An abnormal data detection method and device

Abstract

The application discloses an abnormal data detection method, comprising: obtaining to-be-detected data; inputting the to-be-detected data into a target data reconstruction model to obtain target reconstruction data corresponding to the to-be-detected data, wherein the target data reconstruction model is a model for reconstructing the to-be-detected data according to feature information of the to-be-detected data to obtain reconstruction data corresponding to the to-be-detected data; obtaining reconstruction error information between the to-be-detected data and the target reconstruction data; and judging whether the to-be-detected data is abnormal data according to the reconstruction error information. The method can conveniently and accurately judge whether the to-be-detected data is abnormal data according to the reconstruction error information after obtaining the target reconstruction data corresponding to the to-be-detected data through the target data reconstruction model and obtaining the reconstruction error information between the to-be-detected data and the target reconstruction data.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically to a method, apparatus, electronic device, and storage device for detecting abnormal data. The present application also relates to a method, apparatus, electronic device, and storage device for obtaining a data reconstruction model. The present application also relates to a method, apparatus, electronic device, and storage device for detecting abnormal data on a network platform. The present application also relates to a method, apparatus, electronic device, and storage device for detecting abnormalities on a target device. Background Art

[0002] With the continuous development of computer technology, applications often generate large amounts of application data during operation. For example, when a network platform is running, various user behavior data is often generated in the platform background based on user operations within the platform. How to accurately detect anomalies in this data and quickly resolve the program instruction data that causes the anomaly is becoming increasingly important.

[0003] Currently, there are generally two methods for detecting abnormal data from application data generated by applications, that is, from the data to be detected: 1. Performing threshold-related anomaly detection on a certain indicator data corresponding to the target object. For example, for the number of clicks on a certain button in the network platform, or the number of views on a certain page in the network platform, the historical data within a unit time can be counted, and when performing real-time monitoring, the deviation value between the real-time data and the historical statistical data can be used to determine whether the real-time data has an anomaly; 2. For the time series data corresponding to the target object, by converting the historical time series data corresponding to the target object into one-dimensional time series data, and performing periodicity and trend line decomposition on the one-dimensional time series data, its historical periodic law or historical change trend law is obtained, and by analyzing the degree of deviation between the real-time time series data and the obtained historical periodic law or historical change trend law, it is determined whether the real-time time series data is abnormal data. For example, a periodic change model of the one-dimensional time series data corresponding to the target object is established through a differential integrated moving average autoregressive model (ARIMA), and the real-time time series data corresponding to the target object is determined to be abnormal data based on the periodic change model.

[0004] From this, we can see that the existing methods for determining whether the data to be detected is abnormal data are: one method is only applicable to single-value analysis scenarios, that is, it only analyzes and detects a single-value indicator data, but cannot analyze the overall changes of the data in the time series; the other method, although it can process time series data, is generally only applicable to one-dimensional time series data, and cannot process time series data with multiple dimensions; in addition, both methods have the problem that in the process of training the model for detecting abnormal data, it is difficult to obtain abnormal sample data in the training data, which leads to relatively low accuracy of the detection results. Therefore, when determining whether the data to be detected is abnormal data, the existing technology needs to call different models according to the type of data to be detected, and there is also the problem of not being able to process certain types of data. In other words, the existing technology has the problem of not being able to conveniently and accurately obtain abnormal data in the data to be detected. Summary of the Invention

[0005] The embodiments of the present application provide a method for detecting abnormal data to solve the problem in the prior art that abnormal data in the data to be detected cannot be obtained conveniently and accurately.

[0006] The embodiment of the present application provides a method for detecting abnormal data, comprising: obtaining data to be detected;

[0007] Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected;

[0008] Acquiring reconstruction error information between the data to be detected and the target reconstruction data;

[0009] It is determined whether the data to be detected is abnormal data according to the reconstruction error information.

[0010] Optionally, the target data reconstruction model is obtained by the following method:

[0011] Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0012] According to the original sample data, training is performed to obtain the target data reconstruction model;

[0013] In which, the target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0014] Optionally, the training and obtaining the target data reconstruction model based on the original sample data includes:

[0015] Obtaining a reconstruction model for the data to be trained, and obtaining sample data of the first feature type and sample data of the second feature type from the original sample data, wherein the reconstruction model for the data to be trained is a model corresponding to the reconstruction model for the target data;

[0016] Using the first feature type sample data to train a first encoding sub-model in the model for reconstructing the data to be trained to obtain the first sample feature information, and using the second feature type sample data to train a second encoding sub-model in the model for reconstructing the data to be trained to obtain the second sample feature information;

[0017] Using the first sample feature information to train a first decoding sub-model in the reconstruction model of the data to be trained to obtain the first reconstructed data, and using the second sample feature information to train a second decoding sub-model in the reconstruction model of the data to be trained to obtain the second reconstructed data;

[0018] By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, the parameters in the data reconstruction model to be trained are adjusted to obtain the target data reconstruction model that meets the preset convergence conditions.

[0019] Optionally, also include:

[0020] Using a hidden layer in the to-be-trained data reconstruction model to perform a splicing process on the first sample feature information and the second sample feature information, and using a fully connected layer corresponding to the hidden layer to perform a mapping process on the spliced ​​first sample feature information and the second sample feature information to obtain complete sample feature information to be decoded;

[0021] The method further comprises:

[0022] Before using the first sample characteristic information to train the first decoding sub-model in the reconstruction model of the data to be trained and obtaining the first reconstruction data, and before using the second sample characteristic information to train the second decoding sub-model in the reconstruction model of the data to be trained and obtaining the second reconstruction data, the first sample characteristic information is obtained from the complete sample characteristic information to be decoded, and the second sample characteristic information is obtained.

[0023] Optionally, the first feature type sample data includes single-value indicator data corresponding to the target object, and the second feature type sample data includes time series feature data corresponding to the target object.

[0024] Optionally, the first encoding sub-model and the first decoding sub-model are deep neural network models, and the second encoding sub-model and the second decoding sub-model are recurrent neural network models.

[0025] Optionally, obtaining reconstruction error information between the data to be detected and the target reconstructed data includes:

[0026] Calculating the error value between the data to be detected and the target reconstructed data;

[0027] The reconstruction error information is obtained according to the error value.

[0028] Optionally, the data to be detected includes at least one of a first feature type of data to be detected and a second feature type of data to be detected, and the target reconstruction data includes first target reconstruction data corresponding to the first feature type of data to be detected and second target reconstruction data corresponding to the second feature type of data to be detected;

[0029] The calculating the error value between the to-be-detected data and the target reconstructed data includes:

[0030] A first error value corresponding to the first feature type to-be-detected data and the first target reconstructed data is obtained, and a second error value corresponding to the second feature type to-be-detected data and the second target reconstructed data is obtained.

[0031] Optionally, obtaining a first error value corresponding to the first feature type to-be-detected data and the first target reconstructed data includes:

[0032] The first error value is obtained by calculating a mean square error value between the first feature type to-be-detected data and the first target reconstructed data.

[0033] Optionally, obtaining a second error value corresponding to the second feature type to-be-detected data and the second target reconstructed data includes:

[0034] The second error value is obtained by calculating the cross entropy between the second feature type to be detected data and the second target reconstructed data.

[0035] Optionally, judging whether the data to be detected is abnormal data according to the reconstruction error information includes:

[0036] If the reconstruction error information is not less than a preset reconstruction error threshold, the data to be detected is determined to be abnormal data, wherein the preset reconstruction error threshold is a value obtained in the process of training the target data reconstruction model.

[0037] The embodiment of the present application further provides a method for obtaining a data reconstruction model, comprising: obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0038] According to the original sample data, training is performed to obtain a target data reconstruction model;

[0039] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0040] The present application also provides a method for detecting abnormal data on a network platform, including:

[0041] Obtaining the operation data of the platform to be detected corresponding to the target network platform;

[0042] Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected;

[0043] Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform;

[0044] It is determined whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0045] Optionally, if the operation data of the platform to be detected is judged to be abnormal operation data based on the reconstruction error information, the method also includes: obtaining log data corresponding to the abnormal operation data; obtaining abnormal location data based on the log data, wherein the abnormal location data is used to locate the program instruction data that generates the abnormal operation data.

