Method and device for determining abnormality determination threshold

Abstract

The embodiment of the present application provides a method and device for determining an abnormality determination threshold value, the method comprising: performing an abnormality measurement operation on a target object to obtain an abnormality measurement matrix; calculating the data distribution characteristics of the abnormality measurement matrix; and determining the abnormality determination threshold value of the target object based on the data distribution characteristics of the abnormality measurement matrix. The present application solves the problem of fuzzy threshold limit determination in the abnormal object determination process by calculating the abnormality measurement matrix of the target object and calculating the abnormality determination threshold value according to the data distribution characteristics of the abnormality measurement matrix, clarifies the abnormality threshold limit of the target object, and improves the accuracy of abnormal determination.

Description

Technical Field

[0001] The present application relates to the field of abnormal analysis and detection, and in particular to a method and device for determining an abnormality determination threshold. Background Art

[0002] With the development of information technology, the demand for intelligent detection has also increased rapidly, and anomaly analysis has become the main task of intelligent detection. When performing anomaly analysis, the anomaly measurement of the target object can be achieved through distance-based algorithms, pattern-based algorithms and other methods. However, the threshold division of determining whether the detection object is abnormal in the existing methods does not meet the requirements of anomaly judgment. For example, in the pattern-based anomaly measurement algorithm, when the anomaly measurement based on the isolation forest algorithm is applied, an anomaly measurement value in the range of [0,1] can be obtained. The anomaly judgment standard is: when the result of the anomaly measurement value is close to 1, it is judged as abnormal, and when the result of the anomaly measurement value is close to 0, it is judged as normal; for example, when the distance-based anomaly measurement algorithm is used for anomaly analysis, the anomaly measurement value obtained is quite different from the actual anomaly measurement value, and it is impossible to directly obtain an accurate division threshold. At present, there is often a phenomenon of unclear anomaly judgment threshold in anomaly analysis methods, which leads to anomaly judgment errors. Summary of the invention

[0003] The embodiments of the present application provide a method and device for determining an abnormality determination threshold, which can clarify the abnormality threshold limit determination of a target object and improve the accuracy of abnormality determination.

[0004] In a first aspect, an embodiment of the present application provides a method for determining an abnormality determination threshold, the method comprising:

[0005] Perform anomaly measurement operation on the target object to obtain anomaly measurement matrix;

[0006] Calculating data distribution characteristics of the anomaly metric matrix;

[0007] Based on the data distribution characteristics of the abnormality metric matrix, an abnormality determination threshold of the target object is determined.

[0008] Optionally, the method further includes: acquiring an input factor of the target object, the input factor being at least one parameter required to determine that the target object is abnormal;

[0009] The abnormal measurement operation is performed on the target object to obtain an abnormal measurement matrix, including:

[0010] Calculate the observed values ​​of the input factors, and divide the input factors into normal class input factors and abnormal class input factors based on the observed values; perform abnormal measurement operations on the normal class input factors and the abnormal class input factors respectively to obtain a normal class abnormal measurement matrix and an abnormal class abnormal measurement matrix.

[0011] Optionally, calculating the data distribution characteristics of the abnormal measurement matrix includes:

[0012] Based on the observed values ​​of the input factors, the mean and standard deviation of the normal class anomaly measurement matrix and the mean and standard deviation of the abnormal class anomaly measurement matrix are calculated to obtain the normal class mean, normal class standard deviation, abnormal class mean and abnormal class standard deviation.

[0013] Optionally, determining the abnormality determination threshold of the target object based on the data distribution characteristics of the abnormality metric matrix includes:

[0014] Substitute the normal class mean, the normal class standard deviation, the abnormal class mean and the abnormal class standard deviation into the Bayesian minimum error formula p(T|w u )p(w u )=p(T|w c )p(w c ), calculating the abnormality determination threshold;

[0015] Among them, the p(w u ) is the prior probability of the normal class input factor, and the p(w c ) is the prior probability of the abnormal input factor, and the p(T|w u ) is the conditional density function of the normal class abnormality measurement matrix, and the p(T|w c ) is the conditional density function of the abnormal measurement matrix of the abnormal class, and the p(T|w u ) and the p(T|w c ) all obey the Gaussian density function distribution, and T is the abnormality determination threshold.

[0016] Optionally, the method further includes: determining an abnormality analysis result of the target object based on the abnormality determination threshold, the abnormality analysis result including normal and abnormal.

[0017] Optionally, when the measured value of the input factor of the target object is greater than or equal to the abnormality judgment threshold, the abnormality analysis result of the target object is normal; when the measured value of the input factor of the target object is less than the abnormality judgment threshold, the abnormality analysis result of the target object is abnormal.

[0018] Optionally, the method further includes: comparing actual results of the plurality of target objects with the corresponding abnormal analysis results respectively to obtain the false recognition rate; and adjusting the abnormality determination threshold based on the false recognition rate.

