Abnormal event detection method, device, electronic device and storage medium
By obtaining and analyzing the recorded information of hardware equipment of online ride-hailing products, and using detection models to perform real-time abnormal event detection, the problems of manual detection lag and low efficiency are solved, and automated and efficient abnormal event handling are achieved.
Patent Information
- Application Number
- CN201911414338.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2019-12-31
- Publication Date
- 2024-12-10
- Estimated Expiration
- 2039-12-31
AI Technical Summary
In the prior art, abnormal event detection of hardware equipment for online ride-hailing products relies on manual regular inspections, which have problems of lag and low detection efficiency.
By obtaining the recording information of the device during the execution of the target order, extracting the recording features and inputting the pre-trained detection model, generating abnormal detection results, real-time abnormal event detection of the target device, and improving detection efficiency through terminal equipment updating and training the model .
It realizes automated real-time abnormal event detection of target equipment, improves detection efficiency, can handle large amounts of abnormal events, and reduces the lag of manual intervention.
Smart Images
Figure CN111859101B_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of text detection technology, and in particular to an abnormal event detection method, device, electronic device and storage medium. Background Art
[0002] At present, with the rapid development of the Internet, more and more Internet products are being used by people, such as online car-hailing products. At present, online car-hailing products are usually used in conjunction with hardware devices to enable online car-hailing products to better provide services to users.
[0003] Among them, abnormal events may occur in the hardware equipment during use. At present, usually the abnormal events of the hardware equipment are checked and handled manually on a regular basis. However, the manual regular inspection method has hysteresis and low detection efficiency. Summary of the invention
[0004] In view of this, the purpose of the present application is to provide an abnormal event detection method, device, electronic device and storage medium, which can automatically identify abnormal events of target devices, realize real-time detection of target devices, and can also handle abnormal event detection of large amounts of data, thereby improving detection efficiency.
[0005] In a first aspect, an embodiment of the present application provides a method for detecting an abnormal event, the detection method comprising:
[0006] Acquire record information associated with the target order corresponding to the target device during the execution of the target order;
[0007] Determine an abnormal event corresponding to the target device based on the record information associated with the target order corresponding to the target device;
[0008] Based on the abnormal event corresponding to the target device, generate an abnormality detection result of the target device;
[0009] The abnormality detection result of the target device is sent to a first terminal device corresponding to the target device.
[0010] In a possible implementation, the acquiring the record information associated with the target order and corresponding to the target device during the execution of the target order includes:
[0011] Acquire device information corresponding to the target device, order information corresponding to the target order, and user information corresponding to the target order during the execution of the target order.
[0012] In a possible implementation, the acquiring the record information associated with the target order and corresponding to the target device during the execution of the target order includes:
[0013] Obtain at least one operation record text corresponding to the target device during the execution of the target order.
[0014] In a possible implementation, determining the abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order includes:
[0015] Extracting a record feature of the record information associated with the target order corresponding to the target device;
[0016] Inputting the record features of the record information into a pre-trained detection model to obtain the target feature distribution output by the detection model;
[0017] Based on the target feature distribution output by the detection model, an abnormal event corresponding to the target device is determined.
[0018] In a possible implementation, determining the abnormal event corresponding to the target device based on the target feature distribution output by the detection model includes:
[0019] Based on the mapping relationship between feature distribution and abnormal events, an abnormal event matching the target feature distribution is determined as the abnormal event corresponding to the target device.
[0020] In a possible implementation, determining the abnormal event corresponding to the target device based on the target feature distribution output by the detection model includes:
[0021] If there is no abnormal event matching the target characteristic distribution, sending the record information associated with the target order corresponding to the target device to the second terminal device;
[0022] Receive an abnormal event corresponding to the target device determined based on the record information and sent by the second terminal device.
[0023] In a possible implementation, extracting the record feature of the record information associated with the target order corresponding to the target device includes:
[0024] Extracting device features corresponding to the device information, order features corresponding to the order information, and user features corresponding to the user information;
[0025] The device characteristics, the order characteristics, and the user characteristics are determined as the record characteristics.
[0026] In a possible implementation, extracting the record feature of the record information associated with the target order corresponding to the target device includes:
[0027] Determining operation record texts corresponding to the same category based on the similarity between the at least one operation record text;
[0028] Based on the operation characteristics corresponding to the operation record text of each category, generate the operation characteristics corresponding to the target device;
[0029] The operating characteristics are determined as the recording characteristics.
[0030] In a possible implementation, determining the operation record text corresponding to the same category based on the similarity between the at least one operation record text includes:
[0031] For each operation record text, perform word segmentation processing on the operation record text to obtain at least one word segmentation corresponding to the operation record text;
[0032] For each segmentation corresponding to the running record text, determine the metric score corresponding to the segmentation based on the word frequency and inverse document frequency corresponding to the segmentation;
[0033] Based on the metric score corresponding to each segmentation word in each operation record text, the operation record texts corresponding to the same category are determined.
[0034] In a possible implementation, the generating the operation feature corresponding to the target device based on the operation feature corresponding to the operation record text of each category includes:
[0035] Based on the data structure corresponding to each category of the running record text, select keywords from each word segment corresponding to the running record text of the category;
[0036] Based on the keyword features of the keywords corresponding to each category, the operation features corresponding to the target device are generated.
[0037] In a possible implementation manner, after determining the abnormal event corresponding to the target device, the detection method further includes:
[0038] Receiving a standard abnormal event corresponding to the target device sent by a second terminal device; wherein the standard abnormal event is determined by the second terminal device based on record information associated with the target order corresponding to the target device;
[0039] If the standard abnormal event does not match the abnormal event corresponding to the target device, the abnormal event is updated by the standard abnormal event to obtain the standard abnormal event corresponding to the target device.