[0046] Optionally, it also includes: obtaining user information corresponding to the abnormal operation data; and sending abnormal warning information to the user computing device corresponding to the user information based on the user information, wherein the abnormal warning information corresponds to the abnormal operation data, and the user computing device is the computing device used by the user corresponding to the user information.

[0047] Optionally, the method further includes: sending a target service suspension message to the target network platform, where the target service suspension message is used to enable the target network platform to stop receiving operation requests from the user computing device within a preset time range.

[0048] Optionally, the target network platform includes at least any one of the following platforms: a payment platform, an e-commerce platform.

[0049] The present application also provides a method for detecting anomalies of a target device, including:

[0050] Obtain the target device's operating status data to be tested;

[0051] Inputting the operating state data to be detected into a target data reconstruction model to obtain target operating state reconstruction data corresponding to the operating state data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating state data according to feature information of the operating state data and obtaining reconstruction data corresponding to the operating state data;

[0052] Acquiring reconstruction error information between the operating state data to be detected and the target operating state reconstruction data;

[0053] It is determined whether the target device is an abnormally operating device according to the reconstruction error information.

[0054] The present invention also provides an abnormal data detection device, including:

[0055] A data acquisition unit for detecting, used for acquiring data for detecting;

[0056] a target reconstruction data acquisition unit, configured to input the data to be detected into a target data reconstruction model to acquire target reconstruction data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and acquiring reconstructed data corresponding to the data to be detected;

[0057] A reconstruction error information acquisition unit, configured to acquire reconstruction error information between the data to be detected and the target reconstructed data;

[0058] A judging unit is configured to judge whether the data to be detected is abnormal data according to the reconstruction error information.

[0059] An embodiment of the present application further provides an electronic device, including:

[0060] processor;

[0061] The memory is used to store a program of the abnormal data detection method. After the device is powered on and the program of the abnormal data detection method is run by the processor, the following steps are performed:

[0062] Obtain the data to be tested;

[0063] Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected;

[0064] Acquiring reconstruction error information between the data to be detected and the target reconstruction data;

[0065] It is determined whether the data to be detected is abnormal data according to the reconstruction error information.

[0066] The embodiment of the present application further provides a storage device storing a program of an abnormal data detection method, wherein the program is executed by a processor to perform the following steps:

[0067] Obtain the data to be tested;

[0068] Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected;

[0069] Acquiring reconstruction error information between the data to be detected and the target reconstruction data;

[0070] It is determined whether the data to be detected is abnormal data according to the reconstruction error information.

[0071] The present application also provides a device for obtaining a data reconstruction model, including:

[0072] A data acquisition unit, configured to acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0073] A training unit, configured to train and obtain a target data reconstruction model based on the original sample data;

[0074] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0075] An embodiment of the present application further provides an electronic device, including:

[0076] processor;

[0077] The memory is used to store a program for obtaining a data reconstruction model. After the device is powered on and the program for obtaining a data reconstruction model is run by the processor, the following steps are performed:

[0078] Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0079] According to the original sample data, training is performed to obtain a target data reconstruction model;

[0080] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0081] The present application also provides a storage device storing a program for obtaining a data reconstruction model, wherein the program is executed by a processor to perform the following steps:

[0082] Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0083] According to the original sample data, training is performed to obtain a target data reconstruction model;

[0084] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0085] The present application also provides an abnormal data detection device for a network platform, including:

[0086] The platform operation data acquisition unit to be detected is used to acquire the platform operation data to be detected corresponding to the target network platform;

[0087] a target platform operation reconstruction data acquisition unit, configured to input the operation data of the platform to be detected into a target data reconstruction model, and acquire target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is configured to reconstruct the operation data of the platform to be detected based on characteristic information of the operation data of the platform to be detected and to acquire reconstructed data corresponding to the access data of the platform to be detected;

[0088] a reconstruction error information acquiring unit, configured to acquire reconstruction error information between the operation data of the platform to be detected and the reconstructed data of the target platform operation;

[0089] The abnormal operation data judging unit is configured to judge whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0090] An embodiment of the present application further provides an electronic device, including:

[0091] processor;

[0092] The memory is used to store a program of a method for detecting abnormal operation data on a network platform. After the device is powered on and the program of the method for detecting abnormal data on a network platform is run by the processor, the following steps are performed:

[0093] Obtaining the operation data of the platform to be detected corresponding to the target network platform;

[0094] Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected;

[0095] Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform;

[0096] It is determined whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0097] The present application also provides a storage device storing a program for a method for detecting abnormal data on a network platform. The program is executed by a processor to perform the following steps:

[0098] Obtaining the operation data of the platform to be detected corresponding to the target network platform;

[0099] Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected;

[0100] Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform;

[0101] It is determined whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0102] The present application also provides an abnormality detection device for a target device, including:

[0103] A unit for acquiring data of the operating status to be detected, used for acquiring the data of the operating status to be detected of the target device;

[0104] an operating status data reconstruction unit, configured to input the operating status data to be detected into a target data reconstruction model, and obtain target operating status reconstruction data corresponding to the operating status data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating status data based on characteristic information of the operating status data and obtaining reconstructed data corresponding to the operating status data;

[0105] a reconstruction error information acquiring unit, configured to acquire reconstruction error information between the operating state data to be detected and the target operating state reconstruction data;

[0106] A judging unit is configured to judge whether the target device is an abnormally operating device based on the reconstruction error information.

[0107] An embodiment of the present application further provides an electronic device, including:

[0108] processor;

[0109] The memory is configured to store a program for an abnormality detection method for a target device. After the device is powered on and the program for the abnormality detection method for the target device is run by the processor, the following steps are performed:

[0110] Obtain the target device's operating status data to be tested;

[0111] Inputting the operating state data to be detected into a target data reconstruction model to obtain target operating state reconstruction data corresponding to the operating state data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating state data according to feature information of the operating state data and obtaining reconstruction data corresponding to the operating state data;

[0112] Acquiring reconstruction error information between the operating state data to be detected and the target operating state reconstruction data;

[0113] It is determined whether the target device is an abnormally operating device according to the reconstruction error information.

[0114] The present application also provides a storage device storing a program for an abnormality detection method for a target device. The program is executed by a processor to perform the following steps:

[0115] Obtain the target device's operating status data to be tested;

[0116] Inputting the operating state data to be detected into a target data reconstruction model to obtain target operating state reconstruction data corresponding to the operating state data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating state data according to feature information of the operating state data and obtaining reconstruction data corresponding to the operating state data;

[0117] Acquiring reconstruction error information between the operating state data to be detected and the target operating state reconstruction data;

[0118] It is determined whether the target device is an abnormally operating device according to the reconstruction error information.

[0119] Compared with the prior art, this application has the following advantages:

[0120] An embodiment of the present application provides a method for detecting abnormal data, comprising: obtaining data to be detected; inputting the data to be detected into a target data reconstruction model to obtain target reconstruction data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on characteristic information of the data to be detected and obtaining reconstruction data corresponding to the data to be detected; obtaining reconstruction error information between the data to be detected and the target reconstruction data; and judging whether the data to be detected is abnormal data based on the reconstruction error information. When judging whether the data to be detected is abnormal data, the method does not need to pay attention to the specific type of data. It only needs to obtain the target reconstruction data corresponding to the data to be detected through the target data reconstruction model, and by obtaining the reconstruction error information between the data to be detected and the target reconstruction data, it can conveniently and accurately judge whether the data to be detected is abnormal data.

[0121] The present application also provides a method for obtaining a data reconstruction model, comprising: obtaining original sample data, wherein the original sample data includes at least one of a first feature type sample data and a second feature type sample data; training a target data reconstruction model based on the original sample data; wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected, the target data reconstruction model including an encoding module and a decoding module, the encoding module including a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module including a first decoding sub-model and a second decoding sub-model, the first decoding sub-model for reconstructing first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model for reconstructing second reconstructed data corresponding to the second feature type sample data based on the second sample feature information. The method can conveniently obtain reconstructed data corresponding to the data to be detected by setting sub-models corresponding to different feature type sample data in the original sample data and adaptively reconstructing reconstructed data corresponding to different feature type sample data.

