Abnormality detection method, device and storage medium

Abstract

The present application relates to an anomaly detection method, device and storage medium, the method is applied to a cloud server, the method includes: when receiving user information sent by a terminal device, judging whether the user information has an anomaly based on a preset sample set; when the user information has an anomaly, determining the target health reminder corresponding to the user information based on the sample set; sending the target health reminder and the anomaly cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user based on the target health reminder and the anomaly cause. The embodiment of the present application is applied to the field of terminal artificial intelligence. Through end-cloud collaborative decision-making, the cloud server can perform anomaly detection on the user information sent by the terminal device, which can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the health reminders and anomaly causes sent to the terminal device.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence, and in particular to an anomaly detection method, device, and storage medium. Background Art

[0002] With the rapid development of smart hardware, smart wearable devices have become ubiquitous in all aspects of people's lives, especially in the field of sports and health, where more and more people are choosing to wear smart watches or smart bracelets. Smart wearable devices are equipped with various types of sensors, such as ambient light sensors, optical heart rate sensors, and air pressure sensors, which can help users record their daily life status around the clock and obtain a massive amount of health and environmental data. Users are most concerned about the health insights brought by this data. Therefore, smart wearable devices generally include basic health reminder functions, such as sedentary reminders, water drinking reminders, heart rate reminders, etc.

[0003] However, most current health reminders are based on manually setting thresholds or threshold ranges, and issuing reminders when established indicators exceed the thresholds. This has the disadvantages of requiring a lot of expert knowledge and time, and having a relatively single reminder dimension. Summary of the Invention

[0004] In view of this, an anomaly detection method, device and storage medium are proposed.

[0005] In a first aspect, an embodiment of the present application provides an anomaly detection method, which is applied to a cloud server, and the method includes: when receiving user information sent by a terminal device, judging whether the user information has an abnormality based on a preset sample set, the user information includes the user's basic information and the health data and environmental data of the user collected by the terminal device, and the sample set includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders; when there is an abnormality in the user information, determining the target health reminder corresponding to the user information based on the sample set; sending the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user based on the target health reminder and the abnormal cause.

[0006] According to an embodiment of the present application, the sample set used for anomaly detection includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders. When the cloud server receives user information sent by the terminal device, it can determine whether the user information is abnormal based on the sample set. When the user information is abnormal, it determines the target health reminder corresponding to the user information, and sends the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause. In this way, when the cloud server receives the user information, it can first determine whether the user information is abnormal, and when the user information is abnormal, it can determine the target health reminder and the abnormal cause corresponding to the target health reminder. This can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the target health reminder and the abnormal cause.

[0007] According to the first aspect, in a first possible implementation of the anomaly detection method, the method further includes: performing anomaly exploration on a preset first training set based on multiple preset health reminders and associated features of each health reminder, determining multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories, and abnormal causes corresponding to each abnormal category, wherein the first training set includes multiple unlabeled first initial samples; performing anomaly detection on the second training set based on the multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder, and establishing a sample set, wherein the second training set includes multiple initial abnormal samples corresponding to each health reminder and multiple unlabeled second initial samples.

[0008] In this embodiment, the cloud server can perform anomaly exploration on a preset first training set (including multiple unlabeled first initial samples) based on multiple preset health reminders and the associated features of each health reminder, determine multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories and abnormal causes corresponding to each abnormal category, and perform anomaly detection on the second training set based on the multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder to establish a sample set. Then, based on the sample set, anomaly detection is performed on the user information received from the terminal device. Therefore, through anomaly exploration, a small number of credible abnormal samples, multiple abnormal categories and explainable abnormal causes corresponding to each abnormal category can be automatically identified from the first training set, saving manual labeling time, and making full use of the identified abnormal samples and multiple abnormal categories. At the same time, considering high-dimensional features, a sample set is established through vector representation and deep clustering, which can improve the accuracy of the vector representation of each normal sample and each abnormal sample in the sample set, as well as the diversity of abnormal samples, thereby performing higher-dimensional and more accurate anomaly detection, providing users with more intelligent health reminders.

[0009] According to a first possible implementation manner of the first aspect, in a second possible implementation manner of the abnormality detection method, the abnormality exploration is performed on the preset first training set based on the preset multiple health reminders and the associated features of each health reminder, and multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories and abnormal causes corresponding to each abnormal category are determined, including: for any health reminder, an abnormality decision tree is established based on the associated features of the health reminder and the preset first training set; based on the abnormality decision tree, multiple abnormal categories corresponding to the health reminder, as well as the initial abnormal samples and abnormal causes corresponding to each abnormal category are determined.

[0010] In this embodiment, by establishing an abnormal decision tree for each health reminder, and determining a small number of credible abnormal categories corresponding to each health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category based on each abnormal decision tree, the accuracy of the abnormal categories and initial abnormal samples corresponding to each health reminder and the interpretability of the abnormal causes can be improved.

[0011] According to a second possible implementation manner of the first aspect, in a third possible implementation manner of the anomaly detection method, establishing an abnormal decision tree based on the associated features of the health reminder and a preset first training set includes: establishing a feature space based on the associated features of the health reminder and the preset first training set; adding multiple virtual samples evenly to the feature space based on the number of first initial samples in the first training set; determining multiple division methods of the subspace of the feature space based on the density of the first initial samples in different areas of the feature space; for any division method, under the division method, determining the information gain of each associated feature based on the number of first initial samples and the number of virtual samples in each subspace of the feature space, and determining the information gain of the division method based on the information gain of each associated feature; determining the division method with the largest information gain among the multiple division methods as the target division method; dividing the feature space into multiple subspaces based on the target division method; using each associated feature as a decision condition, and establishing an abnormal decision tree based on the information gain of each associated feature under the target division method and the number of first initial samples in each subspace, wherein each leaf node of the abnormal decision tree corresponds to a subspace in the feature space.

[0012] In this embodiment, for any health reminder, a feature space is established, and virtual samples are evenly added to the feature space. Then, multiple division methods of the subspace of the feature space and the information gain of various division methods are determined, and the division method with the largest information gain is determined as the target division method. Then, according to the target division method, the feature space is divided into multiple subspaces, and each associated feature is used as a decision condition. According to the information gain of each associated feature under the target division method, an abnormal decision tree is established. Therefore, after the feature space is divided into multiple subspaces, the abnormal decision tree can be established according to the information gain of each associated feature (that is, the importance of the associated feature). This not only improves the accuracy of the abnormal decision tree, but also converts the problem of finding credible and explainable abnormal samples and abnormal categories into a binary problem of whether there are real samples (that is, the first initial samples) in the subspace of the feature space, simplifies the processing process, improves processing efficiency, and then realizes automatic classification and labeling of the first initial sample to solve the problem of no labeling of the first initial sample.

[0013] According to a third possible implementation manner of the first aspect, in a fourth possible implementation manner of the abnormality detection method, the determining, based on the abnormal decision tree, multiple abnormal categories corresponding to the health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category, includes: selecting at least one target leaf node from multiple leaf nodes of the abnormal decision tree according to the number of first initial samples in each subspace, wherein there is at least one first initial sample in the subspace corresponding to the target leaf node; judging whether the sample category represented by each target leaf node is an abnormal category according to the abnormal condition, the abnormal condition is determined according to at least one of the number of first initial samples in the subspace corresponding to the target leaf node, the hierarchy of the target leaf node, and the decision path from the root node to the target leaf node; when the sample category represented by the target leaf node is an abnormal category, determining the first initial sample in the subspace corresponding to the target leaf node as the initial abnormal sample corresponding to the abnormal category; and determining the decision condition on the decision path from the root node of the abnormal decision tree to the target leaf node as the abnormal cause corresponding to the abnormal category.

[0014] In this embodiment, a target leaf node including at least one first initial sample is selected from multiple leaf nodes in the abnormal decision tree, and based on the abnormal conditions, it is determined whether the sample category represented by each target leaf node is an abnormal category, thereby determining multiple abnormal categories and initial abnormal samples corresponding to each abnormal category, and determining the abnormal cause corresponding to each abnormal category through the decision path in the abnormal decision tree. This is simple and fast, which can not only improve the processing efficiency, but also improve the explainability of the abnormal cause.

[0015] According to the first possible implementation manner of the first aspect, in a fifth possible implementation manner of the anomaly detection method, anomaly detection is performed on the second training set based on multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder, and a sample set is established, including: for any health reminder, initializing the vector representation of each initial abnormal sample and each second initial sample in the second training set through a vector representation network to obtain the 0th vector representation of each initial abnormal sample and each second initial sample; performing N iterative updates on the 0th vector representation of each initial abnormal sample and each second initial sample according to multiple abnormal categories to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, where N is a positive integer and N≥1; clustering the second training set based on the Nth vector representation of each initial abnormal sample and each second initial sample to obtain the vector representation of the normal samples and abnormal samples corresponding to the health reminder; and establishing a sample set based on the vector representation of the normal samples and abnormal samples corresponding to each health reminder.

[0016] In this embodiment, for any health reminder, after determining the 0th vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network, the vector representation can be iteratively updated N times to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, and the second training set is clustered according to the Nth vector representation of each initial abnormal sample and each second initial sample to obtain the vector representation of the normal samples and abnormal samples corresponding to the health reminder. According to the vector representation of the normal samples and abnormal samples corresponding to each health reminder, a sample set is established, so that the limited initial abnormal samples and multiple abnormal categories corresponding to each health reminder can be utilized, and through iterative updates, the learning of normal samples and abnormal samples in the unknown multiple second initial samples can be accelerated, and then a sample set is established. This not only increases the diversity of abnormal samples, helps to discover more inconspicuous abnormalities, and improves the accuracy of the sample set, but also improves the accuracy of the vector representation of normal samples and abnormal samples.

[0017] According to a fifth possible implementation of the first aspect, in a sixth possible implementation of the anomaly detection method, the 0th vector representation of each initial abnormal sample and each second initial sample is iteratively updated N times according to multiple abnormal categories to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, including: for the i-th iteration, according to the number of multiple abnormal categories and the i-1th vector representation of each initial abnormal sample, the multiple initial abnormal samples are clustered to obtain the i-th cluster center of each abnormal category, where i is a positive integer and 1≤i≤N; according to the i-1th vector representation of each second initial sample, respectively determine Determine an i-th sampling probability of each second initial sample; determine a plurality of positive samples and a plurality of negative samples at an i-th iteration from the plurality of second initial samples based on the i-th sampling probability of each second initial sample; determine an i-th vector representation loss based on the i-th cluster center of each abnormal category and the plurality of positive samples and the plurality of negative samples at the i-th iteration; adjust the i-1-th vector representation of each initial abnormal sample and each second initial sample based on the i-th vector representation loss to obtain an i-th vector representation of each initial abnormal sample and each second initial sample; and obtain an N-th vector representation of each initial abnormal sample and each second initial sample when i=N.

[0018] In this embodiment, the vector representation is adjusted through paired learning of positive and negative samples, which can not only improve the learning speed but also improve the accuracy of the vector representation.

[0019] According to the sixth possible implementation of the first aspect, in a seventh possible implementation of the anomaly detection method, determining the i-th sampling probability of each second initial sample based on the i-1-th vector representation of each second initial sample includes: determining the i-th anomaly confidence level of each second initial sample based on the i-1-th vector representation of each second initial sample; and determining the i-th sampling probability of each second initial sample based on the i-th anomaly confidence level of each second initial sample. In this manner, the accuracy of the i-th sampling probability of each second initial sample can be improved.

[0020] According to the first aspect, in an eighth possible implementation of the anomaly detection method, judging whether the user information has an anomaly based on a preset sample set includes: determining a first vector, a second vector, and a third vector based on the user information and the sample set, respectively, the first vector being a vector representation of the user information, the second vector being an average vector representation of all normal samples in the sample set, and the third vector being an average vector representation of all abnormal samples in the sample set; respectively determining a first similarity between the first vector and the second vector, and a second similarity between the first vector and the third vector; and determining that the user information has an anomaly when the first similarity is less than the second similarity.

[0021] In this embodiment, by respectively determining the average vector representation of all normal samples in the sample set, the average vector representation of all abnormal samples, and the vector representation of user information, and based on the similarity of the vectors, it is determined whether the user information is abnormal. This is simple and fast, can reduce the amount of calculation, and improve processing efficiency.

[0022] According to the eighth possible implementation manner of the first aspect, in the ninth possible implementation manner of the anomaly detection method, determining the target health reminder corresponding to the user information based on the sample set includes: for any health reminder, determining the third similarity between the first vector and the fourth vector, and the fourth similarity between the first vector and the fifth vector, respectively, the fourth vector being the average vector representation of the normal samples corresponding to the health reminder in the sample set, and the fifth vector being the average vector representation of the abnormal samples corresponding to the health reminder in the sample set; when the third similarity is less than the fourth similarity, determining the health reminder as the target health reminder corresponding to the user information.

[0023] In this embodiment, for any health reminder, the average vector representation of the normal samples corresponding to the health reminder is determined as the fourth vector, the average vector representation of the abnormal samples corresponding to the health reminder is determined as the fifth vector, and the third similarity between the first vector and the fourth vector and the fourth similarity between the first vector and the fifth vector are determined respectively. Then, when the third similarity is less than the fourth similarity, the health reminder is determined as the target health reminder corresponding to the user information. In this way, the target health reminder corresponding to the user information can be determined quickly and accurately through similarity calculation and comparison, which can improve the accuracy of the target health reminder.

[0024] According to the first aspect, in the tenth possible implementation of the abnormality detection method, the sending of the target health reminder and the abnormality reason corresponding to the target health reminder to the terminal device includes: when the number of abnormalities in the user information within a preset time period is greater than or equal to a preset abnormality number threshold, the target health reminder and the abnormality reason corresponding to the target health reminder are sent to the terminal device.

[0025] In this way, health reminders caused by occasional abnormal user information can be reduced, the misjudgment rate can be reduced, and the accuracy of health reminders can be improved.

[0026] According to the first aspect or one or more of the multiple possible implementations of the first aspect, in the eleventh possible implementation of the abnormality detection method, the terminal device includes a smart wearable device, and the multiple health reminders include multiple of fatigue reminders, sleep reminders, stress reminders, and hunger reminders.

[0027] In the second aspect, an embodiment of the present application provides an anomaly detection method, which is applied to a terminal device, and the method includes: obtaining user information and sending the user information to a cloud server, so that the cloud server determines a target health reminder and an abnormal cause corresponding to the target health reminder based on a preset sample set and the user information, the user information including the user's basic information and the health data and environmental data of the user collected by the terminal device; receiving the target health reminder and the abnormal cause corresponding to the target health reminder sent by the Sohu cloud server, and reminding the user based on the target health reminder and the abnormal cause.