[0040] In a possible implementation, the detection method further includes:
[0041] The standard abnormal event corresponding to the target device and the record features of the record information corresponding to the target device and associated with the target order are used as new training samples to train the detection model to obtain an updated detection model.
[0042] In a possible implementation, the detection method further includes:
[0043] The abnormal event corresponding to the target device and the record features of the record information associated with the target order corresponding to the target device sent by the second terminal device are used as new training samples to train the detection model to obtain an updated detection model.
[0044] In a second aspect, an embodiment of the present application further provides an abnormal event detection device, the detection device comprising:
[0045] An acquisition module, used for acquiring record information associated with the target order corresponding to the target device during the execution of the target order;
[0046] A determination module, configured to determine an abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order;
[0047] A generating module, configured to generate an abnormality detection result of the target device based on an abnormal event corresponding to the target device;
[0048] The sending module is used to send the abnormality detection result of the target device to the first terminal device corresponding to the target device.
[0049] In a possible implementation, the acquisition module acquires the record information associated with the target order corresponding to the target device during the execution of the target order, including:
[0050] Acquire device information corresponding to the target device, order information corresponding to the target order, and user information corresponding to the target order during the execution of the target order.
[0051] In a possible implementation, the acquisition module acquires the record information associated with the target order corresponding to the target device during the execution of the target order, including:
[0052] Obtain at least one operation record text corresponding to the target device during the execution of the target order.
[0053] In a possible implementation, the determining module determines the abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order, including:
[0054] Extracting a record feature of the record information associated with the target order corresponding to the target device;
[0055] Inputting the record features of the record information into a pre-trained detection model to obtain the target feature distribution output by the detection model;
[0056] Based on the target feature distribution output by the detection model, an abnormal event corresponding to the target device is determined.
[0057] In a possible implementation, the determination module determines the abnormal event corresponding to the target device based on the target feature distribution output by the detection model, including:
[0058] Based on the mapping relationship between feature distribution and abnormal events, an abnormal event matching the target feature distribution is determined as the abnormal event corresponding to the target device.
[0059] In a possible implementation, the determination module determines the abnormal event corresponding to the target device based on the target feature distribution output by the detection model, including:
[0060] If there is no abnormal event matching the target characteristic distribution, sending the record information associated with the target order corresponding to the target device to the second terminal device;
[0061] Receive an abnormal event corresponding to the target device determined based on the record information and sent by the second terminal device.
[0062] In a possible implementation, the determining module extracts the record feature of the record information associated with the target order corresponding to the target device, including:
[0063] Extracting device features corresponding to the device information, order features corresponding to the order information, and user features corresponding to the user information;
[0064] The device characteristics, the order characteristics, and the user characteristics are determined as the record characteristics.
[0065] In a possible implementation, the determining module extracts the record feature of the record information associated with the target order corresponding to the target device, including:
[0066] Determining operation record texts corresponding to the same category based on the similarity between the at least one operation record text;
[0067] Based on the operation characteristics corresponding to the operation record text of each category, generate the operation characteristics corresponding to the target device;
[0068] The operating characteristics are determined as the recording characteristics.
[0069] In a possible implementation, the determining module determines the operation record text corresponding to the same category based on the similarity between the at least one operation record text, including:
[0070] For each operation record text, perform word segmentation processing on the operation record text to obtain at least one word segmentation corresponding to the operation record text;
[0071] For each segmentation corresponding to the running record text, determine the metric score corresponding to the segmentation based on the word frequency and inverse document frequency corresponding to the segmentation;
[0072] Based on the metric score corresponding to each segmentation word in each operation record text, the operation record texts corresponding to the same category are determined.
[0073] In a possible implementation manner, the determining module generates the operation feature corresponding to the target device based on the operation feature corresponding to each category of the operation record text, including:
[0074] Based on the data structure corresponding to each category of the running record text, select keywords from each word segment corresponding to the running record text of the category;
[0075] Based on the keyword features of the keywords corresponding to each category, the operation features corresponding to the target device are generated.
[0076] In a possible implementation, the detection method further includes:
[0077] A receiving module, configured to receive a standard abnormal event corresponding to the target device sent by a second terminal device; wherein the standard abnormal event is determined by the second terminal device based on record information associated with the target order corresponding to the target device;
[0078] An updating module is used for updating the abnormal event by using the standard abnormal event if the standard abnormal event does not match the abnormal event corresponding to the target device, so as to obtain the standard abnormal event corresponding to the target device.
[0079] In a possible implementation manner, the detection device further includes:
[0080] The first training module is used to train the detection model by taking the standard abnormal events corresponding to the target device and the record features of the record information associated with the target order corresponding to the target device as new training samples to obtain an updated detection model.
[0081] In a possible implementation manner, the detection device further includes:
[0082] The second training module is used to use the abnormal event corresponding to the target device sent by the second terminal device and the record features of the record information associated with the target order corresponding to the target device as new training samples, train the detection model, and obtain an updated detection model.
[0083] In the third aspect, an embodiment of the present application also provides an electronic device, comprising: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor communicates with the storage medium through the bus, and the processor executes the machine-readable instructions to perform the steps of the abnormal event detection method as described in any one of the first aspects.
[0084] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the abnormal event detection method as described in any one of the first aspects are executed.
[0085] The embodiments of the present application provide an abnormal event detection method, device, electronic device, and storage medium, which obtains the record information associated with the target order corresponding to the target device during the execution of the target order, determines the abnormal event corresponding to the target device based on the record information associated with the target order corresponding to the target device, and generates the abnormal detection result of the target device based on the abnormal event corresponding to the target device, and sends the abnormal detection result of the target device to the first terminal device corresponding to the target device. The present application can automatically identify the abnormal event of the target device, realize the real-time detection of the target device, and can also process the abnormal event detection of large data volume, thereby improving the detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS
[0086] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.