[0122] The embodiment of the present application also provides a method for detecting abnormal data for a network platform, comprising: obtaining operation data of a platform to be detected corresponding to a target network platform; inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on characteristic information of the operation data of the platform to be detected and obtain reconstruction data corresponding to the operation data of the platform to be detected; obtaining reconstruction error information between the operation data of the platform to be detected and the reconstruction data of the target platform operation; and judging whether the operation data of the platform to be detected is abnormal operation data based on the reconstruction error information. The method can conveniently and accurately judge whether the operation data of the platform to be detected corresponding to the target network platform is abnormal operation data, thereby enabling the computing device corresponding to the target network platform to quickly respond to abnormal access data.

[0123] An embodiment of the present application also provides a method for detecting an abnormality of a target device, comprising: obtaining operating status data to be detected of the target device; inputting the operating status data to be detected into a target data reconstruction model to obtain target operating status reconstruction data corresponding to the operating status data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating status data based on characteristic information of the operating status data and obtaining reconstructed data corresponding to the operating status data; obtaining reconstruction error information between the operating status data to be detected and the target operating status reconstruction data; and judging whether the target device is an abnormally operating device based on the reconstruction error information. By judging whether the operating status data to be detected of the target device is abnormal data, the method can conveniently and accurately judge whether the target device is an abnormally operating device. BRIEF DESCRIPTION OF THE DRAWINGS

[0124] Figure 1 This is a schematic diagram of an application scenario of an abnormal data detection method provided in the first embodiment of the present application.

[0125] Figure 2 This is a flowchart of an abnormal data detection method provided in the first embodiment of the present application.

[0126] Figure 3 This is a data processing diagram of an abnormal data detection method provided in the first embodiment of the present application.

[0127] Figure 4 This is a flowchart of a method for obtaining a data reconstruction model provided in the second embodiment of the present application.

[0128] Figure 5 This is a flowchart of a method for detecting abnormal data on a network platform provided in the third embodiment of the present application.

[0129] Figure 6 This is a schematic diagram of an abnormal data detection device provided in the fourth embodiment of the present application.

[0130] Figure 7 This is a schematic diagram of an electronic device provided in the fifth embodiment of the present application.

[0131] Figure 8 This is a schematic diagram of a device for obtaining a data reconstruction model provided in the seventh embodiment of the present application.

[0132] Figure 9 This is a schematic diagram of an abnormal data detection device for a network platform provided in the tenth embodiment of the present application.

[0133] Figure 10 This is a flowchart of an abnormality detection method for a target device provided in the thirteenth embodiment of the present application.

[0134] Figure 11 This is a schematic diagram of an abnormality detection method for a target device provided in the fourteenth embodiment of the present application. DETAILED DESCRIPTION

[0135] The following description sets forth many specific details to facilitate a thorough understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the scope of the present application. Therefore, the present application is not limited to the specific implementations disclosed below.

[0136] In order to enable those skilled in the art to better understand the present application, the following describes in detail the specific application scenarios of the embodiments based on the abnormal data detection method provided by the present application. The abnormal data detection method provided in the first embodiment of the present application can be applied to scenarios where the client and the server interact, such as Figure 1 As shown, it is a schematic diagram of an application scenario of an abnormal data detection method provided by the first embodiment of the present application.

[0137] In a specific implementation, the method can be for the purpose of enabling a computing device to quickly, conveniently and accurately obtain abnormal data in the data to be detected, so that the user or the computing device can respond promptly to the program instruction data that generates the abnormal data. After the client obtains the data to be detected, the client sends the data to be detected to the server, wherein the data to be detected can be platform operation data for a certain network platform, or it can also be operating status data of a certain machine device, or it can be detection data of a certain entity object collected by a computing device after obtaining authorization; the server obtains the data to be detected sent by the client, and inputs the data to be detected into the target data reconstruction In the model, target reconstruction data corresponding to the data to be detected is obtained, wherein the target data reconstruction model is used to reconstruct the data to be detected according to the characteristic information of the data to be detected and obtain the reconstruction data corresponding to the data to be detected; then, the server obtains the reconstruction error information between the data to be detected and the target reconstruction data, and judges whether the data to be detected is abnormal data based on the reconstruction error information; then, the judgment result is sent to the client; of course, if the data to be detected is abnormal data, the server can also send abnormal location data for locating the program instruction data that generates the abnormal data to the user at the same time as sending the judgment result to the client, according to the difference of the abnormal data.

[0138] Of course, the method can also be applied to the client or the server separately. For example, after obtaining authorization, the server may obtain the data to be detected from data such as user behavior logs or system logs corresponding to the user generated by the application when providing services to the user. Thereafter, the server may input the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, and determine whether the data to be detected is abnormal data by obtaining reconstruction error information between the data to be detected and the target reconstructed data. If the data to be detected is determined to be abnormal data, the server may push the abnormal data to the user computing device corresponding to the abnormal data, or may also obtain abnormal location data corresponding to the abnormal data for locating program instruction data that generated the abnormal data, and push the abnormal location data to the user computing device corresponding to the abnormal data. Alternatively, the server may generate abnormal warning information corresponding to the abnormal data and push the abnormal warning information to the user computing device corresponding to the abnormal data. Furthermore, if the server determines that the abnormal data is abnormal intrusion data, the server may also send a target service suspension message to the client, wherein the target service suspension message is used to cause the client to stop receiving operation requests from the user computing device corresponding to the abnormal data within a preset time range, wherein the user computing device is the computing device used by the user corresponding to the user information.

[0139] The client can be a mobile terminal device, such as a mobile phone, tablet computer, etc., or a common computer device. The server generally refers to a server, which can be a physical server or a cloud server, and is not specifically limited here.

[0140] It should be noted that the above application scenarios are merely specific embodiments of the abnormal data detection method provided in the first embodiment of the present application. The purpose of providing the above application scenarios is to facilitate understanding of the method, and is not to limit the method.

[0141] like Figure 2 As shown, it is a flow chart of an abnormal data detection method provided by the first embodiment of this application. Figure 2 The method provided in the first embodiment of the present application is introduced.

[0142] Step S201: Acquire data to be detected.

[0143] The data to be detected refers to data corresponding to the target object. The data can be attribute data corresponding to the target object, specifically single-value indicator data corresponding to the target object, or time series feature data corresponding to the target object, where the target object generally refers to an entity or virtual object.

[0144] For example, for smart wearable devices, such as smart watches or smart bracelets, the corresponding data to be detected may be the heart rate value detected by the smart wearable device within a certain time range; for vehicle objects, the corresponding data to be detected may be the relative position information of the vehicle object and the surrounding vehicles in time sequence when driving; for a certain network platform, such as a payment platform, e-commerce platform and other platforms, the data to be detected may be the user operation data of the user in the network platform after authorization, such as the click behavior or number of clicks on a certain button, the number of views on a certain page, or the operation time corresponding to the intrusion operation initiated by the user using a computing device on the network platform; for a certain device, such as a router, switch and other network equipment, the data to be detected may be the operating status data of the device, such as the network throughput per unit time and other data.

[0145] It should be noted that in the first embodiment of the present application, the data to be detected includes at least one of the first feature type data to be detected and the second feature type data to be detected; the first feature type data to be detected can be single-value indicator data corresponding to the target object; the second feature type data to be detected can be time series feature data corresponding to the target object; in addition, the time series feature data can be one-dimensional time series feature data, that is, a single-value indicator data corresponding to the target object in the time series; or it can be multi-dimensional time series feature data, that is, single-value indicator data of multiple dimensions corresponding to the target object in the time series. For example, the one-dimensional time series feature data corresponding to the smart wearable device can be in the form of (time, heart rate value); the multi-dimensional time series feature data corresponding to the network platform can be in the form of (time, number of clicks on a certain button, number of views on a certain page, number of users, number of IPs...).

[0146] Step S202: input the data to be detected into a target data reconstruction model to obtain target reconstruction data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstruction data corresponding to the data to be detected.