[0028] According to an embodiment of the present application, the terminal device can obtain user information including user basic information, environmental data and health data, and send the user to the cloud server for abnormality detection. When the cloud server detects an abnormality, it can send a target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device. After the terminal device receives the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, it can remind the user according to the target health reminder and the abnormal reason, so that the user can be given a health reminder through end-cloud collaborative decision-making, which can not only improve processing efficiency, but also improve the accuracy of health reminders and abnormal reasons.

[0029] According to the second aspect, in a first possible implementation of the anomaly detection method, obtaining user information and sending the user information to the cloud server includes: obtaining user information, desensitizing the user information to obtain desensitized user information; and sending the desensitized user information to the cloud server. In this manner, the security of user information can be improved.

[0030] In the third aspect, an embodiment of the present application provides an anomaly detection device, which is applied to a cloud server, and the device includes: an anomaly judgment module, which is used to judge whether there is an abnormality in the user information sent by a terminal device based on a preset sample set when receiving the user information sent by the terminal device, the user information includes the user's basic information and the health data and environmental data of the user collected by the terminal device, and the sample set includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders; a reminder determination module, which is used to determine the target health reminder corresponding to the user information based on the sample set when there is an abnormality in the user information; a second communication module, which is used to send the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause.

[0031] According to an embodiment of the present application, the sample set used for anomaly detection includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders. When the cloud server receives user information sent by the terminal device, it can determine whether the user information is abnormal based on the sample set. When the user information is abnormal, it determines the target health reminder corresponding to the user information, and sends the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause. In this way, when the cloud server receives the user information, it can first determine whether it is abnormal. When the user information is abnormal, it can then determine the target health reminder and the abnormal cause corresponding to the target health reminder. This can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the target health reminder and the abnormal cause.

[0032] According to the third aspect, in a first possible implementation of the anomaly detection device, the device further includes: an anomaly exploration module, which is used to perform anomaly exploration on a preset first training set based on multiple preset health reminders and associated features of each health reminder, and determine multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories, and abnormal causes corresponding to each abnormal category, wherein the first training set includes multiple unlabeled first initial samples; an anomaly detection module, which is used to perform anomaly detection on a second training set based on multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder, and establish a sample set, wherein the second training set includes multiple initial abnormal samples corresponding to each health reminder and multiple unlabeled second initial samples.

[0033] In this embodiment, the cloud server can perform anomaly exploration on a preset first training set (including multiple unlabeled first initial samples) based on multiple preset health reminders and the associated features of each health reminder, determine multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories and abnormal causes corresponding to each abnormal category, and perform anomaly detection on the second training set based on the multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder to establish a sample set. Then, based on the sample set, anomaly detection is performed on the user information received from the terminal device. Therefore, through anomaly exploration, a small number of credible abnormal samples, multiple abnormal categories and explainable abnormal causes corresponding to each abnormal category can be automatically identified from the first training set, saving manual labeling time, and making full use of the identified abnormal samples and multiple abnormal categories. At the same time, considering high-dimensional features, a sample set is established through vector representation and deep clustering, which can improve the accuracy of the vector representation of each normal sample and each abnormal sample in the sample set, as well as the diversity of abnormal samples, thereby performing higher-dimensional and more accurate anomaly detection, providing users with more intelligent health reminders.

[0034] According to a first possible implementation of the third aspect, in a second possible implementation of the abnormality detection device, the abnormality exploration module includes: a decision tree establishment submodule, which establishes an abnormality decision tree for any health reminder based on the associated features of the health reminder and a preset first training set; an abnormality category determination submodule, which is used to determine, based on the abnormality decision tree, multiple abnormality categories corresponding to the health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category.

[0035] In this embodiment, by establishing an abnormal decision tree for each health reminder, and determining a small number of credible abnormal categories corresponding to each health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category based on each abnormal decision tree, the accuracy of the abnormal categories and initial abnormal samples corresponding to each health reminder and the interpretability of the abnormal causes can be improved.

[0036] According to a second possible implementation manner of the third aspect, in a third possible implementation manner of the abnormality detection device, the decision tree establishment submodule is configured to: establish a feature space based on the associated features of the health reminder and a preset first training set; add multiple virtual samples evenly to the feature space based on the number of first initial samples in the first training set; determine multiple division methods of the subspace of the feature space based on the density of the first initial samples in different areas of the feature space; for any division method, under the division method, determine the information gain of each associated feature based on the number of first initial samples and the number of virtual samples in each subspace of the feature space, and determine the information gain of the division method based on the information gain of each associated feature; determine the division method with the largest information gain among the multiple division methods as the target division method; divide the feature space into multiple subspaces based on the target division method; use each associated feature as a decision condition, and establish an abnormal decision tree based on the information gain of each associated feature under the target division method and the number of first initial samples in each subspace, wherein each leaf node of the abnormal decision tree corresponds to a subspace in the feature space.

[0037] In this embodiment, for any health reminder, a feature space is established, and virtual samples are evenly added to the feature space. Then, multiple division methods of the subspace of the feature space and the information gain of various division methods are determined, and the division method with the largest information gain is determined as the target division method. Then, according to the target division method, the feature space is divided into multiple subspaces, and each associated feature is used as a decision condition. According to the information gain of each associated feature under the target division method, an abnormal decision tree is established. Therefore, after the feature space is divided into multiple subspaces, the abnormal decision tree can be established according to the information gain of each associated feature (that is, the importance of the associated feature). This not only improves the accuracy of the abnormal decision tree, but also converts the problem of finding credible and explainable abnormal samples and abnormal categories into a binary problem of whether there are real samples (that is, the first initial samples) in the subspace of the feature space, simplifies the processing process, improves processing efficiency, and then realizes automatic classification and labeling of the first initial sample to solve the problem of no labeling of the first initial sample.

[0038] According to a third possible implementation manner of the third aspect, in a fourth possible implementation manner of the anomaly detection device, the anomaly category determination submodule is configured to: select at least one target leaf node from multiple leaf nodes of the anomaly decision tree according to the number of first initial samples in each subspace, wherein there is at least one first initial sample in the subspace corresponding to the target leaf node; determine whether the sample category represented by each target leaf node is an anomaly category according to an abnormal condition, and the abnormal condition is determined according to at least one of the number of first initial samples in the subspace corresponding to the target leaf node, the hierarchy of the target leaf node, and the decision path from the root node to the target leaf node; when the sample category represented by the target leaf node is an anomaly category, determine the first initial sample in the subspace corresponding to the target leaf node as the initial anomaly sample corresponding to the anomaly category; and determine the decision condition on the decision path from the root node of the anomaly decision tree to the target leaf node as the anomaly cause corresponding to the anomaly category.

[0039] In this embodiment, a target leaf node including at least one first initial sample is selected from multiple leaf nodes in the abnormal decision tree, and based on the abnormal conditions, it is determined whether the sample category represented by each target leaf node is an abnormal category, thereby determining multiple abnormal categories and initial abnormal samples corresponding to each abnormal category, and determining the abnormal cause corresponding to each abnormal category through the decision path in the abnormal decision tree. This is simple and fast, which can not only improve the processing efficiency, but also improve the explainability of the abnormal cause.

[0040] According to the first possible implementation manner of the third aspect, in the fifth possible implementation manner of the anomaly detection device, the anomaly detection module includes: a vector representation submodule, for any health reminder, initializing the vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network, and obtaining the 0th vector representation of each initial abnormal sample and each second initial sample; an iteration submodule, for iteratively updating the 0th vector representation of each initial abnormal sample and each second initial sample N times according to multiple abnormal categories, and obtaining the Nth vector representation of each initial abnormal sample and each second initial sample, where N is a positive integer and N≥1; a clustering submodule, for clustering the second training set according to the Nth vector representation of each initial abnormal sample and each second initial sample, and obtaining the vector representation of the normal samples and abnormal samples corresponding to the health reminder; a sample set establishment submodule, for establishing a sample set according to the vector representation of the normal samples and abnormal samples corresponding to each health reminder.

[0041] In this embodiment, for any health reminder, after determining the 0th vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network, the vector representation can be iteratively updated N times to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, and the second training set is clustered according to the Nth vector representation of each initial abnormal sample and each second initial sample to obtain the vector representation of the normal samples and abnormal samples corresponding to the health reminder. According to the vector representation of the normal samples and abnormal samples corresponding to each health reminder, a sample set is established, so that the limited initial abnormal samples and multiple abnormal categories corresponding to each health reminder can be utilized, and through iterative updates, the learning of normal samples and abnormal samples from the unknown multiple second initial samples can be accelerated, and then the sample set is established. This not only increases the diversity of abnormal samples, helps to discover more inconspicuous abnormalities, and improves the accuracy of the sample set, but also improves the accuracy of the vector representation of normal samples and abnormal samples.

[0042] According to a fifth possible implementation manner of the third aspect, in a sixth possible implementation manner of the anomaly detection device, the iterative submodule is configured to: for the i-th iteration, cluster the multiple initial anomaly samples according to the number of multiple anomaly categories and the i-1-th vector representation of each initial anomaly sample to obtain the i-th cluster center of each anomaly category, where i is a positive integer and 1≤i≤N; determine the i-th sampling probability of each second initial sample according to the i-1-th vector representation of each second initial sample; determine multiple positive samples and multiple negative samples at the i-th iteration from the multiple second initial samples according to the i-th sampling probability of each second initial sample; determine the i-th vector representation loss according to the i-th cluster center of each anomaly category and the multiple positive samples and multiple negative samples at the i-th iteration; adjust the i-1-th vector representation of each initial anomaly sample and each second initial sample according to the i-th vector representation loss to obtain the i-th vector representation of each initial anomaly sample and each second initial sample; and when i=N, obtain the N-th vector representation of each initial anomaly sample and each second initial sample.

[0043] In this embodiment, the vector representation is adjusted through paired learning of positive and negative samples, which can not only improve the learning speed but also improve the accuracy of the vector representation.

[0044] According to a sixth possible implementation of the third aspect, in a seventh possible implementation of the anomaly detection device, determining the i-th sampling probability of each second initial sample based on the i-1-th vector representation of each second initial sample includes: determining the i-th anomaly confidence level of each second initial sample based on the i-1-th vector representation of each second initial sample; and determining the i-th sampling probability of each second initial sample based on the i-th anomaly confidence level of each second initial sample. In this manner, the accuracy of the i-th sampling probability of each second initial sample can be improved.

[0045] According to the third aspect, in an eighth possible implementation of the anomaly detection device, the anomaly judgment module includes: a first vector determination submodule, used to determine a first vector, a second vector and a third vector respectively based on the user information and the sample set, the first vector being a vector representation of the user information, the second vector being an average vector representation of all normal samples in the sample set, and the third vector being an average vector representation of all abnormal samples in the sample set; a first similarity determination submodule, used to respectively determine a first similarity between the first vector and the second vector, and a second similarity between the first vector and the third vector; and an anomaly determination submodule, used to determine that there is an anomaly in the user information when the first similarity is less than the second similarity.

[0046] In this embodiment, by respectively determining the average vector representation of all normal samples in the sample set, the average vector representation of all abnormal samples, and the vector representation of user information, and based on the similarity of the vectors, it is determined whether the user information is abnormal. This is simple and fast, can reduce the amount of calculation, and improve processing efficiency.

[0047] According to the eighth possible implementation manner of the third aspect, in the ninth possible implementation manner of the abnormality detection device, the reminder determination module includes: a second similarity determination submodule, which, for any health reminder, determines the third similarity between the first vector and the fourth vector, and the fourth similarity between the first vector and the fifth vector, respectively, where the fourth vector is the average vector representation of the normal samples corresponding to the health reminder in the sample set, and the fifth vector is the average vector representation of the abnormal samples corresponding to the health reminder in the sample set; and a reminder determination submodule, which is used to determine the health reminder as the target health reminder corresponding to the user information when the third similarity is less than the fourth similarity.

[0048] In this embodiment, for any health reminder, the average vector representation of the normal samples corresponding to the health reminder is determined as the fourth vector, the average vector representation of the abnormal samples corresponding to the health reminder is determined as the fifth vector, and the third similarity between the first vector and the fourth vector and the fourth similarity between the first vector and the fifth vector are determined respectively. Then, when the third similarity is less than the fourth similarity, the health reminder is determined as the target health reminder corresponding to the user information. In this way, the target health reminder corresponding to the user information can be determined quickly and accurately through similarity calculation and comparison, which can improve the accuracy of the target health reminder.

[0049] According to the third aspect, in the tenth possible implementation method of the abnormality detection device, the second communication module includes: a communication sub-module, which is used to send the target health reminder and the abnormality cause corresponding to the target health reminder to the terminal device when the number of abnormalities in the user information within a preset time period is greater than or equal to a preset abnormality threshold.

[0050] In this way, health reminders caused by occasional abnormal user information can be reduced, the misjudgment rate can be reduced, and the accuracy of health reminders can be improved.

[0051] According to the third aspect or one or more of the multiple possible implementations of the third aspect, in an eleventh possible implementation of the abnormality detection device, the terminal device includes a smart wearable device, and the multiple health reminders include multiple of fatigue reminders, sleep reminders, stress reminders, and hunger reminders.

[0052] In the fourth aspect, an embodiment of the present application provides an abnormality detection device, which is applied to a terminal device, and the device includes: a first communication module, used to obtain user information and send the user information to a cloud server, so that the cloud server determines the target health reminder and the abnormal cause corresponding to the target health reminder based on a preset sample set and the user information, the user information including the user's basic information and the health data and environmental data of the user collected by the terminal device; a reminder module, used to receive the target health reminder and the abnormal cause corresponding to the target health reminder sent by the cloud server, and remind the user according to the target health reminder and the abnormal cause.

[0053] According to an embodiment of the present application, the terminal device can obtain user information including user basic information, environmental data and health data, and send the user to the cloud server for abnormality detection. When the cloud server detects an abnormality, it can send a target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device. After the terminal device receives the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, it can remind the user according to the target health reminder and the abnormal reason, so that the user can be given a health reminder through end-cloud collaborative decision-making, which can not only improve processing efficiency, but also improve the accuracy of health reminders and abnormal reasons.

[0054] According to the fourth aspect, in a first possible implementation of the anomaly detection device, the first communication module includes: a desensitizing submodule for acquiring user information and performing desensitization processing on the user information to obtain desensitized user information; and an information sending submodule for sending the desensitized user information to a cloud server. In this manner, the security of user information can be improved.

[0055] In a fifth aspect, an embodiment of the present application provides an anomaly detection device, comprising a processor and a memory for storing processor-executable instructions, wherein the processor is configured to implement the above-mentioned first aspect or one or several of the multiple possible implementations of the first aspect when executing the instructions, or to implement the above-mentioned second aspect or the anomaly detection method in the first possible implementation of the second aspect.

