Abnormality detection method and electronic device

Abstract

Embodiments of the present application disclose an anomaly detection method and an electronic device. The method comprises: determining a data set to be detected, the data set comprising a plurality of detection objects; performing anomaly detection on each detection object by using a plurality of anomaly detection mechanisms to generate a plurality of detection values; determining a plurality of data to be fused for each detection object and performing fusion processing, wherein for a current detection object: determining at least one neighbor object of the current detection object from the data set, and determining a plurality of data to be fused for the current detection object according to the plurality of detection values corresponding to the current detection object and the plurality of detection values corresponding to the neighbor object of the current detection object; and determining an anomaly detection result of the current detection object by performing fusion processing on the plurality of data to be fused for the current detection object. Through the embodiments of the present application, the occupation of computing resources can be reduced during the anomaly detection process.

Description

Technical Field

[0001] This application relates to the field of anomaly detection technology, and in particular to anomaly detection methods and electronic devices. Background Technology

[0002] Anomaly detection (or outlier detection) is a technique for identifying items, events, or observations in a dataset that do not match expected patterns. Anomaly detection techniques can be used in various fields, such as intrusion detection, fraud detection, fault detection, and system health monitoring. For example, in a product information service system, anomaly detection techniques can be used to detect abnormal situations such as click fraud. For instance, in some paid information delivery scenarios, after information is placed on certain pages, charges can be based on the number of clicks or impressions. However, fraud may occur during this process. For example, if an advertisement for the same store in a product information service system is clicked many times a day by the same IP address, this is an anomaly. Such abnormal clicks need to be detected to further analyze whether fraud exists. If so, no payment should be made for these clicks, and so on. In the above scenarios, anomaly detection techniques can be used to detect such abnormal clicks. For example, when conducting specific detection, genuine buyer users have many attributes, including their location which can be resolved from their network IP address, and whether they have clicked on similar products based on their purchase history. By analyzing this data, it is possible to detect whether there are any anomalies in specific clicks.

[0003] However, there are many anomaly detection algorithms, each used for different detection scenarios. Therefore, the typical detection method is to first use multiple anomaly detection algorithms to detect the same object separately, obtaining multiple detection values. Then, the detection values ​​output by the multiple anomaly detection algorithms are merged together to obtain the final anomaly detection result for the object (which can also be represented by a score). Afterward, the presence and degree of anomaly of the detected object can be determined based on the final merged score; for example, a higher score indicates a higher degree of anomaly, and so on.

[0004] A crucial aspect of anomaly detection using the methods described above is the need to construct a large number of data sets to be fused for the same detection object. These data sets must conform to statistical characteristics to offset biases caused by errors in individual algorithms. Current technologies address this issue primarily by creating numerous anomaly detection mechanisms. For example, this can be achieved by increasing the number of anomaly detection algorithms. Furthermore, for each algorithm, additional anomaly detection mechanisms can be constructed by modifying parameters, data input methods, feature space input methods, and so on. Then, each detection object can be scored using these different mechanisms, allowing the same algorithm to generate multiple different detection values ​​for the same object. In other words, this approach requires constructing ten thousand data sets to be fused for a single detection object. This necessitates first constructing ten thousand anomaly detection mechanisms and then performing ten thousand anomaly detection calculations for each object, resulting in significant computational resource consumption.

[0005] Therefore, how to reduce the consumption of computing resources during anomaly detection has become a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0006] This application provides an anomaly detection method and electronic device that can reduce the consumption of computing resources during anomaly detection.

[0007] This application provides the following solution:

[0008] An anomaly detection method, comprising:

[0009] Determine the dataset to be detected, which includes multiple objects to be detected;

[0010] Multiple anomaly detection mechanisms are used to perform anomaly detection on each object, generating multiple detection values;

[0011] For each detection object, multiple data sets to be fused are determined and fused. For one of the current detection objects:

[0012] From the dataset, at least one nearest neighbor object of the current detected object is determined, and multiple data to be fused for the current detected object are determined based on multiple detection values ​​corresponding to the current detected object and multiple detection values ​​corresponding to its nearest neighbor objects; the nearest neighbor object is a detected object whose feature similarity with the current detected object meets the target condition.

[0013] By fusing multiple data points of the current detection object, the abnormal detection result of the current detection object is determined.

[0014] Before determining multiple data points to be fused for each detection object, the method further includes:

[0015] The detection values ​​generated by different anomaly detection mechanisms are scaled uniformly.

[0016] The determination of multiple data to be fused for the current detection object includes:

[0017] The multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its nearest neighbor objects are determined as the data to be fused for the current detection object.

[0018] The determination of multiple data to be fused for the current detection object includes:

[0019] Select a subset of detection values ​​from the multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its neighboring objects, and determine the selected subset of detection values ​​as multiple data to be fused for the current detection object.

[0020] The selection of some detection values ​​includes:

[0021] Select some anomaly detection mechanisms from the multiple anomaly detection mechanisms, and determine multiple data to be fused for the current detection object and its neighboring objects based on the multiple detection values ​​generated by the partial anomaly detection mechanisms.

[0022] The selection of some detection values ​​includes:

[0023] Select a subset of neighboring objects from the at least one neighboring object, and determine multiple data to be fused for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the subset of neighboring objects.

[0024] The step of selecting a subset of neighboring objects from the at least one neighboring object includes:

[0025] The nearest object center is determined from the at least one nearest object, so that multiple data to be fused are determined for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the nearest object center.

[0026] The step of fusing multiple data points of the current detection object to determine the abnormal detection result of the current detection object includes:

[0027] The abnormal detection result of the current detection object is determined by performing fusion processing on the multiple data to be fused by summing, averaging, or taking the maximum value.

[0028] The step of fusing multiple data points of the current detection object to determine the abnormal detection result of the current detection object includes:

[0029] Based on numerical and distributional factors, multiple data points to be fused for the current detection object are fused.