[0087] Figure 1a A flowchart of an abnormal event detection method provided by an embodiment of the present application is shown;
[0088] Figure 1b A schematic diagram of characteristic distribution of the detection model provided in an embodiment of the present application is shown;
[0089] Figure 2A flowchart of another abnormal event detection method provided by an embodiment of the present application is shown;
[0090] Figure 3 A flowchart of another abnormal event detection method provided by an embodiment of the present application is shown;
[0091] Figure 4 A flowchart of another abnormal event detection method provided by an embodiment of the present application is shown;
[0092] Figure 5 A flowchart of another abnormal event detection method provided by an embodiment of the present application is shown;
[0093] Figure 6 A flowchart of another abnormal event detection method provided by an embodiment of the present application is shown;
[0094] Figure 7 A flowchart of another abnormal event detection method provided by an embodiment of the present application is shown;
[0095] Figure 8 A schematic diagram of the structure of an abnormal event detection device provided in an embodiment of the present application is shown;
[0096] Fig. 9 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0097] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.
[0098] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.
[0099] In order to enable those skilled in the art to use the contents of this application, the following implementation methods are provided in conjunction with the specific application scenario "online car-hailing field". For those skilled in the art, the general principles defined herein can be applied to other embodiments and application scenarios without departing from the spirit and scope of this application. Although this application is mainly described around the "online car-hailing field", it should be understood that this is only an exemplary embodiment.
[0100] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.
[0101] The term "user" in this application includes "service providers", "service requesters" and "staff" who perform target device anomaly detection; the above-mentioned "service providers" and "drivers" can be used interchangeably to refer to individuals, entities or tools that can provide services. The above-mentioned "service requesters" and "passengers" can be used interchangeably to refer to individuals, entities or tools that can request or order services.
[0102] The following describes the abnormal event detection method provided by the embodiment of the present application by taking the target device as a camera as an example. It should be noted that the embodiment of the present application does not specifically limit the above target device.
[0103] Reference Figure 1a FIG. 1 is a flow chart of an abnormal event detection method provided in an embodiment of the present application. The method can be executed by a server. The detection method includes the following steps:
[0104] S101. Obtain record information associated with the target order corresponding to the target device during the execution of the target order.
[0105] S102: Determine an abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order.
[0106] S103: Generate an abnormality detection result of the target device based on the abnormal event corresponding to the target device.
[0107] S104: Send the abnormality detection result of the target device to a first terminal device corresponding to the target device.
[0108] The embodiment of the present application provides an abnormal event detection method, which obtains the record information associated with the target order corresponding to the target device during the execution of the target order, determines the abnormal event corresponding to the target device based on the record information associated with the target order corresponding to the target device, generates the abnormal detection result of the target device based on the abnormal event corresponding to the target device, and sends the abnormal detection result of the target device to the first terminal device corresponding to the target device. The present application can automatically identify the abnormal event of the target device, realizes the real-time detection of the target device, and can also process the abnormal event detection of large data volume, thereby improving the detection efficiency.
[0109] The following further describes the steps of an abnormal event detection method in this exemplary embodiment.
[0110] S101. Obtain record information associated with the target order corresponding to the target device during the execution of the target order.
[0111] In the embodiment of the present application, the target device is pre-installed in the operating vehicle registered with the online car-hailing platform (for example, installed inside the operating vehicle), and the driver starts the target device at the same time after starting the operating vehicle. For example, the target device is a camera, which is used to collect images inside the operating vehicle and report the images to the server.
[0112] Generally speaking, after the driver searches for the service request sent by the passenger through the service request end through the service provider end and confirms to provide the service (i.e. accept the order), the server generates the corresponding target order and records the order information of the target order.
[0113] In one implementation, the server may obtain record information associated with the target order in real time during the actual execution of the target order; in another implementation, the server may also obtain record information associated with the target order within a historical time period after the target order is completed. For example, the execution time of the target order is between 8:00 and 9:00 on December 1, 2019. Accordingly, the server obtains record information associated with the target order within the historical time period between 8:00 and 9:00 on December 1, 2019.
[0114] The acquired record information includes data with different data structures.
[0115] When the above-mentioned record information includes structured buried data, obtaining the record information means obtaining the device information corresponding to the target device, the order information corresponding to the target order, and the user information corresponding to the target order during the execution of the target order. Here, the above-mentioned device information includes the device number, device type, etc.; the order information includes the order date, current city information, starting point information, end point information, passenger ID number (Identity document, ID), driver ID, order mileage, etc.; the above-mentioned user information includes: driver gender, driver driving experience, passenger gender, etc.
[0116] When the above record information includes unstructured target device operation log data, obtaining the record information means obtaining at least one operation record text corresponding to the target device during the execution of the target order. In the embodiment of the present application, the operation record text refers to the log data recorded by the target device during operation.
[0117] S102: Determine an abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order.
[0118] In an embodiment of the present application, after obtaining the record information, the record features of the record information associated with the target order corresponding to the target device are extracted, the record features of the record information are input into a pre-trained detection model, the output result of the detection model is obtained, and based on the output result of the detection model, the abnormal event corresponding to the target device is determined.
[0119] Among them, the abnormal event corresponding to the target device can be: the image captured by the target device is abnormal, for example, the image is intentionally blocked or intermittently blocked, for example, the image is abnormal due to hardware damage of the target device, for example, the image is abnormal due to software damage of the target device.
[0120] After obtaining the record information associated with the target order corresponding to the target device during the execution of the target order, the record features of the record information are input into the trained detection model, and the abnormal event corresponding to the target device is confirmed based on the output result of the detection model. For example, it is confirmed whether the abnormal image captured by the target device is caused by occlusion factors or by an abnormality of the target device (such as hardware abnormality or software abnormality).