[0056] According to an embodiment of the present application, the sample set used for anomaly detection includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders. When the cloud server receives user information sent by the terminal device, it can determine whether the user information is abnormal based on the sample set. When the user information is abnormal, it determines the target health reminder corresponding to the user information, and sends the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause. In this way, when the cloud server receives the user information, it can first determine whether the user information is abnormal, and when the user information is abnormal, it can determine the target health reminder and the abnormal cause corresponding to the target health reminder. This can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the target health reminder and the abnormal cause.

[0057] In a sixth aspect, an embodiment of the present application provides a terminal device that can execute the anomaly detection method in the above-mentioned second aspect or the first possible implementation manner of the second aspect.

[0058] According to an embodiment of the present application, the terminal device can obtain user information including user basic information, environmental data and health data, and send the user to the cloud server for abnormality detection. When the cloud server detects an abnormality, it can send a target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device. After the terminal device receives the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, it can remind the user according to the target health reminder and the abnormal reason, so that the user can be given a health reminder through end-cloud collaborative decision-making, which can not only improve processing efficiency, but also improve the accuracy of health reminders and abnormal reasons.

[0059] In the seventh aspect, an embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying a computer-readable code. When the computer-readable code runs in an electronic device, the processor in the electronic device executes the above-mentioned first aspect or one or several of the multiple possible implementations of the first aspect, or executes the above-mentioned second aspect or the first possible implementation of the second aspect. The method of abnormality detection.

[0060] According to an embodiment of the present application, the sample set used for anomaly detection includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders. When the cloud server receives user information sent by the terminal device, it can determine whether the user information is abnormal based on the sample set. When the user information is abnormal, it determines the target health reminder corresponding to the user information, and sends the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause. In this way, when the cloud server receives the user information, it can first determine whether the user information is abnormal, and when the user information is abnormal, it can determine the target health reminder and the abnormal cause corresponding to the target health reminder. This can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the target health reminder and the abnormal cause.

[0061] In an eighth aspect, an embodiment of the present application provides a non-volatile computer-readable storage medium on which computer program instructions are stored, characterized in that when the computer program instructions are executed by a processor, they implement the above-mentioned first aspect or one or several of the multiple possible implementations of the first aspect, or implement the above-mentioned second aspect or the first possible implementation of the second aspect. The abnormality detection method.

[0062] According to an embodiment of the present application, the sample set used for anomaly detection includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders. When the cloud server receives user information sent by the terminal device, it can determine whether the user information is abnormal based on the sample set. When the user information is abnormal, it determines the target health reminder corresponding to the user information, and sends the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause. In this way, when the cloud server receives the user information, it can first determine whether the user information is abnormal, and when the user information is abnormal, it can determine the target health reminder and the abnormal cause corresponding to the target health reminder. This can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the target health reminder and the abnormal cause.

[0063] These and other aspects of the present application will become more readily apparent from the following description of the embodiment(s). BRIEF DESCRIPTION OF THE DRAWINGS

[0064] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the application and, together with the description, serve to explain the principles of the application.

[0065] Figure 1a 、 Figure 1b and Figure 1c A schematic diagram of an anomaly detection system according to an embodiment of the present application is shown.

[0066] Figure 2 A schematic diagram showing a data acquisition module of a terminal device according to an embodiment of the present application is shown.

[0067] Figure 3 A flowchart of an abnormality detection method according to an embodiment of the present application is shown.

[0068] Figure 4 A flowchart showing an abnormality detection method according to an embodiment of the present application is shown.

[0069] Figure 5 A schematic diagram illustrating associated features of health reminders according to an embodiment of the present application.

[0070] Figure 6a 、 Figure 6b and Figure 6c A schematic diagram showing a feature space and its division according to an embodiment of the present application is shown.

[0071] Figure 7a and Figure 7b A schematic diagram of an abnormal decision tree according to an embodiment of the present application is shown.

[0072] Figure 8A schematic diagram of a process for establishing a sample set according to an embodiment of the present application is shown.

[0073] Figure 9a A schematic diagram showing a second training set according to an embodiment of the present application is shown.

[0074] Figure 9b A schematic diagram showing a sample set according to an embodiment of the present application is shown.

[0075] Figure 10 A flowchart of an abnormality detection method according to an embodiment of the present application is shown.

[0076] Figure 11 A block diagram of an abnormality detection device according to an embodiment of the present application is shown.

[0077] Figure 12 A block diagram of an abnormality detection device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0078] Various exemplary embodiments, features, and aspects of the present application will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise indicated.

[0079] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0080] In addition, numerous specific details are provided in the detailed description below to better illustrate the present application. Those skilled in the art will appreciate that the present application can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art are not described in detail in order to highlight the main purpose of the present application.

[0081] Currently, in the application scenario of smart wearable device health reminders, existing technologies mostly rely on manual methods to set thresholds or threshold ranges and issue reminders when the established indicators exceed the thresholds. In other words, existing technologies usually use manual rules / expert libraries for anomaly detection.

[0082] However, when using manual rules / expert libraries for anomaly detection, setting manual thresholds for different indicators usually requires a lot of expert knowledge and time to study different groups, which cannot cover all populations in the long run. Moreover, only using thresholds for reminders can only consider a small number of features and ignore the connections between different features, such as the connection between environmental and physiological characteristics. Therefore, the dimension of reminders is relatively single, for example, only reminders such as cadence and heart rate can be given.

[0083] For example, the patent document "Health Monitoring and Early Warning System Based on Vital Signs Data" (He Jiapeng, CN110856653A, 2020.03.03) proposes a health monitoring and early warning system based on vital signs data, which includes wearable devices, smart terminals and cloud servers. Among them, the smart terminal is responsible for obtaining the wearer's basic personal information, basic physical data, medical history, current status and vital signs data, and transmitting the acquired data to the cloud server. The cloud server is used to build a personal health model, health warning thresholds and early warning reminders based on the received data, combined with the algorithms in the AI ​​computing and analysis module and pre-stored big data analysis.

[0084] However, the health monitoring and early warning system described in this technical solution does not take into account external factors that affect human health, such as environmental factors, and only proposes a general framework of the system. The AI ​​computing and analysis module included in it only mentions the use of AI (Artificial Intelligence) algorithms and big data analysis to provide health warnings, but does not propose a specific model. Its AI model lacks explainability.

[0085] The patent document "A sports health data collection and management prescription and terminal service system based on artificial intelligence" (Rao Xudong, CN110010223A, 2019.07.12) discloses a sports health data collection and management prescription and terminal service system based on artificial intelligence, which provides a method for collecting more comprehensive and accurate health data and generating personalized solutions that fit each user's pain points. This technical solution obtains data such as the environment and user movement through the data acquisition module. In order to find out the user's pain points, this technical solution, based on the collected data, performs various parameterized comparisons and logical operations on the preset threshold range through the update module, and selects a model that is closer to the user parameters in the standard library pre-stored in the system as the exercise prescription. Through cyclic comparison and data calculation, until the threshold range is reached, the final exercise prescription is output.

[0086] However, this technical solution always relies on a preset threshold range to find user pain points, requires a large expert database, and only relies on individual data, failing to tap the potential of group data.

[0087] The patent document "A Sports Teaching Intelligent System Based on a Sports Bracelet and a Network Cloud Platform" (Yu Hongyan, Cao Yang, et al., CN110102025A, August 9, 2019) proposes a sports teaching intelligent system based on a sports bracelet and a network cloud platform. The system includes a bracelet terminal, a cloud platform, and a web terminal. For the reminder function, the cloud platform is equipped with a monitoring and alarm module, including a monitoring unit and an alarm unit. The monitoring unit is configured to receive exercise information and evaluate the intensity of the monitored exercise. The alarm unit is configured to perform an alarm evaluation on the exercise information, obtain an alarm level (including level 0, level 1, level 2, and level 3), and send an alarm message according to the alarm level.

[0088] However, this technical solution uses strong rules to set manual alarm levels, which cannot adapt to the differences between different groups and cannot change over time. In addition, setting fixed alarm levels can only cover limited features and has poor intelligence.

[0089] In addition, the patent document "Smart Physical Education Teaching System Based on Group Portraits" (Zhou Xiaofan, Yu Hongyan, et al., CN109495853A, 2019.03.19) discloses a smart physical education teaching system based on group portraits. This technical solution uses a group optimization module to group physical fitness, individual exercise intensity, and classroom exercise effect, and feeds the grouping results back to the group support module to optimize group portraits; the group support module provides a grouping strategy, and by constructing three semantically related group portraits to form a group portrait model, it improves the interpretability of the grouping results; the model preset unit of the group support module provides a preset initial value for the group portrait model to solve the cold start problem; the monitoring and alarm module uses historical data to construct a heart rate threshold model within each group based on the physical fitness grouping results, monitors the data collected by the data perception module, identifies anomalies, and issues early warnings.

[0090] However, this technical solution determines the number of groups through artificial rules, which will ignore some possible feature combinations and thus fail to identify representative groups. Moreover, when making abnormal alarms, it only establishes a threshold model for a single dimension (heart rate) without considering multiple features.

[0091] In order to solve the above technical problems, the present application provides an anomaly detection method. The anomaly detection method of the embodiment of the present application makes collaborative decisions between the end and the cloud. It can not only automatically identify a small number of credible abnormal samples from multiple unknown samples through anomaly exploration, saving time for manual labeling, but also consider the relationship between multiple features when providing health reminders, thereby providing higher-dimensional and more intelligent health reminders (such as fatigue reminders, etc.).

[0092] In one possible implementation, the anomaly detection method of the embodiments of the present application can be applied to cloud servers and terminal devices, achieving anomaly detection and health reminders through end-cloud collaborative decision-making. The terminal device is a smart terminal that can be connected to the cloud server, and may include smart wearable devices such as smart bracelets, smart watches, and smart glasses.

[0093] In one possible implementation, the terminal device may also include other IoT (Internet of Things) smart devices connected to the cloud server and equipped with sensors, such as self-driving cars, smart home appliances, etc. It should be understood that this application does not limit the specific type of terminal device.

[0094] Figure 1a FIG. 1 is a schematic diagram of an abnormality detection system according to an embodiment of the present application. Figure 1a As shown, the anomaly detection system includes a terminal device 10 and a cloud server 20, which are connected via a network. The terminal device 10 can obtain basic user information, health data, and environmental data, and send the acquired data to the cloud server 20 for anomaly detection. After receiving the data sent by the terminal device 20, the cloud server 10 performs anomaly detection on the data. If the data is anomaly, the cloud server 10 sends the corresponding health reminder and the cause of the anomaly to the terminal device 10, so that the terminal device 10 can alert the user. This allows for more intelligent health reminders through end-to-end collaborative decision-making.

[0095] Figure 1b FIG. 1 is a schematic diagram of an abnormality detection system according to an embodiment of the present application. Figure 1b As shown, the anomaly detection system includes a terminal device 10 and a cloud server 20, and the terminal device 10 and the cloud server 20 are connected via a network.

[0096] The terminal device 10 includes a data acquisition module 11, a first communication module 12, and a reminder module 13. The terminal device 10 can acquire data (such as basic user information, environmental data, and health data) through the data acquisition module 11 and send the acquired data to the cloud server 20 through the first communication module 12, so that the cloud server 20 can perform anomaly detection on the data. The terminal device 10 can also receive health reminders and anomaly reasons from the cloud server 20 through the first communication module 12 to alert the user.

[0097] The cloud server 20 includes a second communication module 21, an anomaly exploration module 22, and an anomaly detection module 23. The cloud server 20 can receive data sent by the terminal device 10 through the second communication module 21, and determine whether the data is abnormal through the anomaly detection module 23. If the data is abnormal, the cloud server 20 determines the health reminder and the cause of the abnormality corresponding to the data, and then sends the health reminder and the cause of the abnormality to the terminal device 10 through the second communication module 21, so that the terminal device 10 can remind the user.

[0098] The anomaly exploration module 22 can be used to identify a small number of credible anomaly samples from a plurality of unlabeled sample data and determine multiple anomaly categories. The anomaly detection module 23 can also be used to train a small number of known anomaly samples and a large number of unknown samples based on the small number of credible anomaly samples and multiple anomaly categories obtained by the anomaly exploration module 22, to obtain vector representations of normal and anomaly samples with strong discrimination.

[0099] Figure 1c FIG. 1 is a schematic diagram showing an abnormality detection system according to an embodiment of the present application. Figure 1b The difference between the anomaly detection system shown is that Figure 1c In the anomaly detection system shown, the cloud server 20 includes a second communication module 21 , an anomaly exploration module 22 , an anomaly detection module 23 ′, an anomaly judgment module 24 and a reminder determination module 25 .

[0100] The cloud server 20 can receive data sent by the terminal device 10 through the second communication module 21, and determine whether there is an abnormality in the data through the abnormality judgment module 24. When there is an abnormality in the data, the cloud server 20 determines the health reminder and the cause of the abnormality corresponding to the data through the reminder determination module 25, and sends the health reminder and the cause of the abnormality to the terminal device 10 through the second communication module 21, so that the terminal device 10 reminds the user.

[0101] Anomaly exploration module 22 can be used to identify a small number of credible anomaly samples from a plurality of unlabeled sample data and determine multiple anomaly categories. Anomaly detection module 23' can be used to train a small number of known anomaly samples and a large number of unknown samples based on the small number of credible anomaly samples and multiple anomaly categories obtained by anomaly exploration module 22, to obtain vector representations of normal and anomaly samples with strong discrimination.

[0102] In one possible implementation, the data acquisition module 11 in the terminal device 10 can collect basic personal information input by the user, such as gender, height, weight, etc., and can also collect data through various sensors. For example, the user's physiological data can be collected through sensors, including heart rate, exercise status, body temperature, sleep and other data. The user's environmental data can also be collected through sensors, including time, location, air pressure, temperature, light and darkness and other data.

[0103] Figure 2 FIG. 1 is a schematic diagram showing a data acquisition module of a terminal device according to an embodiment of the present application. Figure 2 As shown, the data acquisition module 11 may include a basic information statistics submodule 111 , an environment perception submodule 112 and a physiological perception submodule 113 .

[0104] Among them, the basic information statistics submodule 111 includes a personal information submodule and a health status recording submodule. The personal information submodule can be used to receive the personal basic information entered by the user during the initialization stage, such as gender, height, weight and other information. The health status recording submodule can be used to record the historical health data entered by the user.