[0030] The process of fusing multiple data points of the current detection object based on numerical and distribution factors includes:

[0031] The principal component analysis algorithm is used to reconstruct the multiple data to be fused, so that the data that belong to the main factors can be fused.

[0032] The process of fusing multiple data points of the current detection object based on numerical and distribution factors includes:

[0033] The occurrence frequency of multiple values ​​in the multiple data to be fused is determined, and the weights of the multiple values ​​are determined based on the occurrence frequency, so that fusion processing can be performed based on the multiple values ​​and their corresponding weights.

[0034] The process of fusing multiple data points of the current detection object based on numerical and distribution factors includes:

[0035] Based on numerical factors, multiple data to be fused for the current detection object are fused to obtain a first fusion result;

[0036] Based on distribution factors, multiple data to be fused for the current detection object are fused to obtain a second fusion result;

[0037] The first fusion result and the second fusion result are fused together to obtain the abnormal detection result of the current detection object.

[0038] This also includes:

[0039] Before fusing the first fusion result and the second fusion result, the first fusion result and the second fusion result are subjected to scale unification processing.

[0040] In the dataset, each detected object corresponds to feature information in multiple dimensions;

[0041] The similarity between different detected objects is determined based on the distance between the feature vectors of the detected objects.

[0042] The determination of the dataset to be detected includes:

[0043] When an anomaly detection request is received from the system under test, the dataset submitted by the system under test is obtained.

[0044] The system to be tested includes a commodity object information service system, and the dataset includes multiple access records corresponding to the target delivery information, with each access record being a detection object.

[0045] An anomaly detection method, comprising:

[0046] Determine the dataset to be detected, which includes multiple objects to be detected;

[0047] Multiple anomaly detection mechanisms are used to perform anomaly detection on each object, generating multiple detection values;

[0048] Based on the multiple detection values, multiple data to be fused are determined for each detection object;

[0049] Based on numerical and distributional factors, multiple data sets to be fused for each detection object are fused to obtain the anomaly detection results for each detection object.

[0050] An anomaly detection device, comprising:

[0051] A dataset determination unit is used to determine the dataset to be detected, wherein the dataset includes multiple detection objects;

[0052] The detection value generation unit is used to perform anomaly detection on each detection object using multiple anomaly detection mechanisms and generate multiple detection values.

[0053] A fusion unit is used to determine multiple data to be fused for each detection object and perform fusion processing. For one current detection object, the fusion unit includes:

[0054] The data to be fused determination subunit is used to determine at least one nearest neighbor object of the current detection object from the dataset, and to determine multiple data to be fused of the current detection object based on multiple detection values ​​corresponding to the current detection object and multiple detection values ​​corresponding to its nearest neighbor objects; the nearest neighbor object is a detection object whose feature similarity with the current detection object meets the target condition;

[0055] The fusion processing subunit is used to determine the abnormal detection result of the current detection object by fusing multiple data to be fused for the current detection object.

[0056] An anomaly detection device, comprising:

[0057] A dataset determination unit is used to determine the dataset to be detected, wherein the dataset includes multiple detection objects;

[0058] The detection value generation unit is used to perform anomaly detection on each detection object using multiple anomaly detection mechanisms and generate multiple detection values.

[0059] The data to be fused determination unit is used to determine multiple data to be fused for each detection object based on the multiple detection values;

[0060] The fusion processing unit is used to perform fusion processing on multiple data to be fused for each detection object based on numerical factors and distribution factors, so as to obtain the abnormal detection result of each detection object.

[0061] A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of any of the preceding methods.

[0062] An electronic device, comprising:

[0063] One or more processors; and

[0064] A memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method described in any of the preceding descriptions.

[0065] According to the specific embodiments provided in this application, the following technical effects are disclosed:

[0066] Through the embodiments of this application, a nearest neighbor factor can be added to the anomaly detection mechanism factor. This allows for selection from both the anomaly detection mechanism factor and the nearest neighbor factor when constructing the data to be fused. Consequently, more data to be fused can be constructed using fewer anomaly detection mechanisms. Therefore, the computational load can be reduced, saving computational resources.

[0067] Of course, any product implementing this application does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0068] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0069] Figure 1 This is a schematic diagram of the system architecture provided in the embodiments of this application;

[0070] Figure 2This is a flowchart of the first method provided in the embodiments of this application;

[0071] Figure 3 This is a schematic diagram of the data to be fused construction method provided in the embodiments of this application;

[0072] Figure 4 This is a flowchart of the second method provided in the embodiments of this application;

[0073] Figure 5 This is a schematic diagram of the first device provided in the embodiments of this application;

[0074] Figure 6 This is a schematic diagram of the second device provided in the embodiments of this application;

[0075] Figure 7 This is a schematic diagram of the electronic device provided in the embodiments of this application. Detailed Implementation

[0076] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0077] First, it should be noted that, in the process of developing this application, the inventors discovered that in the prior art, there are only two ways to construct a large amount of data to be fused for the detection objects: either increase the number of anomaly detection algorithms, or change the parameters, data input methods, feature input methods, etc., of the anomaly detection algorithms. However, both of these approaches actually involve constructing scores based on algorithmic factors (or anomaly detection mechanism factors). This means that the number of anomaly detection mechanisms needed to be constructed depends on the number of scores to be fused, and simultaneously, a corresponding number of anomaly detection calculations need to be performed on each detection object in the dataset.

[0078] However, there may be correlations between multiple detected objects in a dataset. For example, in the same dataset, a detected object may have at least one nearest neighbor object. A nearest neighbor object is another detected object that is similar to the detected object in terms of features (e.g., the distance between their feature vectors is relatively close, which will be discussed in detail later). If an anomaly detection algorithm is accurate, then the detection values ​​it gives for the detected object and its nearest neighbors should also be similar. That is, if a detected object itself is normal, other detected objects similar to it in the dataset are also very likely to be normal. When the anomaly detection algorithm detects these objects, the detection values ​​it gives should be relatively similar; for example, the detection values ​​representing the degree of anomalousness may all be relatively low. Conversely, if a detected object itself is anomalous, and there are other detected objects similar to it in the dataset, then these other detected objects are also very likely to be anomalous. Similarly, when the anomaly detection algorithm detects these anomalous objects and their nearest neighbors, the detection values ​​it gives should be relatively similar; for example, the detection values ​​may all be relatively high, and so on.