[0147] In the prior art, when it is necessary to perform anomaly detection on the data to be detected, a pre-trained anomaly detection model is usually used to determine whether the data to be detected is anomaly data. For example, the anomaly detection model is used to detect whether the data to be detected of the single-value indicator type is anomaly data. However, the problem faced by this method is that when training the anomaly detection model, it is usually difficult to obtain abnormal sample data that can be used for supervised learning. That is, in practice, normal sample data corresponding to the data to be detected is extremely easy to obtain, while abnormal sample data is a relatively low-probability event. Therefore, abnormal sample data is usually very rare and difficult to obtain. For example, when using smart wearable devices to detect heart rate, or when using the time series relative position information corresponding to the vehicle object to determine the responsibility for the accident, or when using the platform operation data corresponding to the network platform to determine whether there is an intrusion operation on the network platform or whether there is abnormal network congestion, normal heart rate values, time series relative position information during normal driving, and platform operation data under normal conditions can usually be obtained in large quantities, while the corresponding abnormal data is relatively difficult to obtain and the quantity is also very small. Therefore, the anomaly detection model obtained using a large amount of normal sample data and a small amount of abnormal sample data is not only time-consuming and labor-intensive to obtain, but also has the problem of low detection accuracy.

[0148] In response to the problems existing in the prior art, the abnormal data detection method provided in the first embodiment of the present application adopts a target data reconstruction model obtained through pre-training to obtain target reconstruction data corresponding to the data to be detected, and determines whether the data to be detected is abnormal data by obtaining reconstruction error information between the data to be detected and the target reconstruction data.

[0149] The target data reconstruction model is a model for reconstructing the data to be detected based on the feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected; in addition, in view of the problem that the anomaly detection model in the prior art can usually only process data of a certain feature type when detecting the data to be detected and cannot process data of different feature types at the same time, that is, in view of the problem that the anomaly detection model in the prior art can generally only process single-value indicator data or can only convert multi-dimensional time series feature data into one-dimensional time series feature data for processing, the target data reconstruction model provided in the first embodiment of the present application includes at least two sub-models in its structure in order to increase the learning ability of the model. These two sub-models can adaptively perform processing according to the type of input data to be detected.

[0150] The target data reconstruction model can be obtained by the following method: obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; training to obtain the target data reconstruction model based on the original sample data; wherein the target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0151] like Figure 3 As shown, it is a data processing diagram of an abnormal data detection method provided by the first embodiment of the present application. Figure 3 It can be seen from the content that the structure of the target data reconstruction model provided in the first embodiment of the present application can be a model structure corresponding to the autoencoder (AE) framework, that is, the target data reconstruction model completes the reconstruction of the data to be detected through the encoding module and decoding module it contains.

[0152] It should be noted that, in the first embodiment of the present application, the first feature type sample data is the sample data corresponding to the first feature type data to be detected in step S201, that is, the first feature type sample data is the single-value indicator data corresponding to the target object; the second feature type sample data is the sample data corresponding to the second feature type data to be detected in step S201, that is, the second feature type sample data is the time series feature data corresponding to the target object, which can specifically be one-dimensional time series feature data or multi-dimensional time series feature data. In addition, the first encoding sub-model and the first decoding sub-model in the target data reconstruction model can be deep neural network models (DNN, Deep Neural Networks), and the second encoding sub-model and the second decoding sub-model in the target data reconstruction model can be recurrent neural network models (RNN, Recurrent Neural Network). Of course, in the specific implementation, the target data reconstruction model can also be set to other structures, which is not specifically limited here.

[0153] In addition, the training to obtain the target data reconstruction model based on the original sample data includes: obtaining a reconstruction model of the data to be trained, and obtaining the first feature type sample data and the second feature type sample data from the original sample data, wherein the reconstruction model of the data to be trained is a model corresponding to the target data reconstruction model; using the first feature type sample data to train the first encoding sub-model in the reconstruction model of the data to be trained to obtain the first sample feature information, and using the second feature type sample data to train the second encoding sub-model in the reconstruction model of the data to be trained to obtain the second sample feature information; using the first sample feature information to train the first decoding sub-model in the reconstruction model of the data to be trained to obtain the first reconstruction data, and using the second sample feature information to train the second decoding sub-model in the reconstruction model of the data to be trained to obtain the second reconstruction data; by obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting the parameters in the reconstruction model of the data to be trained to obtain the target data reconstruction model that meets the preset convergence conditions. It should be noted that the preset convergence condition can be set according to actual conditions and is not specifically limited here.

[0154] In addition, in order to maintain the integrity of the model, so that the model can be trained conveniently and the accuracy of the model processing results can be improved, the data reconstruction model to be trained also includes a hidden layer and a fully connected layer corresponding to the hidden layer. In the process of obtaining the target data reconstruction model by training the data reconstruction model to be trained using the original sample data, it also includes: using the hidden layer in the data reconstruction model to be trained to splice the first sample feature information and the second sample feature information, and using the fully connected layer corresponding to the hidden layer to map the first sample feature information and the second sample feature information after splicing to obtain the complete sample feature information to be decoded; the method also includes: using the first sample feature information to train the first decoding sub-model in the data reconstruction model to be trained to obtain the first reconstructed data, and using the second sample feature information to train the second decoding sub-model in the data reconstruction model to be trained to obtain the second reconstructed data, and before obtaining the second reconstructed data, obtaining the first sample feature information from the complete sample feature information to be decoded, and obtaining the second sample feature information.

[0155] For example, for a target data reconstruction model used to reconstruct the reconstruction data of the platform operation data to be detected corresponding to the network platform, in the process of training to obtain the target data reconstruction model, historical platform operation data can be obtained from the server corresponding to the network platform as the original sample data for training the model. Through the sample data of at least the above two feature types included in the original sample data, the target platform operation reconstruction data corresponding to the platform operation data to be detected can be obtained through training.

[0156] It should also be noted that, in the first embodiment of the present application, the reason why the reconstruction error information between the data to be detected and the target reconstructed data is obtained to determine whether the data to be detected is abnormal data is specifically because: in the process of training the target data reconstruction model, normal sample data is relatively easy to obtain, and thus the normal sample data can be better reconstructed, that is, the error between the obtained reconstructed data and the normal sample data is usually small; however, since the abnormal sample data is relatively difficult to obtain, the abnormal sample data is usually difficult to reconstruct, and therefore the error between the obtained reconstructed data and the abnormal sample data is usually large; therefore, by using the original sample data, such as the historical data corresponding to the data to be detected to train the reconstruction model of the data to be trained, and then obtaining the target data reconstruction model with a smaller reconstruction error between the reconstructed data and the original sample data, in this way, when the data to be detected is normal data, it can usually be better reconstructed, and when the data to be detected is abnormal data, the error between its reconstructed data and the data to be detected is usually large. This method can increase the accuracy of judging whether the data to be detected is abnormal data.

[0157] The above describes in detail a method for obtaining a target data reconstruction model provided in the first embodiment of the present application, as well as why a target data reconstruction model is used to obtain reconstructed data corresponding to the data to be detected. According to the above description, since when obtaining the target data reconstruction model, it is not necessary to spend a lot of effort to mark the abnormal data in the original sample data, the method can relatively easily obtain the target data reconstruction model, thereby facilitating abnormality detection of the data to be detected.

[0158] After step S202 , step S203 is executed to obtain reconstruction error information between the data to be detected and the target reconstructed data.

[0159] According to the above description, the reconstruction error information can be the error value between the data to be detected and the target reconstructed data, that is, obtaining the reconstruction error information between the data to be detected and the target reconstructed data includes: calculating the error value between the data to be detected and the target reconstructed data; and obtaining the reconstruction error information based on the error value.

[0160] Since the data to be detected includes at least one of a first characteristic type of data to be detected and a second characteristic type of data to be detected, the target reconstruction data corresponding to the data to be detected also includes first target reconstruction data corresponding to the first characteristic type of data to be detected and second target reconstruction data corresponding to the second characteristic type of data to be detected. Therefore, calculating the error value between the data to be detected and the target reconstruction data includes: obtaining a first error value corresponding to the first characteristic type of data to be detected and the first target reconstruction data, and obtaining a second error value corresponding to the second characteristic type of data to be detected and the second target reconstruction data.

[0161] The obtaining of a first error value corresponding to the first feature type to be detected data and the first target reconstructed data includes: obtaining the first error value by calculating a mean square error value between the first feature type to be detected data and the first target reconstructed data.

[0162] For example, the first feature type data to be detected corresponding to the target object is in the form of (entity ID, feature 1, feature 2), such as (id00001, 0.331, 0.8716); the first target reconstructed data corresponding to the data is (id00001, 0.231, 0.8826); then, the mean square error value between the first feature type data to be detected and the first target reconstructed data is ((0.331-0.231)^2+(0.8716-0.8826)^2)^0.5.