[0105] The environmental perception submodule 112 may include a time perception submodule, a position perception submodule, an air pressure perception submodule, an ambient light perception submodule and a weather perception submodule implemented by various different sensors, which are used to collect time, position, air pressure, light and temperature and other data of the external environment where the user using the terminal device is located.

[0106] The physiological sensing submodule 113 may include a dynamic heart rate detection submodule, a motion state detection submodule, a body temperature detection submodule and a sleep state detection submodule implemented by various different sensors, which are used to collect heart rate, motion state, body temperature, sleep state and other data of the user using the terminal device.

[0107] It should be understood that each specific submodule in the data acquisition module can be set according to the actual needs of collecting or obtaining data, and this application does not limit the specific submodules included in the data acquisition module.

[0108] Figure 3 FIG. 1 is a flow chart showing an abnormality detection method according to an embodiment of the present application. Figure 3 As shown, the anomaly detection method is applied to a cloud server, and the method includes:

[0109] Step S310: upon receiving user information sent by a terminal device, determining whether the user information is abnormal based on a preset sample set.

[0110] Among them, the terminal device can be a smart wearable device such as a smart watch or a smart bracelet. The user information is obtained by the terminal device and sent to the cloud server. The user information may include the user's basic information and the user's health data and environmental data collected by the terminal device. The user's basic information may be, for example, the user's height, weight, gender, etc. The user's health data may be, for example, the user's heart rate, blood pressure, blood oxygen, body temperature, sleep status, exercise status and other physiological data, which can be collected by sensors. The user's environmental data may be, for example, the air pressure, temperature, location, time and other data of the external environment in which the user is located, which can be collected by sensors. It should be understood that those skilled in the art can determine the specific content of the user information according to actual conditions, and this application does not limit this.

[0111] In one possible implementation, a preset sample set may include vector representations of normal samples and abnormal samples corresponding to multiple health reminders. The multiple health reminders may include multiple of a fatigue reminder, a sleep reminder, a stress reminder, and a hunger reminder. For any health reminder, there may be multiple normal samples and abnormal samples corresponding to that health reminder.

[0112] In a possible implementation, the vector representation of each normal sample and each abnormal sample in the sample set may be a high-dimensional vector representation to improve the accuracy of the vector representation, thereby improving the accuracy of anomaly detection.

[0113] When the cloud server receives user information sent by the terminal device, it can compare the user information with the normal samples and abnormal samples in the sample set to determine whether there is any abnormality in the user information.

[0114] In one possible implementation, step S310 may include: determining a first vector, a second vector, and a third vector based on the user information and the sample set, respectively, wherein the first vector is a vector representation of the user information, the second vector is an average vector representation of all normal samples in the sample set, and the third vector is an average vector representation of all abnormal samples in the sample set; determining a first similarity between the first vector and the second vector, and a second similarity between the first vector and the third vector; and determining that an abnormality exists in the user information when the first similarity is less than the second similarity.

[0115] In one possible implementation, when determining whether there is an abnormality in user information, the average vector representation of the user information and all normal samples and all abnormal samples in the sample set can be first determined. Specifically, the vector representation of the user information can be determined as the first vector, the average vector representation of all normal samples in the sample set can be determined as the second vector, and the average vector representation of all abnormal samples in the sample set can be determined as the third vector; then, the first similarity between the first vector and the second vector, and the second similarity between the first vector and the third vector are determined respectively, wherein the first similarity and the second similarity can be determined by Euclidean distance, cosine similarity, Manhattan distance, etc., and this application does not limit the method for determining the first similarity and the second similarity.

[0116] After determining the first and second similarities, the relationship between the first and second similarities can be determined. For example, if the first similarity is the first Euclidean distance and the second similarity is the second Euclidean distance, the first and second Euclidean distances can be compared; the smaller the distance, the greater the similarity. If the first Euclidean distance is less than or equal to the second Euclidean distance, the first similarity can be considered greater than or equal to the second similarity; if the first Euclidean distance is greater than the second Euclidean distance, the first similarity can be considered less than the second similarity.

[0117] When the first similarity is greater than or equal to the second similarity, the user information is more similar to the normal samples in the sample set, and the user information can be considered normal, that is, there is no abnormality; when the first similarity is less than the second similarity, the user information is more similar to the abnormal samples in the sample set, and it can be considered that there is an abnormality in the user information.

[0118] By determining the average vector representation of all normal samples in the sample set, the average vector representation of all abnormal samples, and the vector representation of user information, and based on the similarity of the vectors, it is determined whether the user information is abnormal. This is simple and fast, can reduce the amount of calculation, and improve processing efficiency.

[0119] Step S320: When there is an abnormality in the user information, determine a target health reminder corresponding to the user information based on the sample set.

[0120] When there is an abnormality in the user information, the vector representation of the user information can be compared with the vector representations of the normal samples and abnormal samples of each health reminder in the sample set to determine the target health reminder corresponding to the user information.

[0121] For example, assuming that the sample set includes three health reminders, when there is an abnormality in the user information, first determine whether to issue the first health reminder to the user. The vector representation of the user information can be compared with the vector representation of the normal sample and abnormal sample of the first health reminder to determine whether to issue the first health reminder to the user; then determine whether to issue the second health reminder to the user, and then determine whether to issue the third health reminder to the user. The determination method for the second and third health reminders is similar to that for the first health reminder, and will not be repeated here. Then, the health reminders that need to be issued to the user, such as the first and third health reminders, can be determined as the target health reminders corresponding to the user information.

[0122] It should be understood that when determining the target health reminder, those skilled in the art may determine the judgment order of each health reminder based on actual conditions, and this application does not impose any restrictions on this.

[0123] In one possible implementation, step S320 may include: for any health reminder, determining the third similarity between the first vector and the fourth vector, and the fourth similarity between the first vector and the fifth vector, respectively, the fourth vector being the average vector representation of the normal samples corresponding to the health reminder in the sample set, and the fifth vector being the average vector representation of the abnormal samples corresponding to the health reminder in the sample set; when the third similarity is less than the fourth similarity, determining the health reminder as the target health reminder corresponding to the user information.

[0124] For any health reminder in the sample set, such as a fatigue reminder, the average vector representation of normal samples corresponding to the fatigue reminder can be determined as a fourth vector, and the average vector representation of abnormal samples corresponding to the fatigue reminder can be determined as a fifth vector. Then, a third similarity between the first vector (the vector representation of user information) and the fourth vector and a fourth similarity between the first vector and the fifth vector are determined, and a relationship between the third similarity and the fourth similarity is determined.

[0125] When the third similarity is greater than or equal to the fourth similarity, the user information is more similar to the normal sample, and it can be considered that no fatigue reminder is needed; when the third similarity is less than the fourth similarity, the user information is more similar to the abnormal sample, and it can be considered that a fatigue reminder is needed, and the fatigue reminder can be determined as the target health reminder corresponding to the user information.

[0126] For any health reminder, the average vector representation of the normal samples corresponding to the health reminder is determined as the fourth vector, the average vector representation of the abnormal samples corresponding to the health reminder is determined as the fifth vector, and the third similarity between the first vector and the fourth vector and the fourth similarity between the first vector and the fifth vector are determined respectively. Then, when the third similarity is less than the fourth similarity, the health reminder is determined as the target health reminder corresponding to the user information. In this way, the target health reminder corresponding to the user information can be determined quickly and accurately through similarity calculation and comparison, which can improve the accuracy of the target health reminder.

[0127] Step S330: Send the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal reason.

[0128] After determining the target health reminder corresponding to the user information, the target health reminder and the abnormal reason corresponding to the target health reminder can be sent to the terminal device. After receiving the target health reminder and the abnormal reason, the terminal device will remind the user based on the target health reminder and the abnormal reason. Among them, the target health reminder may include at least one of a fatigue reminder, a sleep reminder, a heart rate reminder, a stress reminder, and a hunger reminder; the abnormal reason corresponding to the target health reminder can be a potential abnormal reason, which can be determined based on the label of the abnormal sample corresponding to the target health reminder in the sample set.

[0129] In one possible implementation, step S330 may include: when the number of abnormalities in the user information within a preset time period is greater than or equal to a preset abnormality threshold, sending the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device.

[0130] The preset duration may be, for example, 30 minutes, 60 minutes, etc., and the abnormal number threshold may be, for example, 5 times, 10 times, etc. Those skilled in the art may set the preset duration and abnormal number threshold according to actual conditions, and this application does not impose any limitation thereto.

[0131] When performing anomaly detection, the cloud server can determine whether the number of times user information has anomalies is greater than or equal to a preset anomaly threshold within a preset time period. If the number of times user information has anomalies is greater than or equal to the anomaly threshold within the preset time period, for example, if the number of times user information has anomalies is greater than or equal to 5 times within 60 minutes, the target health reminder corresponding to the user information and the cause of the anomaly corresponding to the target health reminder will be sent to the terminal device.

[0132] In this way, health reminders caused by occasional abnormal user information can be reduced, the misjudgment rate can be reduced, and the accuracy of health reminders can be improved.

[0133] According to an embodiment of the present application, the sample set used for anomaly detection includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders. When the cloud server receives user information sent by the terminal device, it can determine whether the user information is abnormal based on the sample set. When the user information is abnormal, it determines the target health reminder corresponding to the user information, and sends the target health reminder and the abnormal cause corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal cause. In this way, when the cloud server receives the user information, it can first determine whether the user information is abnormal, and when the user information is abnormal, it can determine the target health reminder and the abnormal cause corresponding to the target health reminder. This can not only reduce the amount of calculation and improve processing efficiency, but also improve the accuracy of the target health reminder and the abnormal cause.

[0134] Figure 4 A flowchart of an anomaly detection method according to an embodiment of the present application is shown. As shown in Figure 4, the anomaly detection method is applied to a cloud server and includes steps S301, S302, S310, S320, and S330. That is, before the cloud server performs anomaly detection on user information sent by a terminal device (i.e., before step S310), it can establish a sample set through steps S301 and S302.

[0135] In one possible implementation, when establishing a sample set, first in step S301, based on multiple preset health reminders and the associated features of each health reminder, anomaly exploration can be performed on the preset first training set to determine multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories, and abnormal causes corresponding to each abnormal category.

[0136] The first training set includes multiple unlabeled first initial samples. The multiple first initial samples can be multiple unlabeled historical data of the same user received by the cloud server. The multiple first initial samples can also be multiple unlabeled historical data of different users received by the cloud server.

[0137] In one possible implementation, the multiple health reminders may include a fatigue reminder, a sleep reminder, a heart rate reminder, a stress reminder, and a hunger reminder. The multiple health reminders may also include other health reminders, such as a metabolism reminder and a sedentary reminder. This application does not limit the specific content of the multiple health reminders.

[0138] Because the user information acquired by terminal devices includes numerous, multidimensional, and complex features, and the associated feature sets for different health alert categories may differ, for each health alert, at the initial stage, based on prior knowledge, at least one understandable associated feature for that health alert can be manually selected from the global feature set. This process can also involve expert participation to improve the accuracy of the selected associated features.

[0139] Figure 5 A schematic diagram showing the associated features of health reminders according to an embodiment of the present application. Figure 5 As shown, the global feature library 510 includes 6 physiological features (A, B, C, D, E, and F) and 3 environmental features (H, I, and J), and the health reminders include 3, namely, fatigue reminder 520, sleep reminder 530, and heart rate reminder 540.

[0140] When selecting associated features, based on prior knowledge, three understandable features can be selected from the global feature library 510, namely, fatigue reminder 520, sleep reminder 530, and heart rate reminder 540. The associated features of fatigue reminder 520 are C, F, and J; the associated features of sleep reminder 530 are B, D, and F; and the associated features of heart rate reminder 540 are A, E, and H.

[0141] After determining multiple health reminders and the associated features of each health reminder, for any health reminder, the first training set can be used for anomaly exploration based on the associated features of the health reminder through clustering, similarity calculation, etc., to determine multiple initial abnormal samples corresponding to the health reminder, multiple abnormal categories, and abnormal causes corresponding to each abnormal category.

[0142] In one possible implementation, step S301 may include: for any health reminder, establishing an abnormal decision tree based on the associated features of the health reminder and a preset first training set; and determining, based on the abnormal decision tree, multiple abnormal categories corresponding to the health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category.

[0143] For any health alert, when determining multiple initial abnormal samples, multiple abnormal categories, and abnormal causes corresponding to each abnormal category from the first training set, an abnormality decision tree can be first established based on the associated features of the health alert and the first training set. In other words, each health alert corresponds to an abnormality decision tree.

[0144] For example, assuming that the health reminder is a fatigue reminder, when establishing an abnormal decision tree, the associated features of the fatigue reminder can be used as judgment conditions, the first initial sample in the first training set can be classified, and the abnormal decision tree can be established based on the importance of the associated features, such as weight, information gain, etc.

[0145] In one possible implementation, establishing an abnormal decision tree based on the associated features of the health reminder and a preset first training set may include: establishing a feature space based on the associated features of the health reminder and a preset first training set; evenly adding multiple virtual samples to the feature space based on the number of first initial samples in the first training set; determining multiple division methods of the subspace of the feature space based on the density of the first initial samples in different areas of the feature space; for any division method, under the division method, determining the information gain of each associated feature based on the number of first initial samples and the number of virtual samples in each subspace of the feature space, and determining the information gain of the division method based on the information gain of each associated feature; determining the division method with the largest information gain among the multiple division methods as the target division method; dividing the feature space into multiple subspaces based on the target division method; using each associated feature as a decision condition, and establishing an abnormal decision tree based on the information gain of each associated feature under the target division method and the number of first initial samples in each subspace, wherein each leaf node of the abnormal decision tree corresponds to a subspace in the feature space.

[0146] For example, assuming the health reminder is a fatigue reminder, when building an abnormality decision tree, a feature space can be established based on the fatigue reminder's associated features and the first training set. The dimension of the feature space is equal to the number of associated features of the fatigue reminder. For example, if the fatigue reminder has two associated features, the dimension of the feature space is two-dimensional; if the fatigue reminder has five associated features, the dimension of the feature space is five-dimensional. The first initial samples in the first training set are distributed in the feature space based on the values ​​of the associated features.

[0147] After establishing the feature space, multiple virtual samples can be evenly added to the feature space based on the number of the first initial samples in the first training set. The number of virtual samples can be the same as or similar to the number of the first initial samples. Virtual samples can be evenly added to the feature space at predetermined intervals.

[0148] At the same time, based on the assumption that abnormal samples are relatively far away from normal samples, normal samples are mostly in a high-density space, and abnormal samples are usually in a relatively sparse space because they are far away from normal samples, multiple ways of dividing the subspace of the feature space can be determined according to the density of the first initial samples in different regions of the feature space.