[0121] In an embodiment of the present application, the detection model is trained in the following manner: training samples are obtained in advance, for example, training samples are obtained by manually annotating historical record information associated with historical orders corresponding to the target device; wherein the training samples include historical record features of the above historical record information and abnormal events corresponding to the target device, the above historical record features are used as input to the detection model, and the abnormal events corresponding to the target device are used as output of the detection model, and the detection model is trained (i.e., the parameters of the detection model are trained).
[0122] After the detection model training is completed, a feature distribution will be formed inside the detection model. Through the above feature distribution, the detection model calculates the quantitative value of the group of features based on the record features of the record information associated with the target order corresponding to the target device, and outputs the conclusion. Figure 1b As shown in the figure, in the feature distribution of the detection model, dots represent image anomalies caused by occlusion factors (such as intentional occlusion), triangles represent image anomalies caused by hardware abnormalities of the target device, and the middle is the fitted separation curve. In this way, when the detection model obtains the output result corresponding to the target device based on the record features of the input record information, if the output result (that is, the above-mentioned quantized value) falls above the curve, it is determined that the abnormal image of the target device is caused by the occlusion factor, otherwise, it is caused by hardware damage of the target device.
[0123] S103: Generate an abnormality detection result of the target device based on the abnormal event corresponding to the target device.
[0124] In the embodiment of the present application, the abnormality detection result includes at least an abnormal event corresponding to the target device, and may also include a target device identifier and a target device type.
[0125] For example, the abnormal detection result is: Camera 123456, type A1, hardware damage causes the collected image to be abnormal.
[0126] S104: Send the abnormality detection result of the target device to a first terminal device corresponding to the target device.
[0127] In the embodiment of the present application, the first terminal device may include a terminal device of a staff member, may include a service provider corresponding to a driver, and may also include a service requester corresponding to a passenger.
[0128] For example, the target abnormal event detection result "Camera 123456, type A1, hardware damage causes the collected image to be abnormal" can be sent to the driver's corresponding service provider. Accordingly, the driver replaces or repairs the target device based on the abnormal detection result of the above target device received by the service provider.
[0129] Further, such as Figure 2As shown, the abnormal event detection method provided in the embodiment of the present application, the abnormal event corresponding to the target device is determined based on the record information associated with the target order corresponding to the target device, including:
[0130] S201. Extract record features of record information associated with the target order corresponding to the target device.
[0131] S202: Input the record features of the record information into a pre-trained detection model to obtain the target feature distribution output by the detection model.
[0132] S203: Determine an abnormal event corresponding to the target device based on the target feature distribution output by the detection model.
[0133] In an embodiment of the present application, the server matches the target feature distribution output by the detection model with a preset rule base, and determines the abnormal event corresponding to the target feature distribution based on the mapping relationship between the feature distribution and the abnormal event in the rule base.
[0134] Here, the abnormal events corresponding to the target device are determined based on the target feature distribution output by the detection model in the following two ways:
[0135] I. Based on the mapping relationship between feature distribution and abnormal events, determine the abnormal event matching the target feature distribution as the abnormal event corresponding to the target device.
[0136] In the embodiment of the present application, the server matches the target feature distribution with the rule base, obtains the abnormal event corresponding to the target feature distribution in the rule base, and determines the abnormal event as the abnormal event corresponding to the target device.
[0137] II. Figure 3 As shown, the determining of the abnormal event corresponding to the target device based on the target feature distribution output by the detection model includes:
[0138] S301. If there is no abnormal event matching the target feature distribution, the record information associated with the target order corresponding to the target device is sent to the second terminal device.
[0139] S302: Receive an abnormal event corresponding to the target device determined based on the record information and sent by the second terminal device.
[0140] In the embodiment of the present application, the second terminal device is a terminal device corresponding to the staff who performs abnormality detection on the target device.
[0141] In combination with step 301 to step 302, since the training samples of the detection model are limited, the feature distribution of the detection model trained based on the training samples cannot cover all situations. Accordingly, the server may be unable to determine the abnormal event corresponding to the target device based on the detection model output results.
[0142] In an embodiment of the present application, if the server determines that the target feature distribution does not exist in the rule base, it sends the record information corresponding to the target device and associated with the target order to the second terminal device. The staff determines the abnormal event corresponding to the target device based on the record information displayed by the second terminal device, and sends the determined abnormal event corresponding to the target device to the server through the second terminal device.
[0143] Further, in the embodiments of the present application, the data structure of the data included in the record information is different, and the extracted record features are different, which are described below respectively:
[0144] First, for structured buried data, the extracting the record features of the record information associated with the target order corresponding to the target device includes:
[0145] Extracting device features corresponding to the device information, order features corresponding to the order information, and user features corresponding to the user information; and determining the device features, the order features, and the user features as the record features.
[0146] Among them, the above-mentioned device characteristics include: device number, device type, etc.; order characteristics include order date, current city information, starting point information, destination information, passenger ID number (Identity document, ID), driver ID, order mileage, etc.; the above-mentioned user characteristics include: driver gender, driver driving experience, passenger gender, etc.
[0147] The above-mentioned device features, order features and user features are input into the detection model. Based on the above-mentioned device features, order features and user features, the detection model can output the target feature distribution corresponding to the above-mentioned features. Based on the target feature distribution, it can be determined whether the abnormal image taken by the target device is intentionally occluded.
[0148] For example, the record characteristics are shown in Table 1 and include:
[0149] date Device Number Device Type City Normal picture Abnormal pictures Driver gender Driver's driving experience 2019 / 6 / 28 12345678 A1 Beijing 110 110 male 5
[0150] Table 1
[0151] Second, for unstructured target device operation log data, such as Figure 4 As shown, the extracting the record features of the record information associated with the target order corresponding to the target device includes:
[0152] S401. Determine operation record texts corresponding to the same category based on the similarity between the at least one operation record text.