[0163] The obtaining of a second error value corresponding to the second feature type to be detected data and the second target reconstructed data includes: obtaining the second error value by calculating the cross entropy between the second feature type to be detected data and the second target reconstructed data.

[0164] For example, the second feature type to be detected data corresponding to the target object is in the form of (entity ID, time, timing feature 1, timing feature 2), such as (id00001, 2020-1-20 03:20, 0.1,, 0.4); the second target reconstructed data corresponding to the data is (id00001, 2020-1-20 03:20, 0.15, 0.32); then, the cross entropy between the second feature type to be detected data and the second target reconstructed data is (0.1*log(0.15)+(1-0.1)*log(1-0.15)+0.4*log(0.32)+(1-0.4)*log(1-0.32)) / 2.

[0165] The above describes in detail how to obtain the reconstruction error information between the data to be detected and the target reconstruction data. It should be noted that, in specific implementation, the reconstruction error information can also be obtained by other methods, which will not be described in detail here.

[0166] Step S204: determining whether the data to be detected is abnormal data based on the reconstruction error information.

[0167] After obtaining reconstruction error information, such as an error value, between the data to be detected and the target reconstructed data in step S203, it is possible to determine whether the data to be detected is abnormal data based on the reconstruction error information.

[0168] The determining whether the data to be detected is abnormal data based on the reconstruction error information includes: if the reconstruction error information is not less than a preset reconstruction error threshold, determining that the data to be detected is abnormal data, wherein the preset reconstruction error threshold is a value obtained during the training process of obtaining the target data reconstruction model, wherein the reconstruction error threshold can be obtained according to the error change trend between the obtained reconstructed data and the original sample data during the training process of obtaining the target data reconstruction model, and no further details are given here.

[0169] In addition, when the target object is a machine device, such as a router, switch or other network device, after obtaining the operating status data to be detected and the operating status reconstruction data of the network device, when the operating status data to be detected is judged to be abnormal data based on the reconstruction error information between the operating status data to be detected and the operating status reconstruction data, the network device can be determined to be an abnormally operating device. At this time, abnormal warning information can be pushed to the user's computing device or the network device can be directly restarted so that the network device can resume normal operation as soon as possible.

[0170] In addition, when the target object is a certain network platform, such as a payment platform or an e-commerce platform, because such platforms usually involve more sensitive data, when the platform operation data corresponding to the network platform and the corresponding platform operation reconstruction data are used to obtain the reconstruction error information between the two data, and based on the reconstruction error information, the platform operation data is judged to be abnormal operation data, such as intrusion data targeting the network platform or risky transaction data, then after obtaining authorization, the user information corresponding to the abnormal operation data can be obtained, and abnormal warning information can be sent to the user computing device corresponding to the user information; at the same time, a service suspension message can also be sent to the network platform to enable the network platform to stop receiving operation requests from the user computing device within a preset time range, so as to avoid further intrusion attacks on the network platform.

[0171] It should be noted that, in specific implementation, the abnormal data monitoring method described in this application can of course also be applied to other scenarios as needed, which will not be described in detail here.

[0172] In summary, the abnormal data detection method provided by the first embodiment of the present application includes: obtaining the data to be detected; inputting the data to be detected into the target data reconstruction model to obtain target reconstruction data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on the characteristic information of the data to be detected and obtaining the reconstructed data corresponding to the data to be detected; obtaining reconstruction error information between the data to be detected and the target reconstruction data; and judging whether the data to be detected is abnormal data based on the reconstruction error information. When judging whether the data to be detected is abnormal data, the method does not need to pay attention to the specific type of data. It only needs to obtain the target reconstruction data corresponding to the data to be detected through the target data reconstruction model, and by obtaining the reconstruction error information between the data to be detected and the target reconstruction data, it can conveniently and accurately judge whether the data to be detected is abnormal data.

[0173] Corresponding to the abnormal data detection method provided in the first embodiment of the present application, the second embodiment of the present application also provides a method for obtaining a data reconstruction model, please refer to Figure 4 As shown, it is a flowchart of a method for obtaining a data reconstruction model provided in the second embodiment of the present application, wherein some steps have been described in detail in the first embodiment of the present application, so the description here is relatively simple. For relevant matters, please refer to some descriptions in the method provided in the first embodiment of the present application. The processing process described below is only illustrative.

[0174] Step S401 : acquiring original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data.

[0175] Step S402: training and obtaining a target data reconstruction model based on the original sample data;

[0176] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0177] Optionally, the training to obtain the target data reconstruction model based on the original sample data includes: obtaining a reconstruction model of the data to be trained, and obtaining the first feature type sample data and the second feature type sample data from the original sample data, wherein the reconstruction model of the data to be trained is a model corresponding to the target data reconstruction model; using the first feature type sample data to train the first encoding sub-model in the reconstruction model of the data to be trained to obtain the first sample feature information, and using the second feature type sample data to train the second encoding sub-model in the reconstruction model of the data to be trained to obtain the second sample feature information; using the first sample feature information to train the first decoding sub-model in the reconstruction model of the data to be trained to obtain the first reconstruction data, and using the second sample feature information to train the second decoding sub-model in the reconstruction model of the data to be trained to obtain the second reconstruction data; adjusting the parameters in the reconstruction model of the data to be trained by obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, to obtain the target data reconstruction model that meets preset convergence conditions.

[0178] Optionally, the method also includes: using the hidden layer in the data reconstruction model to be trained to perform splicing processing on the first sample feature information and the second sample feature information, and using the fully connected layer corresponding to the hidden layer to perform mapping processing on the first sample feature information and the second sample feature information after splicing processing to obtain the complete sample feature information to be decoded; the method also includes: using the first sample feature information to train the first decoding sub-model in the data reconstruction model to be trained to obtain the first reconstructed data, and using the second sample feature information to train the second decoding sub-model in the data reconstruction model to be trained to obtain the second reconstructed data, and before obtaining the second reconstructed data, obtaining the first sample feature information from the complete sample feature information to be decoded, and obtaining the second sample feature information.

[0179] Corresponding to the abnormal data detection method provided in the first embodiment of the present application, the third embodiment of the present application also provides a method for detecting abnormal access data on a network platform, see Figure 5 As shown, it is a flowchart of a method for detecting abnormal access data for a network platform provided in the third embodiment of the present application, wherein some steps have been described in detail in the first embodiment of the present application, so the description here is relatively simple. For relevant matters, please refer to some descriptions in the method provided in the first embodiment of the present application. The processing process described below is only illustrative.

[0180] Step S501: Acquire the operation data of the platform to be detected corresponding to the target network platform.

[0181] Step S502: input the operation data of the platform to be detected into the target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected according to the characteristic information of the operation data of the platform to be detected and obtain reconstruction data corresponding to the operation data of the platform to be detected.

[0182] Step S503 : obtaining reconstruction error information between the operation data of the platform to be detected and the reconstructed operation data of the target platform.

[0183] Step S504 : judging whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0184] Optionally, if the operation data of the platform to be detected is judged to be abnormal operation data based on the reconstruction error information, the method also includes: obtaining log data corresponding to the abnormal operation data; obtaining abnormal location data based on the log data, wherein the abnormal location data is used to locate the program instruction data that generates the abnormal operation data.

[0185] Optionally, it also includes: obtaining user information corresponding to the abnormal operation data; and sending abnormal warning information to the user computing device corresponding to the user information based on the user information, wherein the abnormal warning information corresponds to the abnormal operation data, and the user computing device is the computing device used by the user corresponding to the user information.

[0186] Optionally, the method further includes: sending a target service suspension message to the target network platform, where the target service suspension message is used to enable the target network platform to stop receiving operation requests from the user computing device within a preset time range.

[0187] Optionally, the target network platform includes at least any one of the following platforms: a payment platform, an e-commerce platform.

[0188] Corresponding to the abnormal data detection method provided in the first embodiment of the present application, the fourth embodiment of the present application also provides an abnormal data detection device, see Figure 6 , which is a schematic diagram of an abnormal data detection device provided in the fourth embodiment of the present application. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The device embodiment described below is only illustrative. The fourth embodiment of the present application provides an abnormal data detection device including the following parts:

[0189] The data to be detected acquiring unit 601 is used to acquire the data to be detected.