[0149] In one possible implementation, virtual samples may be referenced when determining multiple partitioning methods for subspaces of the feature space. For example, the number of virtual samples in the feature space is the same as the number of the first initial samples. When determining the partitioning method for the feature space, the number of virtual samples required for each partition may be calculated based on the proportion of the feature space, thereby determining the partitioning boundaries.

[0150] Figure 6a 、 Figure 6b 、 Figure 6c FIG. 1 shows a schematic diagram of a feature space and its division according to an embodiment of the present application. Figure 6a As shown, the health reminder has two associated features, d1 and d2, and its feature space is a two-dimensional space. The feature space includes 15 first initial samples (represented by black triangles) and 15 evenly distributed virtual samples (represented by hollow triangles).

[0151] Figure 6b and Figure 6c Show the Figure 6a Schematic diagram of dividing the feature space. Figure 6b As shown, when determining the partition boundary, the relative density can be considered at the same time. When density 1 (between partition 1 and partition 2) is greater than density 2 (between partition 2 and the boundary), we can try to expand partition 1 to partition 2.

[0152] Figure 6c An exemplary division method of the feature space is shown, in which the feature space is divided into five subspaces. It should be understood that the feature space may also be divided in other ways, which are not limited in this application.

[0153] After determining multiple ways of dividing the subspaces of the feature space, for any division method, under this division method, the information entropy of each associated feature can be calculated separately according to the number of first initial samples and the number of virtual samples in each subspace of the feature space, and then the information gain of each associated feature can be determined, and the sum of the information gains of each associated feature can be determined as the information gain of this division method.

[0154] After determining the information gain of each partitioning method, the partitioning method with the highest information gain can be determined as the target partitioning method. Based on the target partitioning method, the feature space can be divided into multiple subspaces. Then, the various associated features of the health reminder can be used as decision conditions. Based on the information gain of each associated feature under the target partitioning method, an abnormality decision tree can be established.

[0155] For example, an abnormal decision tree can be established by using each associated feature as a decision condition in descending order of information gain. The associated feature with the highest information gain can be used as the first decision condition to establish the root node of the abnormal decision tree. The associated feature with the second lowest information gain can then be used as the second decision condition to establish a child node of the root node. This process can be repeated to establish branch nodes of the abnormal decision tree. The leaf nodes of the abnormal decision tree can then be determined based on the correspondence between each subspace in the feature space and each decision condition, thus establishing the abnormal decision tree.

[0156] Each leaf node of the abnormal decision tree corresponds to a subspace in the feature space, that is, the leaf nodes of the abnormal decision tree correspond one to one to the subspace in the feature space.

[0157] In one possible implementation, the above process of generating the abnormal decision tree may be implemented by a machine learning algorithm. The generation of the abnormal decision tree may be iterated multiple times by the machine learning algorithm to improve the accuracy of the generated abnormal decision tree.

[0158] According to the above embodiment, for any health reminder, a feature space is established, and virtual samples are evenly added to the feature space. Then, multiple division methods of the subspace of the feature space and the information gain of various division methods are determined, and the division method with the largest information gain is determined as the target division method. Then, according to the target division method, the feature space is divided into multiple subspaces, and each associated feature is used as a decision condition. According to the information gain of each associated feature under the target division method, an abnormal decision tree is established. Therefore, after the feature space is divided into multiple subspaces, an abnormal decision tree can be established according to the information gain of each associated feature (that is, the importance of the associated feature). This not only improves the accuracy of the abnormal decision tree, but also converts the problem of finding credible and explainable abnormal samples and abnormal categories into a binary problem of whether there are real samples (that is, the first initial samples) in the subspace of the feature space, simplifies the processing process, improves processing efficiency, and then realizes automatic classification and labeling of the first initial sample to solve the problem of no labeling of the first initial sample.

[0159] In one possible implementation, after establishing an abnormal decision tree, the presence of a first initial sample (i.e., a real sample) in each subspace can be determined based on the number of first initial samples in the subspace corresponding to the leaf nodes of the abnormal decision tree. When a first initial sample exists in a subspace, multiple abnormal categories corresponding to health reminders, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category, are determined by judging the sample category (normal category or abnormal category) represented by the leaf node corresponding to the subspace where the first initial sample exists.

[0160] In one possible implementation, when determining multiple abnormal categories corresponding to health reminders, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category based on the abnormal decision tree, at least one target leaf node can be first selected from multiple leaf nodes of the abnormal decision tree based on the number of first initial samples in each subspace, wherein there is at least one first initial sample in the subspace corresponding to the target leaf node, that is, there is a real sample in the subspace corresponding to the target leaf node.

[0161] Then, based on the abnormal conditions, it can be determined whether the sample category represented by each target leaf node is an abnormal category, wherein the abnormal conditions can be determined based on at least one of the number of first initial samples in the subspace corresponding to the target leaf node, the level of the target leaf node, and the decision path from the root node to the target leaf node.

[0162] For example, the abnormal condition may be that the level of the target leaf node is greater than or equal to half the depth of the abnormal decision tree, that is, the level of the target leaf node is relatively deep compared to the depth of the abnormal decision tree.

[0163] The abnormal condition can also be that the number of first initial samples in the subspace corresponding to the target leaf node is relatively small (which can be determined by relative quantity, relative density, percentage, etc.), and the category determined based on the interpretation of the decision path from the root node to the target leaf node is an abnormal category.

[0164] The abnormal conditions may also be that the number of first initial samples in the subspace corresponding to the target leaf node is relatively small, the level of the target leaf node is relatively deep, and the category determined based on the interpretation of the decision path from the root node to the target leaf node is an abnormal category.

[0165] It should be understood that the above is only an exemplary description of the abnormal conditions. Those skilled in the art can set the specific content of the abnormal conditions according to actual conditions, and this application does not limit this.

[0166] In a possible implementation, the abnormal condition may be further adjusted according to the classification result of the abnormal decision tree, that is, the abnormal condition may be adjusted through automatic learning to improve the accuracy of the abnormal condition.

[0167] For any target leaf node, it can be determined whether the target leaf node meets the abnormal condition. If the target leaf node meets the abnormal condition, the sample category represented by the target leaf node can be considered as the abnormal category; if the target leaf node does not meet the abnormal condition, the sample category represented by the target leaf node can be considered as the normal category.

[0168] When the sample category represented by the target leaf node is an abnormal category, the first initial sample in the subspace corresponding to the target leaf node can be determined as the initial abnormal sample corresponding to the abnormal category; and the decision condition on the decision path from the root node of the abnormal decision tree to the leaf node can be determined as the abnormal cause corresponding to the abnormal category.

[0169] The abnormality categories represented by each target leaf node in the abnormality decision tree can be determined as multiple abnormality categories corresponding to the health reminder, thereby obtaining the number of abnormality categories corresponding to the health reminder.

[0170] Figure 7a FIG. 1 shows a schematic diagram of an abnormal decision tree according to an embodiment of the present application. Figure 7a As shown, the abnormal decision tree includes four decision conditions A1, A2, A3, and A4, and five leaf nodes, namely node 71, node 72, node 73, node 74, and node 75. Figure 7a There is no first initial sample (i.e., no real sample) in the subspace corresponding to the white leaf nodes in the abnormal decision tree shown in FIG. , and there is no first initial sample (i.e., no real sample) in the subspace corresponding to nodes 71, 73, and 74 ( Figure 7a There is a first initial sample (ie, a real sample) in the subspace corresponding to the black leaf nodes in the abnormal decision tree shown, and nodes 71, 73, and 74 can be determined as target leaf nodes.

[0171] Assume that the abnormal condition is that the level of the target leaf node is greater than or equal to half the depth of the abnormal decision tree, and the number of first initial samples in the subspace corresponding to the target leaf node is relatively small, the number of first initial samples in the subspace corresponding to node 71 is 95, the number of first initial samples in the subspace corresponding to node 73 is 2, and the number of first initial samples in the subspace corresponding to node 74 is 3.

[0172] For node 71, its level is 2, which is less than half of the depth of the abnormal decision tree (depth is 5), and the number of the first initial samples corresponding to node 71 is relatively large (accounting for 95% of the total number of the first initial samples), which does not meet the abnormal condition. It can be considered that the sample category represented by node 71 is a normal category, and the first initial sample in the subspace corresponding to node 71 is a normal sample;

[0173] For node 73, its level is 4, which is greater than half the depth of the abnormal decision tree, and the number of the first initial samples corresponding to node 73 is relatively small (accounting for 2% of the total number of the first initial samples), which meets the abnormal condition. It can be considered that the sample category represented by node 73 is the abnormal category, and the first initial sample in the subspace corresponding to node 73 is the initial abnormal sample;

[0174] For node 74, its level is 5, which is greater than half of the depth of the abnormal decision tree, and the number of first initial samples corresponding to node 74 is relatively small (accounting for 3% of the total number of first initial samples), which meets the abnormal condition. It can be considered that the sample category represented by node 74 is an abnormal category, and the first initial sample in the subspace corresponding to node 74 is an initial abnormal sample.

[0175] For the anomaly categories represented by nodes 73 and 74, their anomaly causes can be determined based on the decision conditions on the decision paths from the root node of the anomaly decision tree to nodes 73 and 74, respectively. Table 1 shows the explainable anomaly causes corresponding to the anomaly categories.

[0176] Table 1 Explainable anomaly causes corresponding to anomaly categories

[0177] Indicates the exception category The number of initial abnormal samples Explainable causes of anomalies I (node ​​73) 2 A1, A2, A3 II (node ​​74) 3 A1, A2, A3, A4

[0178] Figure 7b FIG. 1 shows a schematic diagram of an abnormal decision tree according to an embodiment of the present application. Figure 7b As shown, the abnormal decision tree includes five decision conditions: B1, B2, B3, B4, and B5, and six leaf nodes, namely, node 711, node 712, node 713, node 714, node 715, and node 716. Figure 7b There is no first initial sample (i.e., no real sample) in the subspace corresponding to the white leaf nodes in the abnormal decision tree shown in FIG. 71 , and there is no first initial sample (i.e., no real sample) in the subspace corresponding to nodes 711, 713, 714, and 715 ( Figure 7b There is a first initial sample (ie, a real sample) in the subspace corresponding to the black leaf nodes in the abnormal decision tree shown, and nodes 711, 713, 714, and 715 can be determined as target leaf nodes.

[0179] Assuming that the abnormal condition is that the number of first initial samples in the subspace corresponding to the target leaf node is relatively small, the number of first initial samples in the subspace corresponding to node 711 is 85, the number of first initial samples in the subspace corresponding to node 713 is 3, the number of first initial samples in the subspace corresponding to node 711 is 5, and the number of first initial samples in the subspace corresponding to node 711 is 7.

[0180] For node 711, the number of first initial samples corresponding to node 711 is relatively large (accounting for 85% of the total number of first initial samples), which does not meet the abnormal condition. It can be considered that the sample category represented by node 711 is a normal category, and the first initial sample in the subspace corresponding to node 711 is a normal sample;

[0181] For node 713, the number of the first initial samples corresponding to node 713 is relatively small (accounting for 3% of the total number of the first initial samples), which meets the abnormal condition. It can be considered that the sample category represented by node 713 is an abnormal category, and the first initial sample in the subspace corresponding to node 713 is an initial abnormal sample;

[0182] For node 714, the number of the first initial samples corresponding to node 714 is relatively small (accounting for 5% of the total number of the first initial samples), which meets the abnormal condition. It can be considered that the sample category represented by node 714 is an abnormal category, and the first initial sample in the subspace corresponding to node 714 is an initial abnormal sample;

[0183] For node 715, the number of first initial samples corresponding to node 715 is relatively small (accounting for 7% of the total number of first initial samples), which meets the abnormal condition. It can be considered that the sample category represented by node 715 is an abnormal category, and the first initial sample in the subspace corresponding to node 715 is an initial abnormal sample.

[0184] For the anomaly categories represented by nodes 713, 714, and 715, their anomaly causes can be determined based on the decision conditions on the decision paths from the root node of the decision tree to nodes 713, 714, and 715, respectively. Table 2 shows the explainable anomaly causes corresponding to the anomaly categories.

[0185] Table 2 Explainable anomaly causes corresponding to anomaly categories

[0186] Indicates the exception category The number of initial abnormal samples Explainable causes of anomalies III (Node 713) 3 B1, B2, B3 IV (node ​​714) 5 B1, B2, B3, B4 V (node ​​715) 7 B1, B2, B3, B4, B5

[0187] According to the above example, although there are multiple initial abnormal samples, they are still a minority compared to normal samples. In other words, the multiple initial abnormal samples corresponding to each health reminder determined from the first training set are a small number of abnormal samples.

[0188] By selecting a target leaf node including at least one first initial sample from multiple leaf nodes in the abnormal decision tree, and judging whether the sample category represented by each target leaf node is an abnormal category based on the abnormal condition, multiple abnormal categories and initial abnormal samples corresponding to each abnormal category are determined, and the abnormal cause corresponding to each abnormal category is determined through the decision path in the abnormal decision tree. This is simple and fast, which can not only improve processing efficiency but also improve the explainability of the abnormal cause.

[0189] In one possible implementation, the associated features of the health reminder corresponding to the abnormal decision tree can be adjusted multiple times based on the analysis results of the abnormal decision tree, including the abnormal category, abnormal cause, etc., to improve the accuracy of the associated features and thereby improve the accuracy of the abnormal decision tree.

[0190] In one possible implementation, after obtaining an anomaly decision tree, multiple anomaly categories, and explainable anomaly causes, the anomaly decision tree can be expert-pruned to improve the accuracy of each anomaly category. Based on the number of initial anomaly samples corresponding to each anomaly category and the explainable anomaly causes, experts can quickly and repeatedly adjust and explore the combination of associated features in the correlation feature selection phase, ultimately determining which branches of the anomaly decision tree to remove and assigning the first initial sample in the subspace corresponding to the leaf node to the node above it. This results in a small number of reliable anomaly categories, as well as initial anomaly samples and anomaly causes corresponding to each anomaly category.

[0191] By establishing an abnormality decision tree for each health reminder, and determining a small number of credible abnormality categories corresponding to each health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category based on each abnormality decision tree, the accuracy of the abnormality categories and initial abnormal samples corresponding to each health reminder and the interpretability of the abnormal causes can be improved.

[0192] In one possible implementation, after determining multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories, and abnormal causes corresponding to each abnormal category in step S301, in step S302, anomaly detection can be performed on the second training set based on the multiple initial abnormal samples corresponding to each health reminder and the multiple abnormal categories to establish a sample set. The second training set includes multiple initial abnormal samples corresponding to each health reminder and multiple unlabeled second initial samples.