[0153] In the embodiment of the present application, the operation log text is the log data corresponding to the target device during operation. There are multiple operation log texts obtained, and accordingly, the server calculates the similarity between the multiple operation log texts, and clusters the multiple operation log texts based on the similarity between the multiple operation log texts.
[0154] For example, the run record text is as follows: <ffffffff814fd11a>] ? panic+0xa0 / 0x168(text1);
[0155] [ <ffffffff810dadb0>] ?watchdog_timer_fn+0x0 / 0x1d0(text2);
[0156] [ <ffffffff810daf6d>] ? watchdog_timer_fn+0x1bd / 0x1d0(text3);
[0157] [ <ffffffff8109684e>] ?__run_hrtimer+0x8e / 0x1a0(text4);
[0158] [ <ffffffff81012bd9>] ? read_tsc+0x9 / 0x20 (text5);
[0159] [ <ffffffff81096bf6>] ? hrtimer_interrupt+0xe6 / 0x250 (text6);
[0160] [ <ffffffffa0259780>] ? fcluster_timer_process+0x0 / 0x1b0 [fcluster](text7);
[0161] [ <ffffffff81505bdb>] ? smp_apic_timer_interrupt+0x6b / 0x9b(text8);
[0162] [ <ffffffff8100bc13>] ? apic_timer_interrupt+0x13 / 0x20(text9);
[0163] [ <ffffffff8127e4ef>] ?__write_lock_failed+0xf / 0x20(text10);
[0164] [ <ffffffff81500147>] ? _write_lock+0x17 / 0x20 (text 11).
[0165] In an embodiment of the present application, the server calculates the text similarity between the above-mentioned text 1 to text 11, and determines the operation record texts in the same category. For example, the clustering result is: text 1 is category 1, text 2~text 3 is category 2, text 4~text 6 is category 3, text 5~text 9 is category 4, and text 10~text 11 is category 5.
[0166] S402: Generate the operation characteristics corresponding to the target device based on the operation characteristics corresponding to the operation record text of each category.
[0167] In an embodiment of the present application, for each category of operation record text, each word segment corresponding to the operation record text of that category is extracted, and keywords are selected from each word segment. Based on the keywords corresponding to each category, the keyword features of the corresponding keywords are matched with the preset feature template to generate the operation features corresponding to the target device that matches the feature template.
[0168] S403: Determine the operation feature as the record feature.
[0169] In an embodiment of the present application, the generated operating characteristics corresponding to the target device that matches the feature template are used as input characteristics and input into the detection model. The detection model can output a target feature distribution corresponding to the target device based on the above input characteristics, and determine whether the abnormal image taken by the target device is caused by a hardware abnormality of the target device based on the target feature distribution; or, determine whether the abnormal image taken by the target device is caused by a software abnormality of the target device based on the target feature distribution.
[0170] Further, such as Figure 5 As shown, in the abnormal event detection method provided in the embodiment of the present application, the determining of the operation record text corresponding to the same category based on the similarity between the at least one operation record text includes:
[0171] S501 . For each operation record text, perform word segmentation processing on the operation record text to obtain at least one word segmentation corresponding to the operation record text.
[0172] In the embodiment of the present application, for each operation log text, if the operation log text is a Chinese operation log text, the server extracts the segmentation words in the Chinese text based on the Language Technology Platform (LTP) tool; if the operation log text is an English operation log text, the server extracts the segmentation words in the English operation log text based on the coreNLP tool. After extracting the segmentation words corresponding to the operation log text, the stop words in the segmentation words are removed to obtain at least one segmentation word corresponding to the operation log text.
[0173] The above processing is performed on each acquired operation record text to obtain at least one word segmentation corresponding to each operation record text.
[0174] S502: For each word segment corresponding to the running record text, determine a metric score corresponding to the word segment based on the word frequency and inverse document frequency corresponding to the word segment.
[0175] In an embodiment of the present application, after obtaining the similarity corresponding to each operation record text, for each word segment corresponding to each operation record text, the word frequency and inverse document frequency corresponding to the word segment are obtained, and the word frequency and inverse document frequency corresponding to the word segment are input into a pre-trained TF-IDF model to obtain the metric score corresponding to the word segment.
[0176] The above processing is performed on each word segment corresponding to each running record text to obtain the metric score corresponding to each word segment, that is, the TF-IDF score.
[0177] S503: Determine the operation record texts corresponding to the same category based on the metric score corresponding to each segmentation word in each operation record text.
[0178] In an embodiment of the present application, based on the measurement scores corresponding to each word respectively corresponding to each operation record text in the multiple operation record texts, the distance or similarity measurement between the multiple operation record texts is calculated, and the operation record texts corresponding to the same category are determined based on the distance and similarity measurement.
[0179] Further, such as Figure 6 As shown, in the abnormal event detection method provided in the embodiment of the present application, the operation characteristics corresponding to the operation record text of each category are generated to generate the operation characteristics corresponding to the target device, including:
[0180] S601 . Based on the data structure corresponding to the operation record text of each category, select keywords from each word segment corresponding to the operation record text of the category.
[0181] In an embodiment of the present application, for the above classification results, text 1 is category 1, text 2 to text 3 are category 2, text 4 to text 6 are category 3, text 5 to text 9 are category 4, and text 10 to text 11 are category 5. Based on the data structure corresponding to the operation record text of each category, keywords corresponding to the content semantic information are selected from each word segment corresponding to the operation record text of the category.
[0182] for example,[ <ffffffff814fd11a>] ? panic+0xa0 / 0x168 (text 1), <fffffxxxxx>The memory address is not a keyword, "+0xe6 / 0x250" represents the address offset and is not a keyword, but "panic" represents the abnormal content and is a keyword.