[0190] The target reconstruction data acquisition unit 602 is used to input the data to be detected into the target data reconstruction model to obtain target reconstruction data corresponding to the data to be detected, wherein the target data reconstruction model is a model used to reconstruct the data to be detected based on the characteristic information of the data to be detected and obtain reconstructed data corresponding to the data to be detected.

[0191] The reconstruction error information obtaining unit 603 is configured to obtain reconstruction error information between the to-be-detected data and the target reconstructed data.

[0192] The judging unit 604 is configured to judge whether the data to be detected is abnormal data according to the reconstruction error information.

[0193] Optionally, the reconstruction error information acquisition unit is specifically used to: calculate an error value between the data to be detected and the target reconstructed data; and obtain the reconstruction error information according to the error value.

[0194] Optionally, the data to be detected includes at least one of a first feature type of data to be detected and a second feature type of data to be detected, and the target reconstruction data includes first target reconstruction data corresponding to the first feature type of data to be detected and second target reconstruction data corresponding to the second feature type of data to be detected; the calculation of the error value between the data to be detected and the target reconstruction data includes: obtaining a first error value corresponding to the first feature type of data to be detected and the first target reconstruction data, and obtaining a second error value corresponding to the second feature type of data to be detected and the second target reconstruction data.

[0195] Optionally, obtaining a first error value corresponding to the first feature type data to be detected and the first target reconstructed data includes: obtaining the first error value by calculating a mean square error value between the first feature type data to be detected and the first target reconstructed data.

[0196] Optionally, obtaining a second error value corresponding to the second feature type data to be detected and the second target reconstructed data includes: obtaining the second error value by calculating the cross entropy between the second feature type data to be detected and the second target reconstructed data.

[0197] Optionally, judging whether the data to be detected is abnormal data based on the reconstruction error information includes: if the reconstruction error information is not less than a preset reconstruction error threshold, judging that the data to be detected is abnormal data, wherein the preset reconstruction error threshold is a value obtained in the process of training the target data reconstruction model.

[0198] Corresponding to the abnormal data detection method provided in the first embodiment of the present application, the fifth embodiment of the present application further provides an electronic device, see Figure 7 , which is a schematic diagram of an electronic device provided in the fifth embodiment of the present application. Since the electronic device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The electronic device embodiment described below is only illustrative. The electronic device provided in the fifth embodiment of the present application includes:

[0199] Processor 701;

[0200] The memory 702 is used to store a program of the abnormal data detection method. After the device is powered on and the program of the abnormal data detection method is run by the processor, the following steps are performed:

[0201] Obtain the data to be tested;

[0202] Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected;

[0203] Acquiring reconstruction error information between the data to be detected and the target reconstruction data;

[0204] It is determined whether the data to be detected is abnormal data according to the reconstruction error information.

[0205] Corresponding to the abnormal data detection method provided in the first embodiment of the present application, the sixth embodiment of the present application also provides a storage device. Since the storage device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant matters, please refer to the partial description of the method embodiment. The storage device embodiment described below is merely illustrative.

[0206] A sixth embodiment of the present application provides a storage device storing a program of an abnormal data detection method. The program is executed by a processor to perform the following steps:

[0207] Obtain the data to be tested;

[0208] Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected;

[0209] Acquiring reconstruction error information between the data to be detected and the target reconstruction data;

[0210] It is determined whether the data to be detected is abnormal data according to the reconstruction error information.

[0211] Corresponding to the method for obtaining a data reconstruction model provided in the second embodiment of the present application, the seventh embodiment of the present application further provides an apparatus for obtaining a data reconstruction model, see Figure 7 , which is a schematic diagram of a device for obtaining a data reconstruction model provided in the seventh embodiment of the present application. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The device embodiment described below is merely illustrative. The device for obtaining a data reconstruction model provided in the seventh embodiment of the present application includes the following parts:

[0212] The data acquisition unit 701 is configured to acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data.

[0213] A training unit 702 is configured to train a target data reconstruction model based on the original sample data;

[0214] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0215] Corresponding to the method for obtaining a data reconstruction model provided in the second embodiment of the present application, the eighth embodiment of the present application further provides an electronic device. Since the electronic device embodiment is substantially similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The electronic device embodiment described below is merely illustrative. The electronic device provided in the eighth embodiment of the present application includes:

[0216] processor;

[0217] The memory is used to store a program for obtaining a data reconstruction model. After the device is powered on and the program for obtaining a data reconstruction model is run by the processor, the following steps are performed:

[0218] Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0219] According to the original sample data, training is performed to obtain a target data reconstruction model;

[0220] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0221] Corresponding to the method for obtaining a data reconstruction model provided in the second embodiment of the present application, the ninth embodiment of the present application also provides a storage device. Since the storage device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant matters, please refer to the partial description of the method embodiment. The storage device embodiment described below is merely illustrative.

[0222] A ninth embodiment of the present application provides a storage device storing a program for a method of obtaining a data reconstruction model. The program is executed by a processor to perform the following steps:

[0223] Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data;

[0224] According to the original sample data, training is performed to obtain a target data reconstruction model;

[0225] In which, the target data reconstruction model is a model used to reconstruct the data to be detected based on the feature information of the data to be detected and obtain reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data based on the second sample feature information.

[0226] Corresponding to the abnormal data detection method for a network platform provided in the third embodiment of the present application, the tenth embodiment of the present application also provides an abnormal data detection device for a network platform, please refer to Figure 9 , which is a schematic diagram of an abnormal data detection device for a network platform provided in the tenth embodiment of the present application. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The device embodiment described below is only illustrative. The tenth embodiment of the present application provides an abnormal access data detection device for a network platform, which includes the following parts:

[0227] The platform operation data acquisition unit 901 is configured to acquire the platform operation data corresponding to the target network platform.

[0228] The target platform operation reconstruction data acquisition unit 902 is used to input the platform operation data to be detected into the target data reconstruction model to obtain the target platform operation reconstruction data corresponding to the platform operation data to be detected, wherein the target data reconstruction model is used to reconstruct the platform operation data to be detected according to the characteristic information of the platform operation data to be detected and obtain the reconstructed data corresponding to the platform operation data to be detected.

[0229] The reconstruction error information obtaining unit 903 is configured to obtain reconstruction error information between the to-be-detected platform operation data and the target platform operation reconstruction data.

[0230] The abnormal operation data judging unit 904 is configured to judge whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0231] Corresponding to the abnormal data detection method for a network platform provided in the third embodiment of the present application, the eleventh embodiment of the present application further provides an electronic device. Since the electronic device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The electronic device embodiment described below is merely illustrative. The electronic device provided in the eleventh embodiment of the present application includes:

[0232] processor;

[0233] The memory is used to store a program of a method for detecting abnormal data on a network platform. After the device is powered on and the program of the method for detecting abnormal data on a network platform is run by the processor, the following steps are performed:

[0234] Obtaining the operation data of the platform to be detected corresponding to the target network platform;

[0235] Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected;

[0236] Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform;

[0237] It is determined whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0238] Corresponding to the abnormal data detection method for a network platform provided in the third embodiment of the present application, the twelfth embodiment of the present application also provides a storage device. Since the storage device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant matters, please refer to the partial description of the method embodiment. The storage device embodiment described below is merely illustrative.

[0239] A twelfth embodiment of the present application provides a storage device storing a program for a method for detecting abnormal data on a network platform. The program is executed by a processor to perform the following steps:

[0240] Obtaining the operation data of the platform to be detected corresponding to the target network platform;

[0241] Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected;

[0242] Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform;

[0243] It is determined whether the platform operation data to be detected is abnormal operation data according to the reconstruction error information.

[0244] Corresponding to the abnormal data detection method provided in the first embodiment of the present application, the thirteenth embodiment of the present application also provides an abnormality detection method for a target device, see Figure 10As shown, it is a flowchart of an abnormality detection method for a target device provided in the thirteenth embodiment of the present application, some of the steps of which have been described in detail in the first embodiment of the present application, so the description here is relatively simple. For relevant matters, please refer to the partial description of the method provided in the first embodiment of the present application. The processing process described below is only illustrative.

[0245] Step S1001: Acquire the operating status data to be detected of the target device.