[0193] Based on step S301, multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder have been determined. Taking into account the natural diversity of abnormal samples, for example, different situations may lead to the same health reminder. A small number of known multiple initial abnormal samples can be used, and high-dimensional features can be considered through deep learning to obtain a finer-grained sample vector representation, thereby distinguishing more implicit abnormal samples.

[0194] In one possible implementation, step S302 may include: for any health reminder, initializing the vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network to obtain the 0th vector representation of each initial abnormal sample and each second initial sample; according to multiple abnormal categories, performing N iterative updates on the 0th vector representation of each initial abnormal sample and each second initial sample to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, where N is a positive integer and N≥1; clustering the second training set according to the Nth vector representation of each initial abnormal sample and each second initial sample to obtain the vector representation of the normal samples and abnormal samples corresponding to the health reminder, and establishing a sample set according to the vector representation of the normal samples and abnormal samples corresponding to each health reminder.

[0195] The vector representation network can represent the multiple initial abnormal samples and the multiple second initial samples in the second training set as vectors. The vector representation network can be a neural network, such as an autoencoder, that can represent input data as high-dimensional vectors. This application does not limit the specific implementation of the vector representation network.

[0196] In one possible implementation, the second training set can be expressed as m is the total number of samples, among which the first n samples are the labeled initial abnormal samples (that is, abnormal samples with labels), which can be expressed as where x1,…,x n Represents n initial abnormal samples, y1,…,y n Represents the label of each initial abnormal sample, which can be the abnormal category of the initial abnormal sample and the abnormal reason corresponding to the abnormal category. The following (mn) samples are unlabeled second initial samples (i.e., samples without labels), which can be expressed as Among them, x n+1 ,…,x m represents (mn) second initial samples, where m and n are both positive integers, and m>n.

[0197] In one possible implementation, for any health reminder, the full features (i.e., all features) of each initial abnormal sample and each second initial sample in the second training set can be mapped to the high-dimensional vector space Z through a vector representation network to obtain the 0th vector representation of each initial abnormal sample and each second initial sample.

[0198] After determining the 0th vector representation of each initial abnormal sample and each second initial sample in the second training set, the 0th vector representation of each initial abnormal sample and each second initial sample can be iteratively updated N times according to multiple abnormality categories to obtain the Nth vector representation of each initial abnormal sample and each second initial sample.

[0199] For the i-th (1≤i≤N) iteration, the multiple initial abnormal samples can be clustered according to the number of multiple abnormal categories and the i-1-th vector representation of each initial abnormal sample. For example, clustering is performed by the K-means clustering algorithm (K-means for short), where K is the number of abnormal categories. The i-th cluster center of each abnormal category is obtained, and the labels of the initial abnormal samples are updated according to the clustering results.

[0200] At the same time, the i-th sampling probability of each second initial sample can be determined according to the i-1-th vector representation of each second initial sample.

[0201] Since multiple second initial samples are unlabeled samples, it is impossible to determine whether multiple features in the global feature library are related to anomaly detection. When determining the i-th sampling probability of each second initial sample, the i-1th vector representation of each second initial sample can be used to calculate the i-th isolation score of each second initial sample through the nearest neighbor-based isolation ensemble algorithm (Isolation Using Nearest Neighbor Ensembles, abbreviated as iNNe), and the i-th isolation score of each second initial sample is determined as its i-th anomaly confidence. The higher the isolation score of the second initial sample, the higher the probability that the second initial sample is an anomaly sample. This can be used as a benchmark to distinguish high-confidence and low-confidence samples. Afterwards, the i-th sampling probability of each second initial sample can be determined based on the i-th anomaly confidence of each second initial sample. In this way, the accuracy of the i-th sampling probability of each second initial sample can be improved.

[0202] In a possible implementation, the i-th sampling probability P of any second initial sample can be determined by the following formula (1): sampling :

[0203]

[0204] In formula (1), max x IS(x) represents the maximum value of the i-th abnormal confidence of multiple second initial samples, min x IS(x) represents the minimum value of the i-th abnormality confidence of multiple second initial samples, and IS(x) represents the i-th abnormality confidence of any second initial sample.

[0205] After determining the i-th sampling probability of each second initial sample, multiple positive samples and multiple negative samples for the i-th iteration can be determined from the multiple second initial samples based on the i-th sampling probability of each second initial sample. The number of positive samples is the same as the number of negative samples, i.e., the ratio of positive samples to negative samples is 1:1, and the positive samples and negative samples correspond one to one.

[0206] When selecting positive samples, P sampling The larger the value, the more likely the second initial sample with low abnormal confidence (most likely a normal sample) is to be selected; when selecting negative samples, the P sampling Take the inverse and get -P sampling , -P sampling The larger the value is, the more likely the second initial sample with high abnormal confidence (high probability abnormal sample) is to be selected.

[0207] Then, the i-th vector representation loss can be determined based on the i-th cluster center of each abnormal category and multiple positive samples and multiple negative samples at the i-th iteration through the positive and negative sample pair learning method. In one possible implementation, the i-th vector representation loss L can be determined by the following formula (2): i :

[0208] L i =-log(σ(score +ve -score -ve )) (2)

[0209] In formula (2), Among them, pos x Represents the vector representation of any positive sample at the i-th iteration, The average vector representation of the i-th vector representation of multiple initial abnormal samples; Among them, negx represents the vector representation of the negative sample corresponding to the above positive sample, represents the i-th cluster center of the j-th abnormal category, and σ represents the learning rate, which is a fixed parameter.

[0210] Based on the i-th vector representation loss, the i-1th vector representation of each initial anomaly sample and each second initial sample can be adjusted to obtain the i-th vector representation of each initial anomaly sample and each second initial sample. The i-th vector representation of each initial anomaly sample and each second initial sample can be used for the next (i+1th) iteration. The learning objectives of the vector representation can be: from a global perspective, the more dissimilar the normal samples are to the known initial anomaly samples, the better; from a local perspective, the more similar the anomaly samples are to the closest anomaly class, the better.

[0211] In one possible implementation, when i=N, the Nth iteration can be completed to obtain the Nth vector representation of each initial abnormal sample and each second initial sample. The specific value of N can be preset or set based on the convergence of the loss. This application does not impose any restrictions on this.

[0212] By adjusting the vector representation through paired learning of positive and negative samples, not only the learning speed can be improved, but also the accuracy of the vector representation can be improved.

[0213] In one possible implementation, after obtaining the Nth vector representation of each initial abnormal sample and each second initial sample, the second training set can be clustered according to the Nth vector representation of each initial abnormal sample and each second initial sample. For example, K-means clustering is performed on the second training set, where K=2, to obtain vector representations of normal samples and abnormal samples corresponding to the health reminder.

[0214] Through the above method, after determining the vector representation of normal samples and abnormal samples corresponding to each health reminder, a sample set can be established based on the vector representation of normal samples and abnormal samples corresponding to each health reminder, so that the sample set includes the vector representation of normal samples and abnormal samples of multiple health reminders.

[0215] For any health reminder, after determining the 0th vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network, the vector representation can be iteratively updated N times to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, and the second training set is clustered according to the Nth vector representation of each initial abnormal sample and each second initial sample to obtain the vector representation of the normal samples and abnormal samples corresponding to the health reminder. According to the vector representation of the normal samples and abnormal samples corresponding to each health reminder, a sample set is established, so that the limited initial abnormal samples and multiple abnormal categories corresponding to each health reminder can be utilized, and through iterative updates, the learning of normal samples and abnormal samples in the unknown multiple second initial samples can be accelerated, and then a sample set is established. This not only increases the diversity of abnormal samples, helps to discover more inconspicuous abnormalities, and improves the accuracy of the sample set, but also improves the accuracy of the vector representation of normal samples and abnormal samples.

[0216] Figure 8 FIG. 1 is a schematic diagram showing a process of establishing a sample set according to an embodiment of the present application. Figure 8As shown, the second training set 81 includes multiple initial abnormal samples 811 and multiple unlabeled second initial samples 812. When establishing the sample set, for any health reminder, the second training set 81 can be input into the autoencoder 82 (i.e., the vector representation network) for vector representation to obtain a first vector table 83. The first vector table 83 includes the 0th vector representation of the multiple initial abnormal samples and the 0th vector representation of the multiple second initial samples.

[0217] Then, based on the 0th vector representation of each initial abnormal sample and the multiple abnormal categories in the first vector table 83, each abnormal sample can be clustered 84 to obtain a second vector table 85. The second vector table 85 includes the first cluster center of each abnormal category and the 0th vector representation of each initial abnormal sample after label update.

[0218] According to the 0th vector representation of each second initial sample in the first vector table 83, the first abnormality confidence 87 of each second initial sample can be obtained by the iNNe algorithm 86;

[0219] Based on the first abnormality confidence 87 of each second initial sample, sampling processing 88 can be performed on the plurality of second initial samples 812 to select a plurality of positive samples 881 and a plurality of negative samples 882. Paired learning 89 can be performed based on the plurality of positive samples 881, the plurality of negative samples 882, and the second vector table 85 to obtain a first vector representation loss.

[0220] According to the loss of the first vector representation, the 0th vector representation of each initial abnormal sample and each second initial sample in the first vector table 83 can be adjusted to obtain an adjusted third vector table 90, which includes the 1st vector representation of each initial abnormal sample and each second initial sample, and the content of the third vector table 90 is used to update the content in the first vector table 83.

[0221] Then, multiple iterations are performed on the first vector table 83 in a manner similar to the first iteration described above. After the iterations are completed, the third vector table 90 generated by the last iteration is subjected to K-means clustering 91, where K = 2, to obtain vector representations of normal samples and abnormal samples corresponding to the health reminder.

[0222] After determining the vector representations of the normal samples and abnormal samples corresponding to each health reminder in the above manner, a sample set 92 may be established based on the vector representations of the normal samples and abnormal samples corresponding to each health reminder.

[0223] In one possible implementation, the process of establishing a sample set can be referred to as a deep clustering-based anomaly detection framework. This framework can consider high-dimensional features and the diversity of anomaly samples during processing, effectively utilizing a limited number of known anomaly samples and known anomaly categories. It accelerates learning of samples similar to these known anomaly samples and known anomaly categories, helping to discover more subtle anomalies and thereby improving the accuracy of anomaly detection.

[0224] Figure 9a FIG. 1 shows a schematic diagram of a second training set according to an embodiment of the present application. Figure 9a As shown, in the second training set, the samples in sample cluster 93, sample cluster 94, and sample cluster 95 are all known abnormal samples (i.e., initial abnormal samples), represented by small black dots, and the other samples (including sample 96, sample 97, sample 98, and sample 99) are all unknown samples (i.e., unlabeled second initial samples), represented by small hollow dots.

[0225] Figure 9b FIG. 1 is a schematic diagram showing a sample set according to an embodiment of the present application. Figure 9b As shown in the figure, after deep clustering of the second training set, sample 96 and sample 99 have a high similarity with sample cluster 93, and sample 96 and sample 99 are marked as known abnormal samples; sample 97 has a high similarity with sample cluster 94, and sample 97 can be marked as a known abnormal sample; sample 98 has a high similarity with sample cluster 95, and sample 98 can be marked as a known abnormal sample, and the remaining samples are marked as known normal samples, represented by small black squares.

[0226] In one possible implementation, after the sample set is established according to step S302, the user information sent by the terminal device can be detected for abnormalities through steps S310, S320, and S330. When there is an abnormality in the user information, the target health reminder corresponding to the user information is determined, and then the target health reminder and the abnormal reason corresponding to the target health reminder are sent to the terminal device, so that the terminal device can remind the user according to the target health reminder and the abnormal reason. The specific processing process is the same as Figure 3 The processing in the illustrated embodiment is similar and will not be described again here.

[0227] In this embodiment, the cloud server can perform anomaly exploration on a preset first training set (including multiple unlabeled first initial samples) based on multiple preset health reminders and the associated features of each health reminder, determine multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories and abnormal causes corresponding to each abnormal category, and perform anomaly detection on the second training set based on the multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder to establish a sample set. Then, based on the sample set, anomaly detection is performed on the user information received from the terminal device. Therefore, through anomaly exploration, a small number of credible abnormal samples, multiple abnormal categories and explainable abnormal causes corresponding to each abnormal category can be automatically identified from the first training set, saving manual labeling time, and making full use of the identified abnormal samples and multiple abnormal categories. At the same time, considering high-dimensional features, a sample set is established through vector representation and deep clustering, which can improve the accuracy of the vector representation of each normal sample and each abnormal sample in the sample set, as well as the diversity of abnormal samples, thereby performing higher-dimensional and more accurate anomaly detection, providing users with more intelligent health reminders.

[0228] In one possible implementation, when the anomaly detection method of the present application is applied to a cloud server, the sample set used for anomaly detection can be updated according to preset update conditions. The sample set can be updated based on personal historical data. For example, when the collection of personal historical data reaches a specified level (continuously collected within a specified time range), the cloud server can update the sample set according to the above method. The sample set can also be updated based on the data of multiple different users. For example, when the amount of data from a large number of different users or different user groups (for example, different groups are divided according to the basic personal information entered by the user in the initialization phase) reaches a specified level (fixed-point collection within a time interval), the cloud server can update the sample set according to the above method. By continuously updating the sample set, not only the accuracy of the sample set can be improved, but also the accuracy of anomaly detection can be improved.

[0229] Figure 10 FIG. 1 is a flow chart showing an abnormality detection method according to an embodiment of the present application. Figure 10 As shown, the anomaly detection method is applied to a terminal device, and the method includes:

[0230] Step S1010: Obtain user information and send the user information to a cloud server, so that the cloud server determines a target health reminder and an abnormality cause corresponding to the target health reminder based on a preset sample set and the user information.

[0231] Among them, user information may include the user's basic information and the user's health data and environmental data collected by the terminal device. The user's basic information may include the user's height, weight, gender, etc. The user's health data may include physiological data such as the user's heart rate, blood pressure, blood oxygen, body temperature, sleep status, exercise status, etc., which can be collected through sensors. The user's environmental data may include data such as the air pressure, temperature, location, time, etc. of the external environment in which the user is located, which can be collected through sensors. It should be understood that those skilled in the art can determine the specific content of the user information according to actual circumstances, and this application does not limit this.

[0232] The terminal device can send the acquired user information to the cloud server according to a preset time interval (for example, 10 minutes), so that the cloud server can determine whether there is any abnormality in the user information based on a preset sample set. If there is an abnormality in the user information, the cloud server can determine the target health reminder corresponding to the user information and the cause of the abnormality corresponding to the target reminder.

[0233] In a possible implementation, step S1010 may include: obtaining user information, and desensitizing the user information to obtain desensitized user information; and sending the desensitized user information to a cloud server.