[0079] It is evident that the statistical characteristics of the detected values ​​can be reflected not only in the anomaly detection mechanism but also in the nearest neighbor object factor. Therefore, in this embodiment, both the anomaly detection mechanism factor and the nearest neighbor object factor can be considered simultaneously to construct the data to be fused for the detected object. That is, not only can multiple different anomaly detection mechanisms generate detection values ​​for a specific detected object x as the data to be fused, but multiple different detection mechanisms can also generate detection values ​​for the nearest neighbor object Y of the detected object x as the data to be fused for the detected object x. For example, if there are m different anomaly detection mechanisms and k detected objects in the dataset, the number of anomaly detections required is m×k, meaning m detection values ​​can be generated for each detected object. If a detected object x has n nearest neighbors, then at most m×n data to be fused can be constructed for the detected object x. In the prior art, if the same goal is to construct m×n data to be fused for a detected object x, m×n anomaly detection mechanisms are required, meaning the number of anomaly detections required is m×n×k. The number of anomaly detection mechanisms used directly determines the total computational load. It can be seen that by using the solution provided in this application, the number of anomaly detection mechanisms can be reduced by n times when the same amount of data to be fused needs to be constructed. Therefore, the computational load of the anomaly detection process can be significantly reduced, thereby reducing the occupation of computing resources.

[0080] Specifically, from a system architecture perspective, such as Figure 1As shown, embodiments of this application can provide an anomaly detection system for detecting anomalies in data within a system under test. Specifically, the system under test may include the aforementioned commodity object information service system, or it may include various other specific application systems. The system under test can, according to specific detection requirements, assemble multiple data points generated within the system into a dataset and initiate an anomaly detection request to the anomaly detection system for that dataset. Correspondingly, the anomaly detection system can first utilize multiple anomaly detection mechanisms to detect multiple objects in the dataset separately, generating multiple detection values ​​for each object. Then, it determines and fuses the data to be fused on a per-object basis. Specifically, for a particular object, one or more nearest neighbors can be identified from the dataset. Thus, the data to be fused for that object can be determined from the multiple detection values ​​corresponding to that object and its neighbors. Finally, fusion processing is performed based on this data to be fused to obtain the final detection value for that object. The specific detection results can be returned to the system under test, which can then determine whether there are any abnormalities such as cheating based on the specific detection results. In turn, it can process the corresponding detection objects according to the actual application scenario. For example, clicks that indicate cheating may not be counted in the billing count, and so on.

[0081] The specific implementation schemes provided in the embodiments of this application will be described in detail below.

[0082] Example 1

[0083] First, this first embodiment provides an anomaly detection method from the perspective of an anomaly detection system, see [link to previous document]. Figure 2 The method may specifically include:

[0084] S201: Determine the dataset to be detected, which includes multiple objects to be detected.

[0085] The specific dataset to be detected can be provided by the system under test, and may include multiple detection objects. In practice, the system under test can call the anomaly detection system and submit the specific dataset to be detected. In this way, the anomaly detection system can determine the dataset to be detected based on the specific call request received.

[0086] In other words, the detection object can be a specific piece of data from a dataset generated by the system under test that requires anomaly detection. The system under test can include, for example, the product object information service system described in the background section. The content of the specific dataset can be determined based on the specific detection requirements of the system under test. For instance, in the aforementioned product object information service system, it is necessary to detect whether there is any cheating during the clicking process of a target information (e.g., advertising information related to a merchant or store). Each click generates a click record (which could be a normal click by a consumer user, or a click simulated by a computer, etc.), and multiple click records can be generated over a period of time. The specific detection timing can also be determined by the system under test, and different detection timings may affect the generation of the dataset. For example, a product object information service system can detect relevant data generated in the system every minute or every half hour, etc. If detection is performed every minute, multiple click records related to a certain information generated in the most recent minute can be considered as a dataset; if detection is performed every half hour, multiple click records related to a certain information generated in the most recent half hour can be considered as a dataset, and so on. Once the dataset is determined, a request can be sent to the anomaly detection system to inspect the click records within it. At this point, each click record in the dataset becomes a test object. Of course, in practical applications, in addition to click records, other access records such as information display records may also be inspected, depending on the specific detection needs of the system under test.

[0087] Each specific detection object in the dataset can be described by feature information across multiple dimensions. For example, if the specific detection object is the aforementioned click record, the specific feature dimensions could include: user IP address, cookies (data stored on the user's local terminal by some websites for user identification, session tracking, etc., usually encrypted), device type, system type, battery level, etc. In other words, if a dataset contains k detection objects, each described by h dimensions of features, then the dataset can be identified by a k x h matrix, where each row represents a detection object. The feature information of the specific object being tested can also be provided by the system being tested.

[0088] For anomaly detection systems, the process involves detecting an object based on its characteristic information to determine if it exhibits anomalies. For example, based on the IP address and cookies of a click record, corresponding historical behavior records can be retrieved from a relevant database, and the system can determine if the click record might be abnormal. As described in the background section, anomaly detection requires constructing a large amount of data to be fused for the same object to conform to statistical characteristics and offset biases caused by errors in individual anomaly detection algorithms.

[0089] S202: Use multiple anomaly detection mechanisms to perform anomaly detection on each detection object and generate multiple detection values.

[0090] Once the dataset to be detected is determined, various anomaly detection mechanisms can be used to perform anomaly detection on each object in the dataset. This allows multiple detection values ​​to be generated for each object. For example, assuming there are m anomaly detection mechanisms and k objects in the dataset, m detection values ​​can be generated for each object, resulting in a total of m×k detection values ​​for the dataset.