[0019] In a second aspect, an embodiment of the present application provides a device for determining an abnormality determination threshold, the device comprising:

[0020] A calculation unit, used to perform anomaly measurement calculation on the target object to obtain anomaly measurement matrix;

[0021] The computing unit is further used to calculate the mean and standard deviation of the abnormality metric matrix;

[0022] A determination unit is used to determine an abnormality determination threshold of the target object based on the mean value and the standard deviation.

[0023] Optionally, the device further comprises: an acquisition unit, configured to acquire an input factor of the target object, wherein the input factor is at least one parameter required for determining that the target object is abnormal;

[0024] In performing anomaly measurement operation on the target object to obtain anomaly measurement matrix, the operation unit is specifically used for:

[0025] Calculate the observed values ​​of the input factors, and divide the input factors into normal class input factors and abnormal class input factors based on the observed values; perform abnormal measurement operations on the normal class input factors and the abnormal class input factors respectively to obtain a normal class abnormal measurement matrix and an abnormal class abnormal measurement matrix.

[0026] Optionally, in calculating the data distribution characteristics of the abnormality metric matrix, the computing unit is specifically used to:

[0027] Based on the observed values ​​of the input factors, the mean and standard deviation of the normal class anomaly measurement matrix and the mean and standard deviation of the abnormal class anomaly measurement matrix are calculated to obtain the normal class mean, normal class standard deviation, abnormal class mean and abnormal class standard deviation.

[0028] Optionally, the determining unit is specifically used to: substitute the normal class mean, the normal class standard deviation, the abnormal class mean and the abnormal class standard deviation into the Bayesian minimum error formula p(T|w u )p(w u )=p(T|w c )p(w c ), calculating the abnormality determination threshold;

[0029] Among them, the p(w u ) is the prior probability of the normal class input factor, and the p(w c) is the prior probability of the abnormal input factor, and the p(T|w u ) is the conditional density function of the normal class abnormality measurement matrix, and the p(T|w c ) is the conditional density function of the abnormal measurement matrix of the abnormal class, and the p(T|w u ) and the p(T|w c ) all obey the Gaussian density function distribution, and T is the abnormality determination threshold.

[0030] Optionally, the determination unit is further used to: determine an abnormality analysis result of the target object based on the abnormality determination threshold, and the abnormality analysis result includes normal and abnormal.

[0031] Optionally, when the measured value of the input factor of the target object is greater than or equal to the abnormality judgment threshold, the abnormality analysis result of the target object is normal; when the measured value of the input factor of the target object is less than the abnormality judgment threshold, the abnormality analysis result of the target object is abnormal.

[0032] Optionally, the device further comprises a comparison unit and an adjustment unit, wherein the comparison unit is used to compare the actual results of the plurality of target objects with the corresponding abnormal analysis results respectively to obtain the false recognition rate;

[0033] The adjustment unit is used to adjust the abnormality determination threshold based on the false recognition rate.

[0034] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the program comprises instructions for executing the steps described in any method in the first aspect of the embodiment of the present application.

[0035] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for electronic data exchange, wherein the computer program enables a computer to execute part or all of the steps described in any method in the first aspect of the embodiment of the present application.

[0036] In a fifth aspect, an embodiment of the present application provides a computer program product, wherein the computer program product includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps described in any method in the first aspect of the embodiment of the present application. The computer program product may be a software installation package.

[0037] The embodiment of the present application provides a method and device for determining an abnormality determination threshold value, which obtains an abnormality measurement matrix by performing an abnormality measurement operation on a target object; calculates the data distribution characteristics of the abnormality measurement matrix; and determines the abnormality determination threshold value of the target object based on the data distribution characteristics of the abnormality measurement matrix. The present application solves the problem of fuzzy threshold limit determination in the abnormal object determination process by calculating the abnormality measurement matrix of the target object and calculating the abnormality determination threshold value according to the data distribution characteristics of the abnormality measurement matrix, clarifies the abnormality threshold limit of the target object, and improves the accuracy of abnormal determination. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0039] Figure 1 It is a flowchart of a method for determining an abnormality determination threshold provided in an embodiment of the present application;

[0040] Figure 2 It is a flowchart of another method for determining an abnormality determination threshold provided in an embodiment of the present application;

[0041] Figure 3a It is a block diagram of the functional units of a device for determining an abnormality determination threshold provided in an embodiment of the present application;

[0042] Figure 3b It is a block diagram of the functional units of another device for determining an abnormality determination threshold provided by an embodiment of the present application;

[0043] Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0044] The following will be combined with the drawings in the embodiments of the present invention to clearly and successfully describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0045] The terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0046] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present invention. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0047] In the embodiments of the present application, the electronic devices involved in the embodiments of the present application may include various handheld devices with wireless communication functions, desktop computers, vehicle-mounted devices, wearable devices (smart watches, smart bracelets, wireless headphones, augmented reality / virtual reality devices, smart glasses), computing devices or other processing devices connected to wireless modems, as well as various forms of user equipment (UE), mobile stations (MS), terminal devices (terminal devices), etc. The electronic device can also be a server.

[0048] In order to better understand the solutions of the embodiments of the present application, the relevant terms and concepts that may be involved in the embodiments of the present application are first introduced below.