[0246] Step S1002: input the operating status data to be detected into a target data reconstruction model to obtain target operating status reconstruction data corresponding to the operating status data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating status data according to characteristic information of the operating status data and obtaining reconstructed data corresponding to the operating status data.

[0247] Step S1003 : obtaining reconstruction error information between the to-be-detected operating state data and the target operating state reconstruction data.

[0248] Step S1004: determining whether the target device is an abnormally operating device based on the reconstruction error information.

[0249] Corresponding to the abnormality detection method for a target device provided in the thirteenth embodiment of the present application, the fourteenth embodiment of the present application also provides an abnormality detection device for a target device, see Figure 11 , which is a schematic diagram of an abnormality detection device for a target device provided in the fourteenth embodiment of the present application. Since the device embodiment is basically similar to the method embodiment, the description is relatively simple. For relevant details, please refer to the partial description of the method embodiment. The device embodiment described below is only illustrative. The fourteenth embodiment of the present application provides an abnormality detection device for a target device, which includes the following parts:

[0250] The to-be-detected running status data acquiring unit 1101 is configured to acquire the to-be-detected running status data of the target device.

[0251] The operating status data reconstruction unit 1102 is used to input the operating status data to be detected into the target data reconstruction model to obtain target operating status reconstruction data corresponding to the operating status data to be detected, wherein the target data reconstruction model is a model used to reconstruct the operating status data according to the characteristic information of the operating status data and obtain reconstructed data corresponding to the operating status data.

[0252] The reconstruction error information acquiring unit 1103 is configured to acquire reconstruction error information between the to-be-detected operating state data and the target operating state reconstructed data.

[0253] The judging unit 1104 is configured to judge whether the target device is an abnormally operating device according to the reconstruction error information.

[0254] Although the present application is disclosed as above with the preferred embodiments, it is not intended to limit the present application. Any person skilled in the art may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

[0255] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0256] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0257] Computer-readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0258] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

Claims

1. A method for detecting abnormal data, characterized in that: include: Obtaining data to be detected; for a smart wearable device, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; For a vehicle object, the corresponding data to be detected is the relative position information of the vehicle object and its surrounding vehicles in time sequence when the vehicle object is traveling; Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected; Acquiring reconstruction error information between the data to be detected and the target reconstruction data; determining whether the data to be detected is abnormal data according to the reconstruction error information; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

2. The abnormal data detection method according to claim 1, characterized in that: The step of training the target data reconstruction model based on the original sample data includes: Obtaining a reconstruction model for the data to be trained, and obtaining sample data of the first feature type and sample data of the second feature type from the original sample data, wherein the reconstruction model for the data to be trained is a model corresponding to the reconstruction model for the target data; Using the first feature type sample data to train a first encoding sub-model in the model for reconstructing the data to be trained to obtain the first sample feature information, and using the second feature type sample data to train a second encoding sub-model in the model for reconstructing the data to be trained to obtain the second sample feature information; The first decoding sub-model in the data reconstruction model to be trained is trained using the first sample feature information to obtain the first reconstruction data, and the second decoding sub-model in the data reconstruction model to be trained is trained using the second sample feature information to obtain the second reconstruction data.

3. The abnormal data detection method according to claim 2, characterized in that: The method further comprises: Before using the first sample characteristic information to train the first decoding sub-model in the reconstruction model of the data to be trained and obtaining the first reconstruction data, and before using the second sample characteristic information to train the second decoding sub-model in the reconstruction model of the data to be trained and obtaining the second reconstruction data, the first sample characteristic information is obtained from the complete sample characteristic information to be decoded, and the second sample characteristic information is obtained.

4. The abnormal data detection method according to claim 1, characterized in that: The first encoding sub-model and the first decoding sub-model are deep neural network models, and the second encoding sub-model and the second decoding sub-model are recurrent neural network models.

5. The abnormal data detection method according to claim 1, characterized in that: The obtaining of reconstruction error information between the data to be detected and the target reconstructed data includes: Calculating the error value between the data to be detected and the target reconstructed data; The reconstruction error information is obtained according to the error value.

6. The abnormal data detection method according to claim 5, characterized in that: The data to be detected includes at least one of a first characteristic type of data to be detected and a second characteristic type of data to be detected, and the target reconstruction data includes first target reconstruction data corresponding to the first characteristic type of data to be detected and second target reconstruction data corresponding to the second characteristic type of data to be detected; The calculating the error value between the to-be-detected data and the target reconstructed data includes: A first error value corresponding to the first feature type to-be-detected data and the first target reconstructed data is obtained, and a second error value corresponding to the second feature type to-be-detected data and the second target reconstructed data is obtained.

7. The abnormal data detection method according to claim 6, characterized in that: The obtaining of a first error value corresponding to the first feature type to-be-detected data and the first target reconstructed data includes: The first error value is obtained by calculating a mean square error value between the first feature type to-be-detected data and the first target reconstructed data.

8. The abnormal data detection method according to claim 6, characterized in that: The obtaining of a second error value corresponding to the second feature type to-be-detected data and the second target reconstructed data includes: The second error value is obtained by calculating the cross entropy between the second feature type to be detected data and the second target reconstructed data.

9. The abnormal data detection method according to claim 1, characterized in that: The determining, based on the reconstruction error information, whether the data to be detected is abnormal data includes: If the reconstruction error information is not less than a preset reconstruction error threshold, the data to be detected is determined to be abnormal data, wherein the preset reconstruction error threshold is a value obtained in the process of training the target data reconstruction model.

10. A method for obtaining a data reconstruction model, characterized in that: include: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain a target data reconstruction model; Wherein, the target data reconstruction model is a model for reconstructing the data to be detected according to the feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected; for smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and its surrounding vehicles in time sequence when driving; the target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data according to the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data according to the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

11. A method for detecting abnormal data on a network platform, characterized in that: include: Obtaining the operation data of the platform to be detected corresponding to the target network platform; Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is a model for reconstructing the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtaining reconstruction data corresponding to the operation data of the platform to be detected; Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform; determining, based on the reconstruction error information, whether the platform operation data to be detected is abnormal operation data; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single-value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a network platform; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

12. The abnormal data detection method for a network platform according to claim 11, characterized in that: If, based on the reconstruction error information, it is determined that the platform operation data to be detected is abnormal operation data, the method further includes: Obtaining log data corresponding to the abnormal operation data; Abnormality locating data is obtained according to the log data, wherein the abnormality locating data is used to locate program instruction data that generates the abnormal operation data.

13. The abnormal data detection method for a network platform according to claim 11, characterized in that: Also includes: Acquiring user information corresponding to the abnormal operation data; According to the user information, abnormal warning information is sent to the user computing device corresponding to the user information, wherein the abnormal warning information corresponds to the abnormal operation data, and the user computing device is a computing device used by the user corresponding to the user information.

14. The abnormal data detection method for a network platform according to claim 13, characterized in that: Also includes: A target service suspension message is sent to the target network platform, where the target service suspension message is used to cause the target network platform to stop receiving operation requests from the user computing device within a preset time range.

15. The abnormal data detection method for a network platform according to claim 11, characterized in that: The target network platform includes at least any one of the following platforms: a payment platform and an e-commerce platform.