[0091] There are multiple methods for obtaining anomaly detection mechanisms. For example, one can first acquire multiple anomaly detection algorithms, and then vary the parameters, data input methods, and feature input methods for each algorithm. This allows each algorithm to generate multiple anomaly detection mechanisms, and each mechanism can generate a detection value for a specific object. For instance, assuming there are d anomaly detection algorithms and e transformation methods for each algorithm, a total of d×e anomaly detection mechanisms can be generated, and so on.

[0092] It should be noted that there can be various specific implementations of the anomaly detection algorithm and its transformation methods, and this part is not the focus of this application's embodiments, so it will not be described in detail here. However, it should also be noted that in this application's embodiments, if it is necessary to construct multiple data to be fused for a detection object, the number of anomaly detection mechanisms to be constructed can be much smaller than the number of data to be fused.

[0093] S203: For each detected object, determine multiple data to be fused and perform fusion processing. For one of the current detected objects, the following processing can be performed:

[0094] S2031: Determine at least one nearest neighbor object of the current detected object from the dataset, and determine multiple data to be fused for the current detected object based on multiple detection values ​​corresponding to the current detected object and multiple detection values ​​corresponding to its nearest neighbor objects; the nearest neighbor object is a detected object whose similarity to the current detected object meets the target condition;

[0095] S2032: By fusing multiple data points of the current detection object, the abnormal detection result of the current detection object is determined.

[0096] After obtaining multiple detection results for each detection object, the data to be fused can be constructed and specific fusion processing can be performed on a per-detection-object basis in order to obtain the abnormal detection results for each detection object.

[0097] It's important to note that different anomaly detection mechanisms may correspond to different anomaly detection algorithms, and these algorithms can vary significantly in the scale on which they represent the detected values. For example, some anomaly detection algorithms use values ​​between 0 and 100, while others use values ​​between 100 and 1000, and so on. Therefore, directly fusing these detection values ​​may lead to inaccuracies. To address this, in an optional implementation, before performing the fusion process, the detection values ​​generated by different anomaly detection mechanisms can first undergo scale unification. For example, the numerical representations at various scales can be unified to the same scale, mapping the original dimensional numerical representations to dimensionless relative values, thus making the detection values ​​from different anomaly detection algorithms more comparable.

[0098] Specifically, when constructing the data to be fused for the current detected object, as mentioned above, in this embodiment, the anomaly detection mechanism and the nearest neighbor object factors can be combined to construct the data to be fused. For a given current detected object x, one or more nearest neighbor objects can first be determined from the dataset. Specifically, since each detected object in the dataset corresponds to its own feature vector, the distance between different detected objects (e.g., Euclidean distance, edit distance, etc.) can be calculated based on the specific feature vector. This distance represents the feature similarity between detected objects. Detected objects whose feature similarity meets the target conditions can be considered as the nearest neighbors of the current detected object x. For example, the distances between the current detected object x and other detected objects are calculated, and then the distance values ​​are sorted, with the top r detected objects determined as the nearest neighbors of the current detected object. Alternatively, when determining nearest neighbor objects, the specific distance value between them and the current detection object can also be considered. For example, if there is a detection object among the first r detection objects that is far away from the current detection object, such as being much greater than the distance between the current detection object and other detection objects, then that detection object can be removed from the nearest neighbor objects of the current detection object x, and so on.

[0099] After identifying r nearest neighbors of the current detection object x (the specific value can vary depending on the specific situation), the data to be fused for the detection object x can be determined based on the detection value corresponding to the detection object x and the detection values ​​corresponding to its r nearest neighbors.

[0100] For example, such as Figure 3 As shown, assuming the current detection object is Q, and its nearest neighbors are detection objects D, E, and F; the anomaly detection mechanisms include (D1, X, F, P2), (D1, X, F, P1), (D2, X, F, P3), (D1, X... s1 (F, P1), (D1, X) s2 (F, P1), (D1, X, F) s1 (P1), (D1, X, F) s2 P1), etc. Here, D represents the anomaly detection algorithm, X represents the input data, F represents the input features, and P represents the parameters in the algorithm. It can be seen that the first and second rows of the matrix use the same algorithm, the same input data, and the same input features, but different algorithm parameters, thus corresponding to different anomaly detection mechanisms. The second and third rows use the same input data, input features, and parameters, but different anomaly detection algorithms, which can also correspond to different anomaly detection mechanisms. The fourth and fifth rows use the same anomaly detection algorithm, input features, and parameters, but the data input method is different; that is, the input dataset is split into two subsets, X and P1.s1 and X s2 This can also correspond to different anomaly detection mechanisms. Between lines six and seven, the same anomaly detection algorithm, input data, and parameters are used, but the feature input method differs; that is, the input feature vector is split into two subsets, F... s1 and F s2 It can also correspond to different anomaly detection mechanisms, and so on.

[0101] The above seven different anomaly detection mechanisms, respectively scoring the detected objects Q, E, D, and F, can yield the following results: Figure 3 The matrix represents the various detection values ​​(of course, in practical applications, the number of anomaly detection mechanisms and the number of nearest neighbor objects may be much greater). Figure 3 This only illustrates some of the anomaly detection mechanisms and their nearest neighbor objects (using distance descriptions). Each row in the matrix represents the detection value calculated by one anomaly detection mechanism for each detected object; each column represents the detection values ​​calculated by multiple different anomaly detection mechanisms for the same detected object. Therefore, the detection values ​​in the matrix reflect both the anomaly detection mechanism factor and the detected object factor. Determining the data to be fused for the current detected object Q from both dimensions simultaneously improves efficiency and reduces computational load compared to considering only the anomaly detection mechanism factor.