[0049] Bayesian decision making is to use subjective probability estimation for some unknown states under incomplete information, and then use the Bayesian formula to correct the probability of occurrence, and finally use the expected value and the corrected probability to make the best decision. The Bayesian decision theory method is a basic method in statistical model decision making. Its basic idea is: for any vector x=(x1,x2,…,x d ) T , the class conditional probability density p(x|w i )i=1,2……c and the prior probability of the category state p(w i ), using the Bayesian formula to obtain the posterior probability of the state According to the basic decision rule Assign x to the category with the largest posterior probability. A decision method to select the optimal category label based on the misclassification loss when all relevant probabilities are known.

[0050] When performing anomaly analysis, the anomaly measurement of the target object can be achieved through distance-based algorithms, pattern-based algorithms, and other methods. However, the threshold division of determining whether the target object is abnormal in the existing methods does not meet the requirements of anomaly determination. For example, in the pattern-based anomaly measurement algorithm, when the anomaly measurement based on the isolation forest algorithm is applied, an anomaly measurement value in the range of [0,1] can be obtained. The anomaly determination standard is: when the result of the anomaly measurement value is close to 1, it is judged as abnormal, and when the result of the anomaly measurement value is close to 0, it is judged as normal; for example, when the distance-based anomaly measurement algorithm is applied to the Mahalanobis distance for anomaly analysis, the difference between the obtained anomaly measurement value and the actual anomaly measurement value is large, and it is impossible to directly obtain an accurate division threshold. At present, there is often a phenomenon of unclear anomaly determination threshold in anomaly analysis methods, which leads to anomaly determination errors.

[0051] To solve the above problems, the present application proposes a method for determining an abnormality determination threshold, which includes performing an abnormality measurement operation on a target object to obtain an abnormality measurement matrix; calculating the data distribution characteristics of the abnormality measurement matrix; and determining the abnormality determination threshold of the target object based on the data distribution characteristics of the abnormality measurement matrix. Specifically, the abnormality measurement matrix of the target object can be calculated, and the abnormality determination threshold can be calculated according to the data distribution characteristics of the abnormality measurement matrix, which solves the problem of fuzzy threshold limit determination in the abnormal object determination process, clarifies the abnormal threshold limit of the target object, and improves the accuracy of abnormal determination.

[0052] The present application is described in detail below in conjunction with specific embodiments.

[0053] See also Figure 1 , Figure 1 FIG. 1 is a flow chart of a method for determining an abnormality determination threshold provided in an embodiment of the present application. Figure 1 As shown, the method comprises the following steps:

[0054] S110, performing anomaly measurement operation on the target object to obtain an anomaly measurement matrix.

[0055] Among them, the target object can be the target of abnormal analysis, and abnormal analysis can be applied to network data, platform data, device security, device usage status, object behavior, object characteristics, etc. The application scenarios of abnormal analysis are different, and the target objects are also different. The embodiments of this application do not limit this. Specifically, when analyzing whether the user's bank account is used abnormally, the target object can be the user's bank account; when detecting whether the quality of a light bulb is qualified, the target object is the light bulb; when monitoring whether network data is abnormal, the target object can be an electronic device, an application platform, an application, such as a mobile phone, an application software (Application, APP), a website, etc.

[0056] In a possible example, the method further includes: acquiring an input factor of the target object, where the input factor is at least one parameter required to determine whether the target object is abnormal.

[0057] Among them, when performing abnormal analysis, it is necessary to collect relevant parameters of the target object to determine whether it is abnormal. The input factors of different target objects are different. For example, when performing abnormal analysis of network data, the target object is an electronic device, and the input factor of the target object can be the log data in the electronic device. The log data comes from the security and hardware in the electronic device, including traffic logs, operation logs, security audit logs, alarm logs, etc. For example, when performing face recognition, the target object is a face image, and the input factors can be facial features, including face contour points, eyebrow contour points, lip contour points, eye pupils, nose tip and nostrils, etc.

[0058] Optionally, the above step 110, performing anomaly measurement operation on the target object to obtain an anomaly measurement matrix, may include the following steps:

[0059] 11. Calculate the observed values ​​of the input factors.

[0060] The observed value of the input factor is a probability value of the input factor, which is between [0, 1] and is used to indicate the probability that the value of the input factor shows an abnormality. Specifically, a model can be pre-trained with known input factors and the observed value of the input factor, and the model gives the corresponding probability value through the input factor; or the value of the input factor is compared with a preset normal value, and the observed value of the input factor is determined according to the difference between the value of the input factor and the preset normal value.

[0061] 12. Based on the observed values, the input factors are divided into normal input factors and abnormal input factors.

[0062] Among them, when the observed value is greater than or equal to the preset value, the input factor corresponding to the observed value greater than or equal to the preset value can be classified as an abnormal factor, and the input factor corresponding to the observed value less than the preset value can be classified as a normal factor. The preset value can be set according to business rules or calculated by a model, and the embodiment of the present application does not limit this.

