblems and anomaly detection subproblems. Combined with the sparse residual screening mechanism, identify network anomalies based on the updated factor matrix and core tensor.

2. The network anomaly detection method based on meta-learning enhanced online Tucker decomposition according to claim 1 is characterized by: In step 1, we obtain the multi-dimensional network traffic tensor at time t. And perform Tucker decomposition to obtain the N factor matrix of the multidimensional network flow tensor at time t and core tensors ; , N is the dimension of the multidimensional network traffic tensor; when the dimension of the multidimensional network traffic tensor at time t+1 increases, the core tensor at time t and the factor matrix of the corresponding dimension are expanded, the added dimension is filled with random numbers, and the dimension is expanded to the dimension corresponding to the tensor at time t+1.

3. The network anomaly detection method based on online Tucker decomposition enhanced by meta-learning according to claim 1 is characterized by: The multidimensional network traffic tensor at time t in step 1 Any dimension All time increase And each dimension grows by , ; Then the multi-dimensional network traffic tensor at time t+1 is .

4. The network anomaly detection method based on meta-learning enhanced online Tucker decomposition according to claim 1 is characterized by: In step 2, the multi-dimensional network traffic tensor at time t+1 is divided into sub-tensors, and divide the sub-tensors of the newly added data at time t+1 into N classes; the sub-tensor data on each class is iteratively updated to obtain the extended factor matrix at time t+1 and fused to generate the meta-factor matrix at time t+1; the meta-factor matrix at time t+1 is concatenated and orthogonalized with the factor matrix at time t to generate the factor matrix at time t+1; where N is the dimension of the multidimensional network traffic tensor.

5. The network anomaly detection method based on meta-learning enhanced online Tucker decomposition according to claim 1 is characterized by: In step 2-2, according to The number of values ​​​​taken as 1 will be The sub-tensors are divided into N categories, denoted as .

6. The network anomaly detection method based on online Tucker decomposition enhanced by meta-learning according to claim 1 is characterized by: Step 4 specifically includes the following steps: Step 4-1: Use the block coordinate descent strategy to decouple online network traffic anomaly detection into alternating optimization of tensor decomposition subproblems and anomaly detection subproblems; The tensor decomposition subproblem is expressed as follows: ； （3-1） The anomaly detection subproblem is expressed as follows: ； （3-2） in, is the noisy network traffic tensor collected from sensors, is the network traffic tensor obtained from the tensor decomposition subproblem, is the factor matrix at time t+1, is the core tensor at time t+1, is the tensor rank set at time t+1; Step 4-2, alternately solve the tensor decomposition subproblem and the anomaly detection subproblem until the solutions of the tensor decomposition subproblem and the anomaly detection subproblem converge; Among them, in the anomaly detection sub-problem, according to the error tensor Update outliers , and solve: （3-3） in, , yes Middle Large value, is an outlier Elements, is the error tensor Elements of In each iteration, the maximum The errors are considered outliers and are placed in The middle ones are excluded from the next round of low-rank fitting; Step 4-3, when the anomaly detection sub-problem converges and obtains After that, use Detect abnormal entries in the current monitoring data.

Images