[0102] In other words, if the existing technology is used, for the detection object Q, the data to be fused can only be selected from the first column of the matrix. Specifically, all or part of the detection values ​​in the first column can be selected as the data to be fused for the detection object Q. For example, as Figure 3 The various selection methods shown in column 31 are all existing methods for selecting data to be fused. However, using the scheme in this application embodiment, in addition to the first column, data to be fused can also be selected from other columns. In this way, in order to construct a certain amount of data to be fused, it is not only necessary to construct more anomaly detection mechanisms, but also to select specific data to be fused for the current detection object from multiple detection values ​​corresponding to the nearest neighbor objects of the current detection object.

[0103] Specifically, when determining the data to be fused for the current detection object based on multiple detection values ​​corresponding to the current detection object and its nearest neighbors, there can be several methods. For example, in one method, one can directly... Figure 3The rectangle 32 shown contains all the detection values ​​corresponding to the current detection object and all the detection values ​​corresponding to its nearest neighbors, which are determined as the data to be fused for the current detection object. That is, assuming there are m anomaly detection mechanisms and r nearest neighbors, m×(r+1) data points to be fused can be determined for the current detection object. It should be noted that in practical applications, there may be a detection object with zero nearest neighbors, i.e., r=0. For such a detection object, the detection values ​​of that object itself are directly used to construct the data to be fused.

[0104] Alternatively, in another approach, some detection values ​​can be selected from the multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its neighboring objects, and the selected partial detection values ​​can be determined as multiple data to be fused for the current detection object.

[0105] There are several specific selection methods. For example, in one approach, a subset of anomaly detection mechanisms can be selected from the various anomaly detection mechanisms. Based on the multiple detection values ​​generated by these mechanisms for the current detection object and its nearest neighbors, multiple sets of data to be fused are determined for the current detection object. In other words, since the selection of data to be fused can be based on both anomaly detection mechanisms and nearest neighbors, some anomaly detection mechanisms can be filtered out, and only the detection values ​​generated by another subset of mechanisms for the current detection object and its nearest neighbors can be selected as the data to be fused for the current detection object. Of course, in practice, the specific selection of anomaly detection mechanisms can differ for different detection objects. For example, specifically... Figure 3 As shown at point 33, for the current detection object Q, the data in the second row can be selected as the data to be fused, and so on. Of course, when specifically selecting data to be fused from the detection values ​​provided by some anomaly detection mechanisms, all or a portion can be selected. Furthermore, this... Figure 3 This is just an example of this selection method. In practical applications, a variety of anomaly detection mechanisms can be selected in order to obtain a sufficient amount of data to be fused.

[0106] Alternatively, a subset of neighboring objects can be selected from the at least one neighboring object, and multiple data points to be fused can be determined for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the subset of neighboring objects. In other words, a subset of neighboring objects can be selected from the set of neighboring objects, and then the data points to be fused for the current detection object can be determined solely based on the current detection object and the multiple detection values ​​corresponding to these neighboring objects.

[0107] There are several ways to select nearest neighbors. For example, you can select the nearest neighbor that is closest to the currently detected object. Alternatively, you can determine the center of the nearest neighbor from the at least one nearest neighbor (specifically, you can calculate the center of these nearest neighbors based on their feature vectors; for example, if the sum of the distances from an object to other objects in a set is the smallest, then that object can become the center of that set). In this way, multiple data to be fused can be determined for the current detected object based on the current detected object and the multiple detection values ​​corresponding to the centers of the nearest neighbors, and so on.

[0108] Of course, when determining the data to be fused for the current detection object based on multiple detection values ​​corresponding to the current detection object and some neighboring objects, one can select all or only a portion of the multiple detection values ​​corresponding to the current detection object and some neighboring objects. For example, Figure 3 As shown at point 34, an example of selecting only a portion is given.

[0109] In summary, in practical implementation, there are various ways to determine multiple data points to be fused for the current detection object from multiple detection values ​​corresponding to the current detection object and its nearest neighbors. For example, for Figure 3 In the example shown, when selecting data to be fused for the detection object Q, as long as it includes some or all of the detection values ​​in the first column, and is not selected only from the detection values ​​in the first column, it falls within the protection scope of the embodiments of this application, and will not be listed one by one here.

[0110] After determining the data to be fused for the current detection object, the specific fusion process can begin. Specifically, there are various ways to fuse multiple data sets, such as traditional data fusion methods including summation, finding the maximum value, and finding the average value. In this embodiment, the above methods can also be used for data fusion processing to obtain the anomaly detection result for the current detection object.

[0111] However, the inventors of this application also discovered during the development of this application that the aforementioned traditional data fusion method only considers numerical factors; that is, only the numerical value of the data to be fused participates in the fusion calculation. For ease of understanding, the relationship between the data to be fused and the numerical value is briefly introduced here. The data to be fused is the data itself selected directly from multiple detection values ​​corresponding to the current detection object and its nearest neighbors. For example, if the number of anomaly detection mechanisms is m, the number of nearest neighbors is r, and all detection values ​​are selected, the number of data to be fused is m×(r+1). That is, a total of m×(r+1) data items participate in the subsequent fusion processing. The numerical value refers to the specific size of the number corresponding to the data to be fused, which is calculated by the anomaly detection mechanism.

[0112] In other words, the amount of data to be merged is large, and the same value may appear multiple times, while different values ​​may appear different times, and so on. For example, Figure 3 In the example shown, there are 28 data points to be fused, with specific values ​​including: 10, 11, 12, 10, 12... 10 appears 5 times, 11 appears 4 times, 12 appears 3 times, and so on. This frequency of occurrence is statistical information about the data to be fused, and in practical applications, this statistical information is very important and can significantly affect the accuracy of the final calculation results.

[0113] Therefore, in a preferred embodiment of this application, when fusing multiple data points of the current detection object, the fusion process can also be performed based on numerical and distribution factors. In other words, the data fusion method considers not only the numerical factors of the data to be fused but also their distribution factors, which allows for improved accuracy even when most of the data to be fused is unreliable.