16. A method for detecting anomalies of a target device, characterized in that: include: Obtain the target device's operating status data to be tested; Inputting the operating state data to be detected into a target data reconstruction model to obtain target operating state reconstruction data corresponding to the operating state data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating state data according to feature information of the operating state data and obtaining reconstruction data corresponding to the operating state data; Acquiring reconstruction error information between the operating state data to be detected and the target operating state reconstruction data; determining, based on the reconstruction error information, whether the target device is an abnormally operating device; The target data reconstruction model is obtained by the following method: Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a target device; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

17. An abnormal data detection device, characterized in that: include: A data acquisition unit for detecting, used for acquiring data for detecting; For smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and its surrounding vehicles in time sequence while driving; a target reconstruction data acquisition unit, configured to input the data to be detected into a target data reconstruction model to acquire target reconstruction data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and acquiring reconstructed data corresponding to the data to be detected; A reconstruction error information acquisition unit, configured to acquire reconstruction error information between the data to be detected and the target reconstructed data; a judging unit, configured to judge whether the data to be detected is abnormal data according to the reconstruction error information; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

18. An electronic device, characterized in that: include: processor; The memory is used to store a program of the abnormal data detection method. After the device is powered on and the program of the abnormal data detection method is run by the processor, the following steps are performed: Acquire the data to be detected; for smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and its surrounding vehicles in time sequence while driving; Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected; Acquiring reconstruction error information between the data to be detected and the target reconstruction data; determining whether the data to be detected is abnormal data according to the reconstruction error information; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

19. A storage device, characterized in that: A program storing an abnormal data detection method is executed by a processor to perform the following steps: Acquire the data to be detected; for smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and its surrounding vehicles in time sequence while driving; Inputting the data to be detected into a target data reconstruction model to obtain target reconstructed data corresponding to the data to be detected, wherein the target data reconstruction model is a model for reconstructing the data to be detected based on feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected; Acquiring reconstruction error information between the data to be detected and the target reconstruction data; determining whether the data to be detected is abnormal data according to the reconstruction error information; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

20. An abnormal data detection device, characterized in that: include: A data acquisition unit is configured to acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single-value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; A training unit, configured to train and obtain a target data reconstruction model based on the original sample data; Wherein, the target data reconstruction model is a model for reconstructing the data to be detected according to the feature information of the data to be detected and obtaining the reconstructed data corresponding to the data to be detected, and the target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data according to the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data according to the second sample feature information; for smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and the surrounding vehicles in time sequence when driving; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

21. An electronic device, characterized in that: include: processor; The memory is used to store a program for obtaining a data reconstruction model. After the device is powered on and the program for obtaining a data reconstruction model is run by the processor, the following steps are performed: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain a target data reconstruction model; Wherein, the target data reconstruction model is a model for reconstructing the data to be detected according to the feature information of the data to be detected and obtaining the reconstructed data corresponding to the data to be detected, and the target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct the first reconstructed data corresponding to the first feature type sample data according to the first sample feature information, and the second decoding sub-model is used to reconstruct the second reconstructed data corresponding to the second feature type sample data according to the second sample feature information; for smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and the surrounding vehicles in time sequence when driving; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

22. A storage device, characterized in that: A program storing a method for obtaining a data reconstruction model is executed by a processor to perform the following steps: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is any one of a smart wearable device and a vehicle object; According to the original sample data, training is performed to obtain a target data reconstruction model; Wherein, the target data reconstruction model is a model for reconstructing the data to be detected based on the feature information of the data to be detected and obtaining reconstructed data corresponding to the data to be detected. The target data reconstruction model includes an encoding module and a decoding module. The encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model. The first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information. For smart wearable devices, the corresponding data to be detected is the heart rate value detected by the smart wearable device within a preset time range; for vehicle objects, the corresponding data to be detected is the relative position information of the vehicle object and its surrounding vehicles in time sequence while driving; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

23. An abnormal data detection device for a network platform, characterized in that: include: The platform operation data acquisition unit to be detected is used to acquire the platform operation data to be detected corresponding to the target network platform; a target platform operation reconstruction data acquisition unit, configured to input the operation data of the platform to be detected into a target data reconstruction model, and acquire target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is configured to reconstruct the operation data of the platform to be detected based on characteristic information of the operation data of the platform to be detected, and to acquire reconstructed data corresponding to the access data of the platform to be detected; a reconstruction error information acquiring unit, configured to acquire reconstruction error information between the operation data of the platform to be detected and the reconstructed data of the target platform operation; an abnormal operation data judging unit, configured to judge whether the operation data of the platform to be detected is abnormal operation data according to the reconstruction error information; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single-value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a network platform; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

24. An electronic device, characterized in that: include: processor; The memory is used to store a program of a method for detecting abnormal operation data on a network platform. After the device is powered on and the program of the method for detecting abnormal data on a network platform is run by the processor, the following steps are performed: Obtaining the operation data of the platform to be detected corresponding to the target network platform; Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected; Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform; determining, based on the reconstruction error information, whether the platform operation data to be detected is abnormal operation data; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single-value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a network platform; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

25. A storage device, characterized in that: A program storing a method for detecting abnormal data on a network platform is executed by a processor to perform the following steps: Obtaining the operation data of the platform to be detected corresponding to the target network platform; Inputting the operation data of the platform to be detected into a target data reconstruction model to obtain target platform operation reconstruction data corresponding to the operation data of the platform to be detected, wherein the target data reconstruction model is used to reconstruct the operation data of the platform to be detected based on feature information of the operation data of the platform to be detected and obtain the reconstructed data corresponding to the operation data of the platform to be detected; Acquiring reconstruction error information between the operation data of the platform to be detected and the operation reconstruction data of the target platform; determining, based on the reconstruction error information, whether the platform operation data to be detected is abnormal operation data; The target data reconstruction model is obtained by the following method: Obtaining original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single-value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a network platform; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

26. An abnormality detection device for a target device, characterized in that: include: A unit for acquiring data of the operating status to be detected, used for acquiring the data of the operating status to be detected of the target device; an operating status data reconstruction unit, configured to input the operating status data to be detected into a target data reconstruction model, and obtain target operating status reconstruction data corresponding to the operating status data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating status data based on characteristic information of the operating status data and obtaining reconstructed data corresponding to the operating status data; a reconstruction error information acquiring unit, configured to acquire reconstruction error information between the operating state data to be detected and the target operating state reconstruction data; a judging unit, configured to judge whether the target device is an abnormally operating device based on the reconstruction error information; The target data reconstruction model is obtained by the following method: Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a target device; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

27. An electronic device, characterized in that: include: processor; The memory is configured to store a program for an abnormality detection method for a target device. After the device is powered on and the program for the abnormality detection method for the target device is run by the processor, the following steps are performed: Obtain the target device's operating status data to be tested; Inputting the operating state data to be detected into a target data reconstruction model to obtain target operating state reconstruction data corresponding to the operating state data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating state data according to feature information of the operating state data and obtaining reconstruction data corresponding to the operating state data; Acquiring reconstruction error information between the operating state data to be detected and the target operating state reconstruction data; determining, based on the reconstruction error information, whether the target device is an abnormally operating device; The target data reconstruction model is obtained by the following method: Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a target device; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

28. A storage device, characterized in that: A program storing an anomaly detection method for a target device is executed by a processor to perform the following steps: Obtain the target device's operating status data to be tested; Inputting the operating state data to be detected into a target data reconstruction model to obtain target operating state reconstruction data corresponding to the operating state data to be detected, wherein the target data reconstruction model is a model for reconstructing the operating state data according to feature information of the operating state data and obtaining reconstruction data corresponding to the operating state data; Acquiring reconstruction error information between the operating state data to be detected and the target operating state reconstruction data; determining, based on the reconstruction error information, whether the target device is an abnormally operating device; The target data reconstruction model is obtained by the following method: Acquire original sample data, wherein the original sample data includes at least one of first feature type sample data and second feature type sample data; the first feature type sample data is single value indicator data corresponding to a target object, and the second feature type sample data is time series feature data corresponding to the target object, wherein the target object is a target device; According to the original sample data, training is performed to obtain the target data reconstruction model; The target data reconstruction model includes an encoding module and a decoding module, the encoding module includes a first encoding sub-model for obtaining first sample feature information corresponding to the first feature type sample data, and a second encoding sub-model for obtaining second sample feature information corresponding to the second feature type sample data; the decoding module includes a first decoding sub-model and a second decoding sub-model, the first decoding sub-model is used to reconstruct first reconstructed data corresponding to the first feature type sample data based on the first sample feature information, and the second decoding sub-model is used to reconstruct second reconstructed data corresponding to the second feature type sample data based on the second sample feature information; The step of training and obtaining the target data reconstruction model based on the original sample data includes: By obtaining first reconstruction error information corresponding to the first feature type sample data and the first reconstruction data, and second reconstruction error information corresponding to the second feature type sample data and the second reconstruction data, adjusting parameters in the reconstruction model of the data to be trained, a reconstruction model of the target data that meets a preset convergence condition is obtained; The first sample feature information and the second sample feature information are spliced ​​using the hidden layer in the data to be trained reconstruction model, and the first sample feature information and the second sample feature information after the splicing processing are mapped using the fully connected layer corresponding to the hidden layer to obtain the complete sample feature information to be decoded.

Images