[0183] Through the above method, the selected keywords are as follows: the keyword corresponding to the running record text in category 1 is: "panic", the keyword corresponding to the running record text in category 2 is "watchdog_timer_fn", the keyword corresponding to the running record text in category 3 is "__run_hrtimer"... The keywords corresponding to the running record text in category 5 are "__write_lock_failed" and "_write_lock".
[0184] S602: Generate operation features corresponding to the target device based on keyword features of the keywords corresponding to each category.
[0185] In an embodiment of the present application, the server includes a feature template, and the feature template includes a feature combination corresponding to keywords, for example, "panic, __write_lock_failed, _write_lock". This specific order of combination corresponds to a specific exception type. Accordingly, based on the keywords corresponding to the above categories, the feature combination corresponding to the target device is obtained as "panic, __write_lock_failed, _write_lock", and the operating characteristics corresponding to the feature combination "panic, __write_lock_failed, _write_lock" are used as record features (i.e., input features of the detection model).
[0186] Further, such as Figure 7 As shown, the abnormal event detection method provided in the embodiment of the present application, after determining the abnormal event corresponding to the target device, the detection method further includes:
[0187] S701. Receive a standard abnormal event corresponding to the target device sent by a second terminal device; wherein the standard abnormal event is determined by the second terminal device based on record information associated with the target order corresponding to the target device.
[0188] S702: If the standard abnormal event does not match the abnormal event corresponding to the target device, update the abnormal event by using the standard abnormal event to obtain the standard abnormal event corresponding to the target device.
[0189] In combination with step 701 to step 702, the staff can verify the abnormal event corresponding to the target device automatically determined by the server. The specific verification process is as follows:
[0190] Based on the record information associated with the target order corresponding to the target device, the standard abnormal event corresponding to the target device is determined, and then the standard abnormal event is compared with the abnormal event corresponding to the target device determined by the server. If the two do not match, the inspection fails, and it is determined that the recognition result of the server is inaccurate. Accordingly, the abnormal event corresponding to the target device is updated through the standard abnormal event to obtain the standard abnormal event corresponding to the target device.
[0191] Accordingly, in the abnormal event detection method provided in the embodiment of the present application, the detection method further includes:
[0192] The standard abnormal event corresponding to the target device and the record features of the record information corresponding to the target device and associated with the target order are used as new training samples to train the detection model to obtain an updated detection model.
[0193] That is to say, after verification, if the recognition result of the server is inaccurate and has been updated, the detection model can be updated based on the recognition result. That is, the standard abnormal events corresponding to the target device and the record features of the record information associated with the target order corresponding to the target device are used as new training samples to train the detection model (that is, update the detection model) to obtain an updated detection model.
[0194] In the embodiment of the present application, updating the detection model based on the verified results can improve the accuracy of the output results of the detection model.
[0195] Furthermore, the abnormal event detection method provided in the embodiment of the present application further includes:
[0196] The abnormal event corresponding to the target device and the record features of the record information associated with the target order corresponding to the target device sent by the second terminal device are used as new training samples to train the detection model to obtain an updated detection model.
[0197] In practice, due to the limited training samples of the detection model, the feature distribution of the trained detection model cannot cover all situations. Accordingly, the server may be unable to determine the abnormal event corresponding to the target device based on the output of the detection model, that is, there is no feature distribution in the rule base that matches the target feature distribution output by the detection model. At this time, the second terminal device determines the abnormal event corresponding to the target device and returns it to the server.
[0198] In this case, the abnormal event corresponding to the target device sent by the second terminal device and the record features of the record information associated with the target order corresponding to the target device are used as new training samples to train the detection model (i.e., update the detection model) to obtain the updated detection model.
[0199] In the embodiment of the present application, updating the detection model based on the recognition result of the second terminal device can improve the detection model and improve the comprehensiveness of the detection model coverage. In addition, the server performs abnormal event detection in combination with the detection model, and can handle abnormal event detection of large amounts of data, thereby improving detection efficiency.
[0200] The embodiment of the present application provides an abnormal event detection method, which obtains the record information associated with the target order corresponding to the target device during the execution of the target order, determines the abnormal event corresponding to the target device based on the record information associated with the target order corresponding to the target device, generates the abnormal detection result of the target device based on the abnormal event corresponding to the target device, and sends the abnormal detection result of the target device to the first terminal device corresponding to the target device. The present application can automatically identify the abnormal event of the target device, realizes the real-time detection of the target device, and can also process the abnormal event detection of large data volume, thereby improving the detection efficiency.
[0201] Based on the same inventive concept, an abnormal event detection device corresponding to the abnormal event detection method provided in the above embodiment is also provided in the embodiment of the present application. Since the principle of solving the problem by the device in the embodiment of the present application is similar to the abnormal event detection method provided in the embodiment of the present application, the implementation of the device can refer to the implementation of the method, and the repeated parts will not be repeated.
[0202] Reference Figure 8 As shown, an abnormal event detection device provided in an embodiment of the present application, the detection device includes:
[0203] The acquisition module 801 is used to acquire the record information associated with the target order corresponding to the target device during the execution of the target order;
[0204] A determination module 802, configured to determine an abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order;
[0205] A generating module 803, configured to generate an abnormality detection result of the target device based on the abnormal event corresponding to the target device;
[0206] The sending module 804 is used to send the abnormality detection result of the target device to the first terminal device corresponding to the target device.
[0207] In a possible implementation, the acquisition module 801 acquires the record information associated with the target order corresponding to the target device during the execution of the target order, including:
[0208] Acquire device information corresponding to the target device, order information corresponding to the target order, and user information corresponding to the target order during the execution of the target order.