[0063] 13. Perform anomaly measurement operations on the normal class input factors and the abnormal class input factors respectively to obtain a normal class anomaly measurement matrix and an abnormal class anomaly measurement matrix.

[0064] The abnormal measurement operation is to detect abnormal values ​​of input factors. The abnormal measurement of input factors can be implemented by distance-based algorithms or pattern-based algorithms to obtain an abnormal measurement matrix of input factors. The abnormal measurement matrix can be expressed as D = {d1, d2, ..., d m By performing abnormal measurement on the normal class input factors and the abnormal class input factors respectively, an abnormal measurement matrix of the normal class input factors or an abnormal measurement matrix of the abnormal class input factors can be obtained.

[0065] S120: Calculate data distribution characteristics of the abnormality metric matrix.

[0066] Since distance-based algorithms or pattern-based algorithms are used to implement abnormality measurement of target objects, there is a problem of unclear abnormality threshold division. Therefore, in an embodiment of the present application, after the abnormality measurement is calculated, Bayesian decision making is used to determine the abnormality judgment threshold of the target object, so as to automatically obtain an accurate threshold.

[0067] Optionally, calculating the data distribution characteristics of the abnormal measurement matrix includes:

[0068] Based on the observed values ​​of the input factors, the mean and standard deviation of the normal class anomaly measurement matrix and the mean and standard deviation of the abnormal class anomaly measurement matrix are calculated to obtain the normal class mean, normal class standard deviation, abnormal class mean and abnormal class standard deviation.

[0069] Among them, the conditional density function p(x|w u ) and the conditional density function p(x|w c ) are all distributed according to the Gaussian density function The w u Represents the normal class, w c The total density function p(x) of the target object anomaly measurement matrix can be expressed as p(x) = p(x|w u )p(w u )+p(x|w c)p(w c ), where p(w u ) and p(w c ) is the prior probability value of the input factor of the target object. For example, if the number of input factor samples of the target object is A and the input factor is an abnormal class w c The number of is B, and the input factor is the normal class w u The number of is C, A=B+C, then p(w u )=C / A,p(w c )=B / A. Therefore, after realizing the abnormal measurement, the process of solving the change threshold can be transformed into the process of estimating the mean and standard deviation of the abnormal class and the normal class.

[0070] Specifically, the estimation of the mean and standard deviation can be achieved by applying the Expectation Maximum (EM) algorithm. The EM algorithm is implemented by an iterative loop, and each iteration consists of two steps: expected value and expected maximization. The expected value can be directly estimated from the observed data based on the current value of the parameter to be estimated; then the parameter estimate is updated by maximizing this expectation. These two steps are performed alternately in the entire iterative process until the iterative process converges, that is, when the difference between the prior probability, mean and standard deviation calculated in two adjacent iterations is less than a given threshold, the iteration terminates.

[0071] S130: Determine an abnormality determination threshold of the target object based on data distribution characteristics of the abnormality metric matrix.

[0072] Optionally, determining the abnormality judgment threshold of the target object based on the data distribution characteristics of the abnormality metric matrix includes: substituting the normal class mean, the normal class standard deviation, the abnormal class mean and the abnormal class standard deviation into the Bayesian minimum error formula p(T|w u )p(w u )=p(T|w c )p(w c ), calculate the abnormality determination threshold; wherein, the p(w u ) is the prior probability of the normal class input factor, and the p(w c ) is the prior probability of the abnormal input factor, and the p(T|w u ) is the conditional density function of the normal class abnormality measurement matrix, and the p(T|w c ) is the conditional density function of the abnormal measurement matrix of the abnormal class, and the p(T|w u ) and the p(T|w c ) all obey the Gaussian density function distribution, and T is the abnormality determination threshold.

[0073] Among them, after obtaining the mean and standard deviation of the normal class and the abnormal class according to the EM algorithm, the abnormal judgment threshold T can be calculated according to the Bayesian minimum error rate theory. The Bayesian minimum error can be expressed as: p(T|w u )p(w u )=p(T|w c )p(w c ), respectively p(w u )、p(w c )、p(x|w u ) and p(x|w c ) is substituted into the formula, and the solution of the abnormality judgment threshold T is obtained as follows: The value of the abnormality determination threshold T is thus calculated.

[0074] In a possible example, the method further includes: determining an abnormality analysis result of the target object based on the abnormality determination threshold, wherein the abnormality analysis result includes normal and abnormal.

[0075] Optionally, when the measured value of the input factor of the target object is greater than or equal to the abnormality judgment threshold, the abnormality analysis result of the target object is normal; when the measured value of the input factor of the target object is less than the abnormality judgment threshold, the abnormality analysis result of the target object is abnormal.

[0076] According to the abnormality determination threshold T, the abnormality analysis result of the target object can be obtained by performing binary segmentation on the abnormality measurement matrix. Specifically, when the observed value of the input factor of the target object is greater than or equal to the abnormality determination threshold T, the abnormality analysis result of the target object is normal; when the observed value of the input factor of the target object is less than the abnormality determination threshold T, the abnormality analysis result of the target object is abnormal. For example, when the value of the input parameter of the light bulb is greater than or equal to the abnormality determination threshold T, it indicates that the quality of the light bulb is qualified; when the value of the input parameter of the light bulb is less than the abnormality determination threshold T, it indicates that the quality of the light bulb is unqualified.