[0234] In other words, after obtaining user information, the terminal device can desensitize sensitive data involving personal privacy in the user information through methods such as value / string replacement, invalidation, randomization, and masking, obtaining the desensitized user information and then sending the desensitized user information to the cloud server. In this way, the security of user information can be improved.

[0235] Step S1020, receiving the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, and reminding the user according to the target health reminder and the abnormal reason.

[0236] That is to say, after the terminal device receives the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, it can remind the user according to the target health reminder and the abnormal reason so that the user can understand his or her health status in time.

[0237] According to an embodiment of the present application, the terminal device can obtain user information including user basic information, environmental data and health data, and send the user to the cloud server for abnormality detection. When the cloud server detects an abnormality, it can send a target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device. After the terminal device receives the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, it can remind the user according to the target health reminder and the abnormal reason, so that the user can be given a health reminder through end-cloud collaborative decision-making, which can not only improve processing efficiency, but also improve the accuracy of health reminders and abnormal reasons.

[0238] The embodiments of this application can be applied to the field of terminal artificial intelligence, specifically the sub-field of terminal-cloud collaboration. Its specific application scenario is any smart wearable device paired with a cloud server, including but not limited to smart bracelets, smart watches, and other terminal devices. When a user uses a smart wearable device, the terminal device can obtain the user's personal information and surrounding environment data, and through anomaly detection on the cloud server, provide intelligent real-time alerts for any abnormal situations.

[0239] When using smart wearable devices, users can also customize reminders according to actual needs and send them to the cloud server after authorization. The cloud server can find the relevant features of the customized reminders and automatically identify abnormal samples through methods such as anomaly exploration and expert decision-making. After establishing a sample set through vector representation training, customized reminders can be added to the smart wearable device.

[0240] In one possible implementation, users can also use their terminal devices to independently select health indicators of concern, such as blood pressure and heart rate, and send them to the cloud server. The cloud server can then perform anomaly detection on the selected health indicators and send the detection results to the terminal device at a preset period so that the user can view them through the terminal device. For example, the cloud server can monitor blood pressure based on the user's selection and send the monitoring results to the client. The monitoring results may include blood pressure values ​​and blood pressure status (too high, too low, normal, etc.). Users can also independently select monitoring times, for example, different time periods each day: 6:00-12:00, 12:00-18:00, 18:00-24:00, etc.

[0241] In one possible implementation, users can also use their terminal devices to check whether their selected health indicators are abnormal within a group. The cloud service can use clustering to determine the group to which the user belongs and, based on the distribution of the user's health indicator values ​​within the group, determine whether the user's health indicator is abnormal within the group.

[0242] In one possible implementation, the embodiments of the present application may be applicable to scenarios including but not limited to smart reminders, application information push, application recommendations, etc.

[0243] Compared to the prior art, the embodiments of the present application can not only reduce manual / rule intervention (i.e., the embodiments of the present application do not need to rely on manually set threshold ranges and a large amount of long-term expert input, and can automatically identify abnormal samples), automatically learn abnormal samples, abnormal categories, and explainable abnormal causes, but also consider multi-dimensional features to build more complex intelligent reminders. Because there is no single threshold limit, the embodiments of the present application can combine machine learning and deep learning, can effectively consider multi-dimensional features, and are not limited to single-dimensional reminders, making it possible to customize intelligent reminders according to user needs.

[0244] Figure 11 FIG. 1 is a block diagram of an abnormality detection device according to an embodiment of the present application. Figure 11 As shown, the device is applied to a cloud server, and the device includes:

[0245] Anomaly determination module 1110 is configured to, upon receiving user information sent by a terminal device, determine whether the user information contains an anomaly based on a preset sample set, wherein the user information includes basic user information and health data and environmental data of the user collected by the terminal device, and the sample set includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders;

[0246] a reminder determination module 1120, configured to determine, when an abnormality exists in the user information, a target health reminder corresponding to the user information based on the sample set;

[0247] The second communication module 1130 is used to send the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal reason.

[0248] In a possible implementation, the apparatus further includes:

[0249] an anomaly exploration module, configured to perform anomaly exploration on a preset first training set based on a plurality of preset health reminders and associated features of each health reminder, and determine a plurality of initial anomaly samples corresponding to each health reminder, a plurality of anomaly categories, and an anomaly cause corresponding to each anomaly category, wherein the first training set includes a plurality of unlabeled first initial samples;

[0250] The anomaly detection module is used to perform anomaly detection on the second training set based on multiple initial anomaly samples and multiple anomaly categories corresponding to each health reminder, and establish a sample set. The second training set includes multiple initial anomaly samples corresponding to each health reminder and multiple unlabeled second initial samples.

[0251] In a possible implementation, the anomaly exploration module includes:

[0252] A decision tree establishment submodule, for any health reminder, establishes an abnormal decision tree based on the associated features of the health reminder and a preset first training set;

[0253] The abnormality category determination submodule is used to determine multiple abnormality categories corresponding to the health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category according to the abnormality decision tree.

[0254] In one possible implementation, the decision tree establishment submodule is configured to: establish a feature space based on the associated features of the health reminder and a preset first training set; evenly add multiple virtual samples to the feature space based on the number of first initial samples in the first training set; determine multiple division methods of the subspace of the feature space based on the density of the first initial samples in different areas of the feature space; for any division method, under the division method, determine the information gain of each associated feature based on the number of first initial samples and the number of virtual samples in each subspace of the feature space, and determine the information gain of the division method based on the information gain of each associated feature; determine the division method with the largest information gain among the multiple division methods as the target division method; divide the feature space into multiple subspaces based on the target division method; use each associated feature as a decision condition, and establish an abnormal decision tree based on the information gain of each associated feature under the target division method, wherein each leaf node of the abnormal decision tree corresponds to a subspace in the feature space.

[0255] In one possible implementation, the abnormal category determination submodule is configured to: select at least one target leaf node from multiple leaf nodes of the abnormal decision tree based on the number of first initial samples in each subspace, wherein there is at least one first initial sample in the subspace corresponding to the target leaf node; determine whether the sample category represented by each target leaf node is an abnormal category based on the abnormal condition, and the abnormal condition is determined based on at least one of the number of first initial samples in the subspace corresponding to the target leaf node, the hierarchy of the target leaf node, and the decision path from the root node to the target leaf node; when the sample category represented by the target leaf node is an abnormal category, determine the first initial sample in the subspace corresponding to the target leaf node as the initial abnormal sample corresponding to the abnormal category; and determine the decision condition on the decision path from the root node of the abnormal decision tree to the target leaf node as the abnormal cause corresponding to the abnormal category.

[0256] In one possible implementation, the anomaly detection module includes: a vector representation submodule, which, for any health reminder, initializes the vector representation of each initial abnormal sample and each second initial sample in the second training set through a vector representation network to obtain the 0th vector representation of each initial abnormal sample and each second initial sample; an iteration submodule, which is used to iteratively update the 0th vector representation of each initial abnormal sample and each second initial sample N times according to multiple abnormal categories to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, where N is a positive integer and N≥1; a clustering submodule, which is used to cluster the second training set according to the Nth vector representation of each initial abnormal sample and each second initial sample to obtain the vector representation of the normal samples and abnormal samples corresponding to the health reminder; and a sample set establishment submodule, which is used to establish a sample set according to the vector representation of the normal samples and abnormal samples corresponding to each health reminder.

[0257] In one possible implementation, the iterative submodule is configured to: for the i-th iteration, cluster the multiple initial abnormal samples according to the number of multiple abnormal categories and the i-1th vector representation of each initial abnormal sample to obtain the i-th cluster center of each abnormal category, where i is a positive integer and 1≤i≤N; determine the i-th sampling probability of each second initial sample according to the i-1th vector representation of each second initial sample; determine multiple positive samples and multiple negative samples at the i-th iteration from the multiple second initial samples according to the i-th sampling probability of each second initial sample; determine the i-th vector representation loss according to the i-th cluster center of each abnormal category and the multiple positive samples and multiple negative samples at the i-th iteration; adjust the i-1th vector representation of each initial abnormal sample and each second initial sample according to the i-th vector representation loss to obtain the i-th vector representation of each initial abnormal sample and each second initial sample; and when i=N, obtain the N-th vector representation of each initial abnormal sample and each second initial sample.

[0258] In one possible implementation, determining the i-th sampling probability of each second initial sample based on the i-1-th vector representation of each second initial sample includes: determining the i-th anomaly confidence of each second initial sample based on the i-1-th vector representation of each second initial sample; and determining the i-th sampling probability of each second initial sample based on the i-th anomaly confidence of each second initial sample.

[0259] In one possible implementation, the abnormality judgment module includes: a first vector determination submodule, used to determine a first vector, a second vector and a third vector respectively based on the user information and the sample set, wherein the first vector is a vector representation of the user information, the second vector is an average vector representation of all normal samples in the sample set, and the third vector is an average vector representation of all abnormal samples in the sample set; a first similarity determination submodule, used to determine a first similarity between the first vector and the second vector, and a second similarity between the first vector and the third vector; and an abnormality determination submodule, used to determine that there is an abnormality in the user information when the first similarity is less than the second similarity.

[0260] In one possible implementation, the reminder determination module includes: a second similarity determination submodule, which, for any health reminder, determines the third similarity between the first vector and the fourth vector, and the fourth similarity between the first vector and the fifth vector, respectively, where the fourth vector is the average vector representation of the normal samples corresponding to the health reminder in the sample set, and the fifth vector is the average vector representation of the abnormal samples corresponding to the health reminder in the sample set; and a reminder determination submodule, which is used to determine the health reminder as the target health reminder corresponding to the user information when the third similarity is less than the fourth similarity.

[0261] In one possible implementation, the second communication module includes: a communication sub-module, which is used to send the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device when the number of abnormalities in the user information within a preset time period is greater than or equal to a preset abnormality threshold.

[0262] In a possible implementation, the terminal device includes a smart wearable device, and the multiple health reminders include multiple ones of a fatigue reminder, a sleep reminder, a stress reminder, and a hunger reminder.

[0263] Figure 12 FIG. 1 is a block diagram of an abnormality detection device according to an embodiment of the present application. Figure 12 As shown, the device is applied to a terminal device, and the device includes:

[0264] The first communication module 1210 is configured to obtain user information and send the user information to a cloud server so that the cloud server can determine a health reminder and an abnormality cause corresponding to the target health reminder based on a preset sample set and the user information target. The user information includes basic user information and health data and environmental data of the user collected by the terminal device.

[0265] The reminder module 1220 is used to receive the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, and remind the user according to the target health reminder and the abnormal reason.

[0266] In one possible implementation, the first communication module includes: a desensitizing submodule for acquiring user information and performing desensitizing processing on the user information to obtain desensitized user information; and an information sending submodule for sending the desensitized user information to a cloud server.

[0267] An embodiment of the present application provides an anomaly detection device, comprising: a processor and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions.

[0268] An embodiment of the present application provides a terminal device that can execute the above-mentioned anomaly detection method.

[0269] An embodiment of the present application provides a non-volatile computer-readable storage medium having computer program instructions stored thereon, wherein the computer program instructions implement the above method when executed by a processor.

[0270] An embodiment of the present application provides a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of an electronic device, the processor in the electronic device executes the above method.

[0271] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disc (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination thereof.

[0272] The computer-readable program instructions or codes described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0273] The computer program instructions for performing the operations of the present application may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, by utilizing the state information of computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field-programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit can execute the computer-readable program instructions, thereby implementing various aspects of the present application.

[0274] Various aspects of the present application are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present application. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0275] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0276] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0277] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, systems, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a part for a module, program segment or instruction, and the part for the module, program segment or instruction comprises one or more executable instructions for realizing the logical function of the specification. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous boxes can actually be performed substantially in parallel, and they can sometimes also be performed in the opposite order, depending on the function involved.

[0278] It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart, can be implemented by hardware that performs the corresponding function or action (such as a circuit or ASIC (Application Specific Integrated Circuit)), or can be implemented by a combination of hardware and software, such as firmware.

[0279] Although the present invention is described herein in conjunction with various embodiments, in the process of implementing the claimed invention, those skilled in the art can understand and implement other variations of the disclosed embodiments by reviewing the drawings, the disclosure, and the appended claims. In the claims, the word "comprising" does not exclude other components or steps, and "a" or "an" does not exclude multiple situations. A single processor or other unit can implement several functions listed in the claims. Certain measures are recorded in different dependent claims, but this does not mean that these measures cannot be combined to produce good results.

[0280] The embodiments of the present application have been described above. The above description is illustrative and not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting anomalies, characterized in that: The method is applied to a cloud server and includes: Upon receiving user information sent by a terminal device, determining whether the user information contains any abnormalities based on a preset sample set, wherein the user information includes basic user information and health and environmental data of the user collected by the terminal device, and the sample set includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders; When there is an abnormality in the user information, determining a target health reminder corresponding to the user information based on the sample set; Sending the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal reason; The method further comprises: Based on a plurality of preset health reminders and associated features of each health reminder, performing anomaly exploration on a preset first training set to determine a plurality of initial abnormal samples corresponding to each health reminder, a plurality of abnormal categories, and abnormal causes corresponding to each abnormal category, wherein the first training set includes a plurality of unlabeled first initial samples; Based on multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder, abnormality detection is performed on the second training set to establish a sample set. The second training set includes multiple initial abnormal samples corresponding to each health reminder and multiple unlabeled second initial samples.

2. The method according to claim 1, characterized in that The method includes performing abnormal exploration on a preset first training set based on the preset multiple health reminders and the associated features of each health reminder, determining multiple initial abnormal samples corresponding to each health reminder, multiple abnormal categories, and abnormal causes corresponding to each abnormal category, including: For any health reminder, establish an abnormal decision tree based on the associated features of the health reminder and a preset first training set; According to the abnormal decision tree, multiple abnormal categories corresponding to the health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category are determined.

3. The method according to claim 2, characterized in that The step of establishing an abnormality decision tree based on the associated features of the health reminder and a preset first training set includes: Establishing a feature space based on the associated features of the health reminder and a preset first training set; According to the number of first initial samples in the first training set, a plurality of virtual samples are added in a balanced manner in the feature space; determining multiple ways of dividing the subspace of the feature space according to the densities of the first initial samples in different regions of the feature space; For any partitioning method, under the partitioning method, the information gain of each associated feature is determined according to the number of first initial samples and the number of virtual samples in each subspace of the feature space, and the information gain of the partitioning method is determined according to the information gain of each associated feature; Determining the partitioning method with the largest information gain among the multiple partitioning methods as the target partitioning method; Dividing the feature space into multiple subspaces according to the target division method; Each associated feature is used as a decision condition, and an abnormal decision tree is established according to the information gain of each associated feature under the target partitioning method. Each leaf node of the abnormal decision tree corresponds to a subspace in the feature space.