[0209] In a possible implementation, the acquisition module 801 acquires the record information associated with the target order corresponding to the target device during the execution of the target order, including:
[0210] Obtain at least one operation record text corresponding to the target device during the execution of the target order.
[0211] In a possible implementation, the determination module 802 determines the abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order, including:
[0212] Extracting a record feature of the record information associated with the target order corresponding to the target device;
[0213] Inputting the record features of the record information into a pre-trained detection model to obtain the target feature distribution output by the detection model;
[0214] Based on the target feature distribution output by the detection model, an abnormal event corresponding to the target device is determined.
[0215] In a possible implementation, the determination module 802 determines the abnormal event corresponding to the target device based on the target feature distribution output by the detection model, including:
[0216] Based on the mapping relationship between feature distribution and abnormal events, an abnormal event matching the target feature distribution is determined as the abnormal event corresponding to the target device.
[0217] In a possible implementation, the determination module 802 determines the abnormal event corresponding to the target device based on the target feature distribution output by the detection model, including:
[0218] If there is no abnormal event matching the target characteristic distribution, sending the record information associated with the target order corresponding to the target device to the second terminal device;
[0219] Receive an abnormal event corresponding to the target device determined based on the record information and sent by the second terminal device.
[0220] In a possible implementation, the determination module 802 extracts the record features of the record information associated with the target order corresponding to the target device, including:
[0221] Extracting device features corresponding to the device information, order features corresponding to the order information, and user features corresponding to the user information;
[0222] The device characteristics, the order characteristics, and the user characteristics are determined as the record characteristics.
[0223] In a possible implementation, the determination module 802 extracts the record features of the record information associated with the target order corresponding to the target device, including:
[0224] Determining operation record texts corresponding to the same category based on the similarity between the at least one operation record text;
[0225] Based on the operation characteristics corresponding to the operation record text of each category, generate the operation characteristics corresponding to the target device;
[0226] The operating characteristics are determined as the recording characteristics.
[0227] In a possible implementation, the determining module 802 determines the operation record text corresponding to the same category based on the similarity between the at least one operation record text, including:
[0228] For each operation record text, perform word segmentation processing on the operation record text to obtain at least one word segmentation corresponding to the operation record text;
[0229] For each segmentation corresponding to the running record text, determine the metric score corresponding to the segmentation based on the word frequency and inverse document frequency corresponding to the segmentation;
[0230] Based on the metric score corresponding to each segmentation word in each operation record text, the operation record texts corresponding to the same category are determined.
[0231] In a possible implementation, the determination module 802 generates the operation feature corresponding to the target device based on the operation feature corresponding to each category of the operation record text, including:
[0232] Based on the data structure corresponding to each category of the running record text, select keywords from each word segment corresponding to the running record text of the category;
[0233] Based on the keyword features of the keywords corresponding to each category, the operation features corresponding to the target device are generated.
[0234] In a possible implementation manner, the detection device further includes:
[0235] A receiving module, configured to receive a standard abnormal event corresponding to the target device sent by a second terminal device; wherein the standard abnormal event is determined by the second terminal device based on record information associated with the target order corresponding to the target device;
[0236] An updating module is used for updating the abnormal event by using the standard abnormal event if the standard abnormal event does not match the abnormal event corresponding to the target device, so as to obtain the standard abnormal event corresponding to the target device.
[0237] In a possible implementation manner, the detection device further includes:
[0238] The first training module is used to train the detection model by taking the standard abnormal events corresponding to the target device and the record features of the record information associated with the target order corresponding to the target device as new training samples to obtain an updated detection model.
[0239] In a possible implementation manner, the detection device further includes:
[0240] The second training module is used to use the abnormal event corresponding to the target device sent by the second terminal device and the record features of the record information associated with the target order corresponding to the target device as new training samples, train the detection model, and obtain an updated detection model.
[0241] The embodiment of the present application provides an abnormal event detection device, which obtains the record information associated with the target order corresponding to the target device during the execution of the target order, determines the abnormal event corresponding to the target device based on the record information associated with the target order corresponding to the target device, generates the abnormal detection result of the target device based on the abnormal event corresponding to the target device, and sends the abnormal detection result of the target device to the first terminal device corresponding to the target device. The present application can automatically identify the abnormal event of the target device, realize the real-time detection of the target device, and can also handle the abnormal event detection of large data volume, thereby improving the detection efficiency.
[0242] like Fig. 9 As shown, an electronic device 900 provided in an embodiment of the present application includes: a processor 901, a memory 902 and a bus, wherein the memory 902 stores machine-readable instructions executable by the processor 901. When the electronic device is running, the processor 901 communicates with the memory 902 through the bus, and the processor 901 executes the machine-readable instructions to perform the steps of the abnormal event detection method provided in the above embodiment.
[0243] Specifically, the above-mentioned memory 902 and processor 901 can be general-purpose memories and processors, which are not specifically limited here. When the processor 901 runs the computer program stored in the memory 902, it can execute the abnormal event detection method corresponding to the above-mentioned embodiment.
[0244] Corresponding to the above-mentioned abnormal event detection method, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the abnormal event detection method provided in the above-mentioned embodiment are executed.
[0245] Those skilled in the art can clearly understand that, for the convenience and simplicity of description, the specific working process of the system and device described above can refer to the corresponding process in the method embodiment, and will not be repeated in this application. In the several embodiments provided in this application, it should be understood that the disclosed system, device and method can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of devices or modules, which can be electrical, mechanical or other forms.
[0246] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.
[0247] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0248] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a non-volatile computer-readable storage medium that is executable by a processor. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the detection method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as USB flash drives, mobile hard drives, ROM, RAM, magnetic disks, or optical disks.