[0077] In a possible example, the method further includes: comparing actual results of the plurality of target objects with corresponding abnormality analysis results to obtain the false positive rate; and adjusting the abnormality determination threshold based on a mapping relationship between the false positive rate and the adjustment coefficient.

[0078] Among them, the abnormality determination threshold determined by the embodiment of the present application may still have deviations in actual applications, so that when performing abnormality analysis or abnormality detection, a normal target object is determined to be abnormal, or an abnormal target object is determined to be normal. Therefore, in order to improve the accuracy of abnormality determination, after determining the abnormality determination threshold, the abnormality determination threshold is adjusted based on the actual results of the target object.

[0079] Specifically, multiple target objects are subjected to abnormal analysis through a determined abnormality determination threshold to obtain abnormality analysis results of the multiple target objects, and then the abnormality analysis results of the multiple target objects are compared with the actual results of the multiple target objects, and the first error recognition rate and the second error recognition rate of the multiple target objects are calculated, the first error recognition rate is the probability of determining a normal target object as an abnormal target object, and the second error recognition rate is the probability of determining an abnormal target object as a normal target object, the first error recognition rate = the number of target objects that determine a normal target object as an abnormal target object / the total number of target objects, the second error recognition rate = the number of target objects that determine an abnormal target object as a normal target object / the total number of target objects. Then, the abnormality determination threshold is adjusted by the difference between the first error recognition rate and the second error recognition rate, and the mapping relationship between the difference and the adjustment coefficient.

[0080] Furthermore, when the difference between the first error rate and the second error rate is greater than zero, the abnormality determination threshold is reduced based on the mapping relationship between the difference and the adjustment coefficient; when the difference between the first error rate and the second error rate is less than or equal to zero, the abnormality determination threshold is increased based on the mapping relationship between the difference and the adjustment coefficient.

[0081] In a possible example, the adjusted abnormality determination threshold=abnormality determination threshold-data sensitivity coefficient*adjustment coefficient.

[0082] The mapping relationship between the difference and the adjustment coefficient is different for different target objects. Specifically, different target objects have different data sensitivities. For example, target objects involving security and property have a greater impact of abnormalities, and their abnormality judgment error rate is relatively small compared to other types of target objects, and the interval between their differences is also small. Therefore, in order to reduce the excessive adjustment of the abnormality judgment threshold, the adjustment coefficient can be multiplied by the data sensitivity coefficient. The greater the data sensitivity of the target object, the smaller the data sensitivity coefficient.

[0083] In a specific implementation, the electronic device may use a multi-scale decomposition algorithm to perform multi-scale feature decomposition on the relevant parameters of the target object to obtain low-frequency feature components and high-frequency feature components. The multi-scale decomposition algorithm may be at least one of the following: pyramid transform algorithm, wavelet transform, contourlet transform, shearlet transform, etc., which are not limited here. Further, the low-frequency feature components may be divided into multiple dimensions, and each dimension may include the same or different input factors. The low-frequency feature components reflect the main features of the target object, and the high-frequency feature components reflect the detailed information of the target object. For example, when performing face recognition, the electronic device may use a multi-scale decomposition algorithm to perform multi-scale feature decomposition on the target vein image to obtain low-frequency feature components and high-frequency feature components, and divide the low-frequency feature components into multiple regions, and the area size of each region is the same or different. The low-frequency feature components reflect the main features of the image, and the high-frequency feature components reflect the detailed information of the image.

[0084] Furthermore, the electronic device can determine the information entropy corresponding to each dimension in multiple dimensions or each region in multiple regions, obtain multiple information entropies, and determine the average information entropy and the target mean square error based on the multiple information entropies. The information entropy reflects the amount of information of the target object to a certain extent, and the mean square error can reflect the stability of the target object. The electronic device can pre-store the mapping relationship between the preset mean square error and the adjustment coefficient, and then, the target adjustment coefficient corresponding to the target mean square error can be determined based on the mapping relationship. In the embodiment of the present application, the value range of the adjustment coefficient can be -0.15 to 0.15.

[0085] Furthermore, the electronic device may adjust the average information entropy according to the target adjustment coefficient to obtain the target information entropy, where target information entropy = (1 + target adjustment coefficient) * average information entropy. The electronic device may pre-store a mapping relationship between a preset information entropy and an evaluation value, and further, may determine a first evaluation value corresponding to the target information entropy according to the mapping relationship between the preset information entropy and the evaluation value.