[0114] There are various data fusion methods that combine numerical and distributional factors. For example, one approach involves using principal component analysis (PCA) algorithms to reconstruct the multiple datasets to be fused, allowing the data representing the primary factors to be fused. In other words, after identifying multiple datasets to be fused for the current detection object, some data may be primary while others are less important. Including these less important data in the final fusion process could negatively impact the accuracy of the calculation results. Therefore, filtering out these less important data using PCA is equivalent to denoising the dataset, which can improve accuracy. After denoising, the values ​​of the remaining datasets are summed, averaged, or maximized to ensure that the specific values ​​participate in the final calculation. Furthermore, the distributional factors of the specific values ​​within the datasets are naturally considered during PCA, thus also influencing the fusion calculation.

[0115] Alternatively, another approach is to first determine the frequency of occurrence of multiple values ​​in the multiple data sets to be fused, and then determine the weights of these values ​​based on their frequency. This allows for fusion processing based on the values ​​and their corresponding weights. Specifically, the more frequently a value appears, the higher its weight should be, reflecting its importance in the fusion process. In practice, there are various ways to calculate the weights. For example, one can first determine the frequency of each value, then divide the frequency of a specific value by the total frequency of all values ​​(i.e., the total number of data sets to be fused) to obtain the weight of that value. Then, fusion processing is performed based on the specific values ​​and their weights. This includes methods such as summation, finding the maximum, and averaging. Of course, if the weights of each value are determined using the above method when fusion is performed by summation, the result may be the same as direct summation. Therefore, in practice, if summation is required for fusion calculation, other methods for calculating weights can be used. For example, first calculate the square of the number of times each value appears, and then calculate the square of the total number of times all values ​​appear. Thus, for a specific value, the square of the number of times that value appears can be divided by the square of the total number of times it appears, and the result can be used as the weight of that value. Then, a summation operation is performed based on the weights corresponding to each value, and so on.

[0116] In another approach, to combine numerical and distributional factors, multiple data points of the current detection object can first be fused based on numerical factors to obtain a first fusion result, and then fused based on distributional factors to obtain a second fusion result. Then, the first and second fusion results are combined to obtain the anomaly detection result for the current detection object. For example, the first fusion result can be obtained by summing or averaging based on numerical factors. Alternatively, the second fusion result can be obtained by calculating the Shannon entropy of each data point to be fused. Specifically, the Shannon entropy method can involve first determining the frequency of each value in the data to be fused, and then summing the frequencies of these values. For example... Figure 3 In the example shown, 10 appears 5 times, 11 appears 4 times, 12 appears 3 times, and so on. This yields multiple <value, frequency> pairs, including <10, 5>, <11, 4>, <12, 3>, etc. A curve can then be plotted on the value-frequency plane, with the horizontal axis representing the numerical value and the vertical axis representing the frequency of occurrence. If a certain value has a high value on the vertical axis, it indicates that the values ​​in the data to be fused are concentrated around that number; if the curve is relatively flat, it indicates that the values ​​are relatively dispersed, and so on. This approach primarily focuses on whether the values ​​are concentrated or dispersed, without considering which values ​​they are concentrated in or which values ​​they are dispersed in. In other words, each specific numerical value does not contribute to the final fusion result. Therefore, this is a fusion process based solely on distribution factors.

[0117] After performing fusion processing based solely on numerical or distribution factors, further fusion of the two results allows for simultaneous fusion processing based on both numerical and distribution factors. Specifically, further fusion processing of the first and second results can be achieved through various methods such as summation, averaging, and maximization.

[0118] Of course, there may be inconsistencies in scale between the first and second fusion results. For example, the first fusion result may generally be larger, while the second fusion result may generally use smaller values. Therefore, in practical applications, before further fusing the first and second fusion results, it is advisable to first unify their scales.

[0119] The above provides a detailed description of the specific anomaly detection method provided in the embodiments of this application. By incorporating the nearest neighbor factor, the construction of the data to be fused can be performed by selecting between two dimensions: anomaly detection mechanism factors and nearest neighbor factors. This allows for the construction of more data to be fused with fewer anomaly detection mechanisms. Therefore, it reduces computational load and saves computational resources.

[0120] It should be noted that in practical applications, there are many specific scenarios for anomaly detection. In addition to anti-fraud detection in the commodity object information service system mentioned above, it can also be applied in multiple scenarios such as intrusion detection, fraud detection, fault detection, and system health monitoring, which will not be listed here.

[0121] Example 2

[0122] In the aforementioned Embodiment 1, an anomaly detection method was primarily provided from the perspective of the construction method of the data to be fused, that is, the construction of the data to be fused was performed simultaneously based on both the anomaly detection mechanism and the nearest neighbor factor. Furthermore, based on this, the specific data fusion method was improved, that is, the numerical and distribution factors of the data to be fused were considered simultaneously during the fusion process. In practical applications, if a common method for constructing the data to be fused is used, for example, constructing only the anomaly detection mechanism factor, the improved data fusion method described above can also be used for fusion processing. Therefore, in this Embodiment 2, an anomaly detection method is also provided from the perspective of the specific fusion processing method, see [link to Embodiment 1]. Figure 4 The method may include:

[0123] S401: Determine the dataset to be detected, wherein the dataset includes multiple objects to be detected;

[0124] S402: Utilize multiple anomaly detection mechanisms to perform anomaly detection on each detection object and generate multiple detection values;

[0125] S403: Based on the multiple detection values, determine multiple data to be fused for each detection object;

[0126] S404: Based on numerical and distribution factors, multiple data to be fused for each detection object are fused to obtain the anomaly detection result for each detection object.

[0127] For the parts of this embodiment that are not described in detail, please refer to the description in embodiment one and other parts of this application specification, which will not be repeated here.

[0128] It should be noted that the embodiments of this application may involve the use of user data. In practical applications, user-specific personal data may be used in the scheme described herein within the scope permitted by applicable laws and regulations, provided that it complies with the applicable laws and regulations of the country (e.g., with the user's explicit consent, with the user being properly notified, etc.).