[0249] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.< / fffffxxxxx>
Claims
1. A method for detecting abnormal events, characterized in that: The detection method comprises: Acquire record information associated with the target order corresponding to the target device during the execution of the target order; Based on the record information corresponding to the target device and associated with the target order, determine the abnormal event corresponding to the target device; the record information at least includes the device information corresponding to the target device, the order information corresponding to the target order, the user information corresponding to the target order, and at least one operation record text corresponding to the target device; the abnormal event at least includes: the image abnormality caused by the hardware damage of the target device and the image abnormality caused by the software damage of the target device; Based on the abnormal event corresponding to the target device, generating an abnormality detection result of the target device; the abnormality detection result at least includes: the abnormal event corresponding to the target device, the target device identifier and the target device type; Sending the abnormality detection result of the target device to a first terminal device corresponding to the target device; The determining, based on the record information associated with the target order and corresponding to the target device, an abnormal event corresponding to the target device, includes: Extracting a record feature of the record information associated with the target order corresponding to the target device; Inputting the record features of the record information into a pre-trained detection model to obtain the target feature distribution output by the detection model; Determining an abnormal event corresponding to the target device based on the target feature distribution output by the detection model; The determining, based on the target feature distribution output by the detection model, an abnormal event corresponding to the target device, comprises: If there is no abnormal event matching the target characteristic distribution, sending the record information associated with the target order corresponding to the target device to the second terminal device; Receive an abnormal event corresponding to the target device determined based on the record information and sent by the second terminal device.
2. The abnormal event detection method according to claim 1, characterized in that: The determining, based on the target feature distribution output by the detection model, an abnormal event corresponding to the target device, comprises: Based on the mapping relationship between feature distribution and abnormal events, an abnormal event matching the target feature distribution is determined as the abnormal event corresponding to the target device.
3. The abnormal event detection method according to claim 1, characterized in that: The extracting the record feature of the record information associated with the target order corresponding to the target device includes: Extracting device features corresponding to the device information, order features corresponding to the order information, and user features corresponding to the user information; The device characteristics, the order characteristics, and the user characteristics are determined as the record characteristics.
4. The abnormal event detection method according to claim 1, characterized in that: The extracting the record feature of the record information associated with the target order corresponding to the target device includes: Determining operation record texts corresponding to the same category based on the similarity between the at least one operation record text; Based on the operation characteristics corresponding to the operation record text of each category, generate the operation characteristics corresponding to the target device; The operating characteristics are determined as the recording characteristics.
5. The abnormal event detection method according to claim 4, characterized in that: The step of determining the operation record text corresponding to the same category based on the similarity between the at least one operation record text comprises: For each operation record text, perform word segmentation processing on the operation record text to obtain at least one word segmentation corresponding to the operation record text; For each segmentation corresponding to the running record text, determine the metric score corresponding to the segmentation based on the word frequency and inverse document frequency corresponding to the segmentation; Based on the metric score corresponding to each segmentation word in each operation record text, the operation record texts corresponding to the same category are determined.
6. The abnormal event detection method according to claim 4, characterized in that: The step of generating the operation feature corresponding to the target device based on the operation feature corresponding to the operation record text of each category includes: Based on the data structure corresponding to each category of the running record text, select keywords from each word segment corresponding to the running record text of the category; Based on the keyword features of the keywords corresponding to each category, the operation features corresponding to the target device are generated.
7. The abnormal event detection method according to claim 1, characterized in that: After determining the abnormal event corresponding to the target device, the detection method further includes: Receiving a standard abnormal event corresponding to the target device sent by a second terminal device; wherein the standard abnormal event is determined by the second terminal device based on record information associated with the target order corresponding to the target device; If the standard abnormal event does not match the abnormal event corresponding to the target device, the abnormal event is updated by the standard abnormal event to obtain the standard abnormal event corresponding to the target device.
8. The abnormal event detection method according to claim 7, characterized in that: The detection method further comprises: The standard abnormal event corresponding to the target device and the record features of the record information corresponding to the target device and associated with the target order are used as new training samples to train the detection model to obtain an updated detection model.
9. The abnormal event detection method according to claim 2, characterized in that: The detection method further comprises: The abnormal event corresponding to the target device and the record features of the record information associated with the target order corresponding to the target device sent by the second terminal device are used as new training samples to train the detection model to obtain an updated detection model.
10. An abnormal event detection device, characterized in that: The detection device comprises: An acquisition module, used for acquiring record information associated with the target order corresponding to the target device during the execution of the target order; A determination module, configured to determine an abnormal event corresponding to the target device based on the record information corresponding to the target device and associated with the target order; the record information at least includes device information corresponding to the target device, order information corresponding to the target order, user information corresponding to the target order, and at least one operation record text corresponding to the target device; the abnormal event at least includes: image abnormality caused by hardware damage of the target device and image abnormality caused by software damage of the target device; A generating module, configured to generate an abnormality detection result of the target device based on the abnormal event corresponding to the target device; the abnormality detection result at least includes: the abnormal event corresponding to the target device, the target device identifier and the target device type; A sending module, used to send the abnormality detection result of the target device to a first terminal device corresponding to the target device; The determination module includes: extracting a record feature of the record information associated with the target order corresponding to the target device; Inputting the record features of the record information into a pre-trained detection model to obtain the target feature distribution output by the detection model; Determining an abnormal event corresponding to the target device based on the target feature distribution output by the detection model; The determining module further includes: If there is no abnormal event matching the target characteristic distribution, sending the record information associated with the target order corresponding to the target device to the second terminal device; Receive an abnormal event corresponding to the target device determined based on the record information and sent by the second terminal device.
11. An electronic device, characterized in that: include: A processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the storage medium communicate via the bus, and the processor executes the machine-readable instructions to perform the steps of the abnormal event detection method as described in any one of claims 1 to 9.
12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the abnormal event detection method according to any one of claims 1 to 9 are executed.