[0086] Furthermore, the electronic device can determine the input factor distribution density or the target feature point distribution density based on the high-frequency feature component, where the input factor distribution density = the total number of input factors / dimension of the high-frequency feature component, and the target feature point distribution density = the total number of feature points of the high-frequency feature component / region area. The electronic device can also pre-store a mapping relationship between a preset input factor distribution density or feature point distribution density and an evaluation value, and then, according to the mapping relationship between the preset feature point distribution density and the evaluation value, determine the second evaluation value corresponding to the input factor distribution density or the target feature point distribution density, and finally, perform a weighted operation based on the first evaluation value, the second evaluation value, the target low-frequency weight, and the target high-frequency weight to obtain the input factor quality evaluation value of the target object, as follows:

[0087] Input factor quality evaluation value = first evaluation value * target low frequency weight + second evaluation value * target high frequency weight

[0088] It can be seen that the method for determining the abnormality determination threshold of the embodiment of the present application is to obtain an abnormality measurement matrix by performing an abnormality measurement operation on the target object; calculate the data distribution characteristics of the abnormality measurement matrix; and determine the abnormality determination threshold of the target object based on the data distribution characteristics of the abnormality measurement matrix. The present application solves the problem of fuzzy threshold limit determination in the abnormal object determination process by calculating the abnormality measurement matrix of the target object and calculating the abnormality determination threshold according to the data distribution characteristics of the abnormality measurement matrix, clarifies the abnormal threshold limit of the target object, and improves the accuracy of abnormal determination.

[0089] The above mainly introduces the scheme of the embodiment of the present application from the perspective of the execution process on the method side. It is understandable that, in order to realize the above functions, the electronic device includes a hardware structure and / or software module corresponding to the execution of each function. It should be easily appreciated by those skilled in the art that, in combination with the units and algorithm steps of each example described in the embodiments provided herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present application.

[0090] The embodiment of the present application can divide the electronic device into functional units according to the above method example. For example, each functional unit can be divided according to each function, or two or more functions can be integrated into one processing unit. The above integrated unit can be implemented in the form of hardware or in the form of software functional units. It should be noted that the division of units in the embodiment of the present application is schematic and is only a logical function division. There may be other division methods in actual implementation.

[0091] See also Figure 2 , Figure 2 is a flow chart of a method for determining an abnormality determination threshold provided in an embodiment of the present application, such as Figure 2 As shown, the method for determining the abnormality determination threshold includes:

[0092] S210: Acquire an input factor of the target object, where the input factor is at least one parameter required to determine if the target object is abnormal.

[0093] S220. Calculate the observed values ​​of the input factors, and divide the input factors into normal input factors and abnormal input factors based on the observed values.

[0094] S230, performing anomaly measurement operations on the normal class input factors and the abnormal class input factors respectively to obtain a normal class anomaly measurement matrix and an abnormal class anomaly measurement matrix.

[0095] S240, calculating data distribution characteristics of the normal class anomaly measurement matrix and the anomaly measurement matrix of the abnormal class.

[0096] S250: Determine an abnormality determination threshold of the target object based on the data distribution characteristics of the normal class abnormality measurement matrix and the data distribution characteristics of the abnormality measurement matrix.

[0097] The specific description of the above steps 210 to 250 can refer to the above Figure 1 The corresponding steps described are not repeated here.

[0098] It can be seen that the method for determining the abnormality determination threshold value described in the embodiment of the present application obtains the input factor of the target object, the input factor is at least one parameter required to determine the abnormality of the target object, calculates the observed value of the input factor, divides the input factor into a normal class input factor and an abnormal class input factor based on the observed value, performs abnormal measurement operations on the normal class input factor and the abnormal class input factor respectively, obtains a normal class abnormal measurement matrix and an abnormal class abnormal measurement matrix, calculates the data distribution characteristics of the normal class abnormal measurement matrix and the abnormal class abnormal measurement matrix, and determines the abnormality determination threshold value of the target object based on the data distribution characteristics of the normal class abnormal measurement matrix and the data distribution characteristics of the abnormal measurement matrix. By calculating the normal class abnormal measurement matrix and the abnormal measurement matrix of the target object, and calculating the abnormality determination threshold value according to the data distribution characteristics of the normal class abnormal measurement matrix and the data distribution characteristics of the abnormal measurement matrix, the problem of fuzzy threshold limit determination in the abnormal object determination process is solved, the abnormal threshold limit of the target object is clarified, and the accuracy of abnormal determination is improved.

[0099] See also Figure 3a , Figure 3a is a functional unit block diagram of a device 300 for determining an abnormality determination threshold provided in an embodiment of the present application, such as Figure 3a As shown, the device 300 includes a computing unit 310 and a determining unit 320, wherein:

[0100] A computing unit 310 is used to perform an abnormality measurement operation on the target object to obtain an abnormality measurement matrix;

[0101] The computing unit 310 is further used to calculate the mean and standard deviation of the abnormality metric matrix;

[0102] The determination unit 320 is used to determine an abnormality determination threshold of the target object based on the mean value and the standard deviation.