[0129] Corresponding to Embodiment 1, this application also provides an anomaly detection device, see [link to embodiment 1]. Figure 5 The device may include:

[0130] Data set determination unit 501 is used to determine the dataset to be detected, wherein the dataset includes multiple detection objects;

[0131] The detection value generation unit 502 is used to perform anomaly detection on each detection object using multiple anomaly detection mechanisms and generate multiple detection values.

[0132] The fusion unit 503 is used to determine multiple data to be fused for each detection object and perform fusion processing. For one current detection object, the fusion unit 503 includes:

[0133] The data to be fused determination subunit 5031 is used to determine at least one nearest neighbor object of the current detection object from the dataset, and to determine multiple data to be fused of the current detection object based on multiple detection values ​​corresponding to the current detection object and multiple detection values ​​corresponding to its nearest neighbor objects; the nearest neighbor object is a detection object whose feature similarity with the current detection object meets the target condition;

[0134] The fusion processing subunit 5032 is used to determine the abnormal detection result of the current detection object by fusing multiple data to be fused for the current detection object.

[0135] In a specific implementation, the device may further include:

[0136] The first preprocessing unit is used to perform scale unification processing on the detection values ​​generated by different anomaly detection mechanisms before determining multiple data to be fused for each detection object.

[0137] Specifically, the data to be fused determination subunit can be used for:

[0138] The multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its nearest neighbor objects are determined as the data to be fused for the current detection object.

[0139] Alternatively, the data to be fused determination subunit can be specifically used for:

[0140] Select a subset of detection values ​​from the multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its neighboring objects, and determine the selected subset of detection values ​​as multiple data to be fused for the current detection object.

[0141] Specifically, the data to be fused determination subunit can be used for:

[0142] Select some anomaly detection mechanisms from the multiple anomaly detection mechanisms, and determine multiple data to be fused for the current detection object and its neighboring objects based on the multiple detection values ​​generated by the partial anomaly detection mechanisms.

[0143] Alternatively, the data to be fused determination subunit can be specifically used for:

[0144] Select a subset of neighboring objects from the at least one neighboring object, and determine multiple data to be fused for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the subset of neighboring objects.

[0145] Specifically, the data to be fused determination subunit can be used for:

[0146] The nearest object center is determined from the at least one nearest object, so that multiple data to be fused are determined for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the nearest object center.

[0147] Specifically, the fusion processing subunit can be used for:

[0148] Based on numerical and distributional factors, multiple data points to be fused for the current detection object are fused.

[0149] Specifically, the fusion processing subunit can be used for:

[0150] The principal component analysis algorithm is used to reconstruct the multiple data to be fused, so that the data that belong to the main factors can be fused.

[0151] Alternatively, the fusion processing subunit can be specifically used for:

[0152] The occurrence frequency of multiple values ​​in the multiple data to be fused is determined, and the weights of the multiple values ​​are determined based on the occurrence frequency, so that fusion processing can be performed based on the multiple values ​​and their corresponding weights.

[0153] Alternatively, the fusion processing subunit can be specifically used for:

[0154] Based on numerical factors, multiple data to be fused for the current detection object are fused to obtain a first fusion result;

[0155] Based on distribution factors, multiple data to be fused for the current detection object are fused to obtain a second fusion result;

[0156] The first fusion result and the second fusion result are fused together to obtain the abnormal detection result of the current detection object.

[0157] At this point, the device may also include:

[0158] The second preprocessing unit is used to perform scale unification processing on the first fusion result and the second fusion result before fusing them.

[0159] In a specific implementation, each detection object in the dataset corresponds to feature information in multiple dimensions; the similarity between different detection objects can be determined based on the distance between the feature vectors of the detection objects.

[0160] Specifically, the dataset determination unit can be used for:

[0161] When an anomaly detection request is received from the system under test, the dataset submitted by the system under test is obtained.

[0162] In practical applications, the system under test includes a commodity object information service system, and the dataset includes multiple access records corresponding to the target delivery information, with each access record being a detection object.

[0163] Corresponding to Embodiment 2, this application also provides an anomaly detection device, see [link to embodiment]. Figure 6 The device may also include:

[0164] Data set determination unit 601 is used to determine the dataset to be detected, wherein the dataset includes multiple detection objects;

[0165] The detection value generation unit 602 is used to perform anomaly detection on each detection object using multiple anomaly detection mechanisms and generate multiple detection values.

[0166] The data to be fused determination unit 603 is used to determine multiple data to be fused for each detection object based on the multiple detection values;

[0167] The fusion processing unit 604 is used to perform fusion processing on multiple data to be fused for each detection object based on numerical factors and distribution factors, so as to obtain the abnormal detection result of each detection object.

[0168] In addition, embodiments of this application also provide a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the method described in any of the foregoing method embodiments.

[0169] And an electronic device, comprising:

[0170] One or more processors; and

[0171] A memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method described in any of the foregoing method embodiments.

[0172] in, Figure 7 An exemplary architecture of an electronic device is shown, which may include a processor 710, a video display adapter 711, a disk drive 712, an input / output interface 713, a network interface 714, and a memory 720. The processor 710, video display adapter 711, disk drive 712, input / output interface 713, network interface 714, and memory 720 can communicate with each other via a communication bus 730.

[0173] The processor 710 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to achieve the technical solution provided in this application.

[0174] The memory 720 can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 720 can store the operating system 721 for controlling the operation of the electronic device 700, and the basic input / output system (BIOS) for controlling the low-level operations of the electronic device 700. Additionally, it can store a web browser 723, a data storage management system 724, and an anomaly detection and handling system 725, etc. The aforementioned anomaly detection and handling system 725 can be the application program that specifically implements the aforementioned steps in this embodiment. In summary, when the technical solution provided in this application is implemented through software or firmware, the relevant program code is stored in the memory 720 and is called and executed by the processor 710.