4. The method according to claim 3, characterized in that Determining, according to the abnormality decision tree, a plurality of abnormality categories corresponding to the health reminder, and initial abnormal samples and abnormal causes corresponding to each abnormality category, includes: Selecting at least one target leaf node from the plurality of leaf nodes of the abnormal decision tree according to the number of first initial samples in each subspace, wherein at least one first initial sample exists in the subspace corresponding to the target leaf node; Determine, based on an abnormal condition, whether the sample category represented by each target leaf node is an abnormal category, wherein the abnormal condition is determined based on at least one of the number of first initial samples in the subspace corresponding to the target leaf node, the hierarchy of the target leaf node, and a decision path from the root node to the target leaf node; When the sample category represented by the target leaf node is an abnormal category, determining the first initial sample in the subspace corresponding to the target leaf node as the initial abnormal sample corresponding to the abnormal category; The decision condition on the decision path from the root node of the abnormal decision tree to the target leaf node is determined as the abnormal cause corresponding to the abnormal category.

5. The method according to claim 1, wherein The method of performing anomaly detection on the second training set based on the multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder to establish a sample set includes: For any health reminder, initialize the vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network to obtain the 0th vector representation of each initial abnormal sample and each second initial sample; According to the multiple anomaly categories, performing N iterative updates on the 0th vector representation of each initial anomaly sample and each second initial sample to obtain the Nth vector representation of each initial anomaly sample and each second initial sample, where N is a positive integer and N ≥ 1; Clustering the second training set according to the Nth vector representation of each initial abnormal sample and each second initial sample to obtain vector representations of normal samples and abnormal samples corresponding to the health reminder; A sample set is established based on the vector representation of normal samples and abnormal samples corresponding to each health reminder.

6. The method according to claim 5, characterized in that The method of performing N iterative updates on the 0th vector representation of each initial abnormal sample and each second initial sample according to the multiple abnormality categories to obtain the Nth vector representation of each initial abnormal sample and each second initial sample includes: For the i-th iteration, cluster the multiple initial abnormal samples according to the number of multiple abnormal categories and the i-1-th vector representation of each initial abnormal sample to obtain the i-th cluster center of each abnormal category, where i is a positive integer and 1≤i≤N; Determine the i-th sampling probability of each second initial sample according to the i-1-th vector representation of each second initial sample; Determine, from the plurality of second initial samples, a plurality of positive samples and a plurality of negative samples at the i-th iteration according to the i-th sampling probability of each second initial sample; Determine the i-th vector representation loss based on the i-th cluster center of each abnormal category and multiple positive samples and multiple negative samples at the i-th iteration; Adjusting the (i-1)th vector representation of each initial abnormal sample and each second initial sample according to the (i)th vector representation loss to obtain the (i)th vector representation of each initial abnormal sample and each second initial sample; When i=N, the Nth vector representation of each initial abnormal sample and each second initial sample is obtained.

7. The method according to claim 6, characterized in that Determining the i-th sampling probability of each second initial sample according to the i-1-th vector representation of each second initial sample includes: Determine the i-th abnormality confidence of each second initial sample according to the i-1-th vector representation of each second initial sample; The i-th sampling probability of each second initial sample is determined according to the i-th abnormality confidence of each second initial sample.

8. The method according to claim 1, characterized in that The determining, based on a preset sample set, whether the user information is abnormal includes: Determine, according to the user information and the sample set, a first vector, a second vector, and a third vector, respectively, where the first vector is a vector representation of the user information, the second vector is an average vector representation of all normal samples in the sample set, and the third vector is an average vector representation of all abnormal samples in the sample set; respectively determining a first similarity between the first vector and the second vector, and a second similarity between the first vector and the third vector; When the first similarity is smaller than the second similarity, it is determined that an abnormality exists in the user information.

9. The method according to claim 8, characterized in that Determining a target health reminder corresponding to the user information based on the sample set includes: For any health reminder, determining a third similarity between the first vector and a fourth vector, and a fourth similarity between the first vector and a fifth vector, respectively, where the fourth vector is an average vector representation of normal samples in the sample set corresponding to the health reminder, and the fifth vector is an average vector representation of abnormal samples in the sample set corresponding to the health reminder; When the third similarity is smaller than the fourth similarity, the health reminder is determined as a target health reminder corresponding to the user information.

10. The method according to claim 1, characterized in that The sending the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device includes: When the number of abnormalities in the user information within the preset time period is greater than or equal to the preset abnormality threshold, the target health reminder and the abnormal reason corresponding to the target health reminder are sent to the terminal device.

11. The method according to any one of claims 1 to 10, characterized in that The terminal device includes a smart wearable device, and the multiple health reminders include multiple ones of fatigue reminders, sleep reminders, stress reminders, and hunger reminders.

12. A method for detecting anomalies, characterized in that: The method is applied to a terminal device, and the method includes: Obtaining user information and sending the user information to a cloud server, so that the cloud server determines a target health reminder and an abnormality cause corresponding to the target health reminder based on a preset sample set and the user information, wherein the user information includes basic information of the user and health data and environmental data of the user collected by the terminal device; receiving a target health reminder and an abnormality reason corresponding to the target health reminder sent by the cloud server, and reminding the user according to the target health reminder and the abnormality reason; The method further comprises: Based on a plurality of preset health reminders and associated features of each health reminder, performing anomaly exploration on a preset first training set to determine a plurality of initial abnormal samples corresponding to each health reminder, a plurality of abnormal categories, and abnormal causes corresponding to each abnormal category, wherein the first training set includes a plurality of unlabeled first initial samples; Based on multiple initial abnormal samples and multiple abnormal categories corresponding to each health reminder, abnormality detection is performed on the second training set to establish a sample set. The second training set includes multiple initial abnormal samples corresponding to each health reminder and multiple unlabeled second initial samples.

13. The method according to claim 12, characterized in that The obtaining of user information and sending the user information to the cloud server includes: Obtaining user information and performing desensitization processing on the user information to obtain desensitized user information; Send desensitized user information to the cloud server.

14. An abnormality detection device, characterized in that: The device is applied to a cloud server and includes: an abnormality determination module, configured to, upon receiving user information sent by a terminal device, determine whether the user information contains any abnormality based on a preset sample set, wherein the user information includes basic user information and health and environmental data of the user collected by the terminal device, and the sample set includes vector representations of normal samples and abnormal samples corresponding to multiple health reminders; a reminder determination module, configured to determine, when an abnormality exists in the user information, a target health reminder corresponding to the user information based on the sample set; A second communication module is used to send the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device, so that the terminal device reminds the user according to the target health reminder and the abnormal reason; The device further comprises: an anomaly exploration module, configured to perform anomaly exploration on a preset first training set based on a plurality of preset health reminders and associated features of each health reminder, and determine a plurality of initial anomaly samples corresponding to each health reminder, a plurality of anomaly categories, and an anomaly cause corresponding to each anomaly category, wherein the first training set includes a plurality of unlabeled first initial samples; The anomaly detection module is used to perform anomaly detection on the second training set based on multiple initial anomaly samples and multiple anomaly categories corresponding to each health reminder, and establish a sample set. The second training set includes multiple initial anomaly samples corresponding to each health reminder and multiple unlabeled second initial samples.

15. The device according to claim 14, characterized in that The anomaly exploration module includes: A decision tree establishment submodule, for any health reminder, establishes an abnormal decision tree based on the associated features of the health reminder and a preset first training set; The abnormality category determination submodule is used to determine multiple abnormality categories corresponding to the health reminder, as well as initial abnormal samples and abnormal causes corresponding to each abnormal category according to the abnormality decision tree.

16. The device according to claim 15, characterized in that The decision tree establishment submodule is configured as follows: Establishing a feature space based on the associated features of the health reminder and a preset first training set; According to the number of first initial samples in the first training set, a plurality of virtual samples are added in a balanced manner in the feature space; determining multiple ways of dividing the subspace of the feature space according to the densities of the first initial samples in different regions of the feature space; For any partitioning method, under the partitioning method, the information gain of each associated feature is determined according to the number of first initial samples and the number of virtual samples in each subspace of the feature space, and the information gain of the partitioning method is determined according to the information gain of each associated feature; Determining the partitioning method with the largest information gain among the multiple partitioning methods as the target partitioning method; Dividing the feature space into multiple subspaces according to the target division method; Each associated feature is used as a decision condition, and an abnormal decision tree is established according to the information gain of each associated feature under the target division method and the number of first initial samples in each subspace. Each leaf node of the abnormal decision tree corresponds to a subspace in the feature space.

17. The device according to claim 16, characterized in that The abnormality category determination submodule is configured to: Selecting at least one target leaf node from the plurality of leaf nodes of the abnormal decision tree according to the number of first initial samples in each subspace, wherein at least one first initial sample exists in the subspace corresponding to the target leaf node; Determine, based on an abnormal condition, whether the sample category represented by each target leaf node is an abnormal category, wherein the abnormal condition is determined based on at least one of the number of first initial samples in the subspace corresponding to the target leaf node, the hierarchy of the target leaf node, and a decision path from the root node to the target leaf node; When the sample category represented by the target leaf node is an abnormal category, determining the first initial sample in the subspace corresponding to the target leaf node as the initial abnormal sample corresponding to the abnormal category; The decision condition on the decision path from the root node of the abnormal decision tree to the target leaf node is determined as the abnormal cause corresponding to the abnormal category.

18. The device according to claim 14, characterized in that The anomaly detection module includes: The vector representation submodule, for any health reminder, initializes the vector representation of each initial abnormal sample and each second initial sample in the second training set through the vector representation network to obtain the 0th vector representation of each initial abnormal sample and each second initial sample; an iterative submodule, configured to iteratively update the 0th vector representation of each initial abnormal sample and each second initial sample N times according to multiple abnormality categories, to obtain the Nth vector representation of each initial abnormal sample and each second initial sample, where N is a positive integer and N ≥ 1; a clustering submodule, configured to cluster the second training set according to the Nth vector representation of each initial abnormal sample and each second initial sample, to obtain vector representations of normal samples and abnormal samples corresponding to the health reminder; The sample set establishment submodule is used to establish a sample set based on the vector representation of normal samples and abnormal samples corresponding to each health reminder.

19. The device according to claim 18, characterized in that The iterator module is configured as follows: For the i-th iteration, cluster the multiple initial abnormal samples according to the number of multiple abnormal categories and the i-1-th vector representation of each initial abnormal sample to obtain the i-th cluster center of each abnormal category, where i is a positive integer and 1≤i≤N; Determine the i-th sampling probability of each second initial sample according to the i-1-th vector representation of each second initial sample; Determine, from the plurality of second initial samples, a plurality of positive samples and a plurality of negative samples at the i-th iteration according to the i-th sampling probability of each second initial sample; Determine the i-th vector representation loss based on the i-th cluster center of each abnormal category and multiple positive samples and multiple negative samples at the i-th iteration; Adjusting the (i-1)th vector representation of each initial abnormal sample and each second initial sample according to the (i)th vector representation loss to obtain the (i)th vector representation of each initial abnormal sample and each second initial sample; When i=N, the Nth vector representation of each initial abnormal sample and each second initial sample is obtained.

20. The device according to claim 19, characterized in that Determining the i-th sampling probability of each second initial sample according to the i-1-th vector representation of each second initial sample includes: Determine the i-th abnormality confidence of each second initial sample according to the i-1-th vector representation of each second initial sample; The i-th sampling probability of each second initial sample is determined according to the i-th abnormality confidence of each second initial sample.

21. The device according to claim 14, characterized in that The abnormality judgment module includes: A first vector determination submodule, configured to determine a first vector, a second vector, and a third vector, respectively, based on the user information and the sample set, wherein the first vector is a vector representation of the user information, the second vector is an average vector representation of all normal samples in the sample set, and the third vector is an average vector representation of all abnormal samples in the sample set; a first similarity determination submodule, configured to respectively determine a first similarity between the first vector and the second vector, and a second similarity between the first vector and the third vector; The abnormality determination submodule is configured to determine that an abnormality exists in the user information when the first similarity is less than the second similarity.

22. The device according to claim 21, characterized in that The reminder determination module includes: a second similarity determination submodule, for any health reminder, determining a third similarity between the first vector and a fourth vector, and a fourth similarity between the first vector and a fifth vector, respectively, where the fourth vector is an average vector representation of normal samples in the sample set corresponding to the health reminder, and the fifth vector is an average vector representation of abnormal samples in the sample set corresponding to the health reminder; The reminder determination submodule is configured to determine the health reminder as a target health reminder corresponding to the user information when the third similarity is less than the fourth similarity.

23. The device according to claim 14, characterized in that The second communication module includes: The communication submodule is used to send the target health reminder and the abnormal reason corresponding to the target health reminder to the terminal device when the number of abnormalities in the user information within a preset time period is greater than or equal to a preset abnormal number threshold.

24. The device according to any one of claims 14 to 23, characterized in that The terminal device includes a smart wearable device, and the multiple health reminders include multiple ones of fatigue reminders, sleep reminders, stress reminders, and hunger reminders.

25. An abnormality detection device, characterized in that: The device is applied to a terminal device, and includes: a first communication module, configured to obtain user information and send the user information to a cloud server, so that the cloud server determines a target health reminder and an abnormality cause corresponding to the target health reminder based on a preset sample set and the user information, wherein the user information includes basic information of the user and health data and environmental data of the user collected by the terminal device; a reminder module, configured to receive the target health reminder and the abnormal reason corresponding to the target health reminder sent by the cloud server, and remind the user according to the target health reminder and the abnormal reason; The device further comprises: an anomaly exploration module, configured to perform anomaly exploration on a preset first training set based on a plurality of preset health reminders and associated features of each health reminder, and determine a plurality of initial anomaly samples corresponding to each health reminder, a plurality of anomaly categories, and an anomaly cause corresponding to each anomaly category, wherein the first training set includes a plurality of unlabeled first initial samples; The anomaly detection module is used to perform anomaly detection on the second training set based on multiple initial anomaly samples and multiple anomaly categories corresponding to each health reminder, and establish a sample set. The second training set includes multiple initial anomaly samples corresponding to each health reminder and multiple unlabeled second initial samples.

26. The device according to claim 25, characterized in that The first communication module includes: The desensitization submodule is used to obtain user information and perform desensitization processing on the user information to obtain desensitized user information; The information sending submodule is used to send desensitized user information to the cloud server.

27. An abnormality detection device, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the method of any one of claims 1 to 11, or the method of claim 12 or 13 when executing the instructions.

28. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 11 is implemented, or the method according to claim 12 or 13 is implemented.

Images