[0103] Optional, such as Figure 3b , is a functional unit composition block diagram of another apparatus 300 for determining an abnormality determination threshold provided in an embodiment of the present application, wherein the apparatus 300 further includes: an acquisition unit 330, configured to acquire an input factor of the target object, wherein the input factor is at least one parameter required for determining an abnormality of the target object;

[0104] In performing anomaly measurement operation on the target object to obtain anomaly measurement matrix, the operation unit 310 is specifically used for:

[0105] Calculate the observed values ​​of the input factors, and divide the input factors into normal class input factors and abnormal class input factors based on the observed values; perform abnormal measurement operations on the normal class input factors and the abnormal class input factors respectively to obtain a normal class abnormal measurement matrix and an abnormal class abnormal measurement matrix.

[0106] Optionally, in calculating the data distribution characteristics of the abnormality metric matrix, the operation unit 310 is specifically used to:

[0107] Based on the observed values ​​of the input factors, the mean and standard deviation of the normal class anomaly measurement matrix and the mean and standard deviation of the abnormal class anomaly measurement matrix are calculated to obtain the normal class mean, normal class standard deviation, abnormal class mean and abnormal class standard deviation.

[0108] Optionally, the determining unit 320 is specifically used to: substitute the normal class mean, the normal class standard deviation, the abnormal class mean and the abnormal class standard deviation into the Bayesian minimum error formula p(T|w u )p(w u )=p(T|w c )p(w c ), calculating the abnormality determination threshold;

[0109] Among them, the p(w u ) is the prior probability of the normal class input factor, and the p(w c ) is the prior probability of the abnormal input factor, and the p(T|w u ) is the conditional density function of the normal class abnormality measurement matrix, and the p(T|w c ) is the conditional density function of the abnormal measurement matrix of the abnormal class, and the p(T|w u ) and the p(T|w c ) all obey the Gaussian density function distribution, and T is the abnormality determination threshold.

[0110] Optionally, the determination unit 320 is further used to: determine an abnormality analysis result of the target object based on the abnormality determination threshold, where the abnormality analysis result includes normal and abnormal.

[0111] Optionally, when the measured value of the input factor of the target object is greater than or equal to the abnormality judgment threshold, the abnormality analysis result of the target object is normal; when the measured value of the input factor of the target object is less than the abnormality judgment threshold, the abnormality analysis result of the target object is abnormal.

[0112] Optionally, the device 300 further includes a comparison unit 340 and an adjustment unit 350, wherein the comparison unit 340 is used to compare the actual results of the plurality of target objects with the corresponding abnormal analysis results respectively to obtain the false recognition rate;

[0113] The adjustment unit 350 is used to adjust the abnormality determination threshold based on the false recognition rate.

[0114] It can be understood that the functions of each program module of the device for determining the abnormal judgment threshold in the embodiment of the present application can be specifically implemented according to the method in the above method embodiment, and its specific implementation process can refer to the relevant description of the above method embodiment, which will not be repeated here.

[0115] See also Figure 4 , Figure 4 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application. As shown in FIG4 , the electronic device includes a memory, a communication interface and a processor, wherein the electronic device may also include a communication bus, and the processor, communication interface and memory may be interconnected through the bus.

[0116] Wherein, the above-mentioned processor, when used to execute the program stored in the memory, implements the following steps:

[0117] An abnormal measurement operation is performed on the target object to obtain an abnormal measurement matrix; data distribution characteristics of the abnormal measurement matrix are calculated; and an abnormality determination threshold of the target object is determined based on the data distribution characteristics of the abnormal measurement matrix.

[0118] Furthermore, the processor may be a general-purpose central processing unit (CPU) or multiple CPUs, a single or multiple graphics processing units (GPU), a microprocessor, an application specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of the program of the present invention.

[0119] The memory may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0120] In some examples, the memory may be independent, and the communication interface and the communication bus are connected to the processor. The memory may also be integrated with the processor. The communication bus transmits information between the above components.

[0121] An embodiment of the present application also provides a computer storage medium, wherein the computer storage medium stores a computer program for electronic data exchange, and the computer program enables a computer to execute part or all of the steps of any method recorded in the above method embodiments.

[0122] The present application also provides a computer program product, which includes a non-transitory computer-readable storage medium storing a computer program, and the computer program is operable to cause a computer to execute some or all of the steps of any method described in the above method embodiment. The computer program product may be a software installation package.

[0123] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0124] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0125] In the several embodiments provided in the present application, it should be understood that the disclosed device can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of the above-mentioned units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0126] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0128] If the above-mentioned integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a memory, including a number of instructions to enable an electronic device (which can be a personal computer, terminal device or network device, etc.) to perform all or part of the steps of the above-mentioned methods of each embodiment of the present application. The aforementioned memory includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or CD-ROM and other media that can store program codes.

[0129] A person skilled in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing the relevant hardware through a program, and the program may be stored in a computer-readable memory, which may include a flash drive, ROM, RAM, a magnetic disk or an optical disk, etc.