[0175] Input / output interface 713 is used to connect input / output modules to realize information input and output. Input / output modules can be configured as components in the device (not shown in the figure) or externally connected to the device to provide corresponding functions. Input devices may include keyboards, mice, touch screens, microphones, various sensors, etc., and output devices may include displays, speakers, vibrators, indicator lights, etc.

[0176] Network interface 714 is used to connect a communication module (not shown in the figure) to enable communication between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0177] Bus 730 includes a pathway for transmitting information between various components of the device, such as processor 710, video display adapter 711, disk drive 712, input / output interface 713, network interface 714, and memory 720.

[0178] It should be noted that although the above-described device only shows the processor 710, video display adapter 711, disk drive 712, input / output interface 713, network interface 714, memory 720, bus 730, etc., in specific implementations, the device may also include other components necessary for normal operation. Furthermore, those skilled in the art will understand that the above-described device may only include the components necessary for implementing the solution of this application, and does not necessarily include all the components shown in the figures.

[0179] As can be seen from the above description of the embodiments, those skilled in the art can clearly understand that this application can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in various embodiments or some parts of the embodiments of this application.

[0180] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, for system or system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and relevant parts can be referred to the descriptions in the method embodiments. The systems and system embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0181] The anomaly detection method and electronic device provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and its core ideas. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An anomaly detection method, characterized in that, include: Based on the detection requirements of the product object information service system under test, a dataset to be detected that needs to be anomaly detected is determined from the product object information service system under test. The dataset includes multiple detection objects. The detection requirements include detecting whether there is cheating during the process of clicking on the target information. The dataset to be detected includes multiple click records for the target information, and each click record corresponds to a detection object. Multiple anomaly detection mechanisms are used to perform anomaly detection on each detection object, so as to generate multiple detection values ​​for each detection object; For each detection object, multiple data sets to be fused are determined and fused. Specifically, for one of the current detection objects, the following steps are performed: From the dataset, at least one nearest neighbor object of the current detected object is determined, and multiple data to be fused for the current detected object are determined based on multiple detection values ​​corresponding to the current detected object and multiple detection values ​​corresponding to its nearest neighbor objects; the nearest neighbor object is a detected object whose feature similarity with the current detected object meets the target condition. Based on numerical and distributional factors, multiple data sets of the current detection object are fused to determine the abnormal detection results of the current detection object. This allows the product information service system to determine whether there is any cheating involved in the click records corresponding to the current detection object based on the abnormal detection results.

2. The method according to claim 1, characterized in that, The determination of multiple data points to be fused for the current detection object includes: The multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its nearest neighbor objects are determined as the data to be fused for the current detection object.

3. The method according to claim 1, characterized in that, The determination of multiple data points to be fused for the current detection object includes: Select a subset of detection values ​​from the multiple detection values ​​corresponding to the current detection object and the multiple detection values ​​corresponding to its neighboring objects, and determine the selected subset of detection values ​​as multiple data to be fused for the current detection object.

4. The method according to claim 3, characterized in that, The selected partial detection values ​​include: Select some anomaly detection mechanisms from the multiple anomaly detection mechanisms, and determine multiple data to be fused for the current detection object and its neighboring objects based on the multiple detection values ​​generated by the partial anomaly detection mechanisms.

5. The method according to claim 3, characterized in that, The selected partial detection values ​​include: Select a subset of neighboring objects from the at least one neighboring object, and determine multiple data to be fused for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the subset of neighboring objects.

6. The method according to claim 5, characterized in that, The step of selecting a subset of nearest neighbors from the at least one nearest neighbor includes: The nearest object center is determined from the at least one nearest object, so that multiple data to be fused are determined for the current detection object based on the current detection object and the multiple detection values ​​corresponding to the nearest object center.

7. The method according to any one of claims 1 to 6, characterized in that, The process of fusing multiple data sets of the current detection object to determine the abnormal detection result of the current detection object includes: The abnormal detection result of the current detection object is determined by performing fusion processing on the multiple data to be fused by summing, averaging, or taking the maximum value.

8. The method according to claim 1, characterized in that, The process of fusing multiple data points of the current detection object based on numerical and distribution factors includes: The occurrence frequency of multiple values ​​in the multiple data to be fused is determined, and the weights of the multiple values ​​are determined based on the occurrence frequency, so that fusion processing can be performed based on the multiple values ​​and their corresponding weights.

9. The method according to claim 1, characterized in that, The process of fusing multiple data points of the current detection object based on numerical and distribution factors includes: Based on numerical factors, multiple data to be fused for the current detection object are fused to obtain a first fusion result; Based on distribution factors, multiple data to be fused for the current detection object are fused to obtain a second fusion result; The first fusion result and the second fusion result are fused together to obtain the abnormal detection result of the current detection object.

10. The method according to any one of claims 1 to 6, characterized in that, In the dataset to be detected, each detection object corresponds to feature information in multiple dimensions; The similarity between different detected objects is determined based on the distance between the feature vectors of the detected objects.

11. An anomaly detection method, characterized in that, include: Based on the detection requirements of the product object information service system under test, a dataset to be detected that needs to be anomaly detected is determined from the product object information service system under test. The dataset includes multiple detection objects. The detection requirements include detecting whether there is cheating during the process of clicking on the target information. The dataset to be detected includes multiple click records for the target information, and each click record corresponds to a detection object. Multiple anomaly detection mechanisms are used to perform anomaly detection on each detection object, so as to generate multiple detection values ​​for each detection object; Based on the multiple detection values, multiple data to be fused are determined for each detection object; Based on numerical and distributional factors, multiple data sets to be fused for each detection object are fused to obtain anomaly detection results for each detection object. This allows the product information service system to determine whether there is any cheating involved in the click records corresponding to each detection object based on the anomaly detection results.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the program performs the steps of the method described in any one of claims 1 to 11.

13. An electronic device, characterized in that, include: One or more processors; as well as A memory associated with the one or more processors, the memory being used to store program instructions that, when read and executed by the one or more processors, perform the steps of the method according to any one of claims 1 to 11.

Images