[0130] The embodiments of the present application are introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method and core idea of ​​the present application. At the same time, for general technical personnel in this field, according to the idea of ​​the present application, there will be changes in the specific implementation method and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for determining an abnormality determination threshold, characterized in that: Applied to electronic equipment, the method comprises: Perform anomaly measurement operation on the target object to obtain anomaly measurement matrix; Calculating data distribution characteristics of the anomaly metric matrix; Based on the data distribution characteristics of the abnormality metric matrix, determining the abnormality determination threshold of the target object, so as to perform abnormality detection on the target object based on whether the information of the target object is greater than the abnormality determination threshold; Performing abnormal analysis on multiple target objects through the abnormality determination threshold to obtain abnormality analysis results of the multiple target objects; comparing the abnormality analysis results of the multiple target objects with actual results of the multiple target objects, and calculating a first false recognition rate and a second false recognition rate for the multiple target objects, wherein the first false recognition rate is a probability of determining a normal target object as an abnormal target object, and the second false recognition rate is a probability of determining an abnormal target object as a normal target object; The abnormality determination threshold is adjusted based on the difference between the first error recognition rate and the second error recognition rate, and the mapping relationship between the difference and the adjustment coefficient; the adjustment includes: when the difference between the first error recognition rate and the second error recognition rate is greater than zero, the abnormality determination threshold is reduced based on the mapping relationship between the difference and the adjustment coefficient; when the difference between the first error recognition rate and the second error recognition rate is less than or equal to zero, the abnormality determination threshold is increased based on the mapping relationship between the difference and the adjustment coefficient.

2. The method according to claim 1, characterized in that The method further comprises: Acquire an input factor of the target object, where the input factor is at least one parameter required to determine if the target object is abnormal; The abnormal measurement operation is performed on the target object to obtain an abnormal measurement matrix, including: Calculating observed values ​​of the input factors, and dividing the input factors into normal input factors and abnormal input factors based on the observed values; Anomaly measurement operations are performed on the normal class input factors and the abnormal class input factors respectively to obtain a normal class abnormal measurement matrix and an abnormal class abnormal measurement matrix.

3. The method according to claim 2, characterized in that The calculating of the data distribution characteristics of the abnormal measurement matrix includes: Based on the observed values ​​of the input factors, the mean and standard deviation of the normal class anomaly measurement matrix and the mean and standard deviation of the abnormal class anomaly measurement matrix are calculated to obtain the normal class mean, normal class standard deviation, abnormal class mean and abnormal class standard deviation.

4. The method according to claim 3, characterized in that The determining the abnormality determination threshold of the target object based on the data distribution characteristics of the abnormality metric matrix includes: Substitute the normal class mean, the normal class standard deviation, the abnormal class mean and the abnormal class standard deviation into the Bayesian minimum error formula p(T|w u )p(w u )=p(T|w c )p(w c ), calculating the abnormality determination threshold; Among them, the p(w u ) is the prior probability of the normal class input factor, and the p(w c ) is the prior probability of the abnormal input factor, and the p(T|w u ) is the conditional density function of the normal class abnormality measurement matrix, and the p(T|w c ) is the conditional density function of the abnormal measurement matrix of the abnormal class, and the p(T|w u ) and the p(T|w c ) all obey the Gaussian density function distribution, and T is the abnormality determination threshold.

5. The method according to any one of claims 1 to 4, characterized in that: The abnormal analysis results include normal and abnormal.

6. The method according to claim 4, characterized in that When the measured value of the input factor of the target object is greater than or equal to the abnormality determination threshold, the abnormality analysis result of the target object is normal; When the measured value of the input factor of the target object is less than the abnormality determination threshold, the abnormality analysis result of the target object is abnormal.

7. A device for determining an abnormality determination threshold, characterized in that: The device comprises: A calculation unit, used for performing anomaly measurement calculation on the target object to obtain anomaly measurement matrix; The computing unit is further used to calculate the data distribution characteristics of the abnormal measurement matrix; A determination unit, configured to determine an abnormality determination threshold of the target object based on data distribution characteristics of the abnormality metric matrix, so as to perform abnormality detection on the target object based on whether information of the target object is greater than the abnormality determination threshold; The determination unit is further configured to perform abnormality analysis on the multiple target objects through the abnormality determination threshold to obtain abnormality analysis results of the multiple target objects; A comparing unit, configured to compare the abnormality analysis results of the plurality of target objects with the actual results of the plurality of target objects, and calculate a first error recognition rate and a second error recognition rate for the plurality of target objects, wherein the first error recognition rate is a probability of determining a normal target object as an abnormal target object, and the second error recognition rate is a probability of determining an abnormal target object as a normal target object; An adjustment unit is used to adjust the abnormality determination threshold based on the difference between the first error recognition rate and the second error recognition rate, and the mapping relationship between the difference and the adjustment coefficient; the adjustment includes: when the difference between the first error recognition rate and the second error recognition rate is greater than zero, the abnormality determination threshold is reduced based on the mapping relationship between the difference and the adjustment coefficient; when the difference between the first error recognition rate and the second error recognition rate is less than or equal to zero, the abnormality determination threshold is increased based on the mapping relationship between the difference and the adjustment coefficient.

8. An electronic device, characterized in that: The electronic device includes a processor, a memory, a communication interface, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the processor, and the programs include instructions for executing the steps in the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a computer program for storing data exchange, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images