An anomaly detection method and apparatus based on spatiotemporal data

Abstract

This application discloses an anomaly detection method and apparatus based on spatiotemporal data, relating to the field of smart city technology. The method includes: receiving an anomaly detection request, acquiring corresponding driving trajectory data, and generating an undirected graph based on the driving trajectory data; performing node reconstruction tasks on each node in the undirected graph to determine the reconstruction loss value corresponding to each node; clustering each node to generate corresponding clusters; determining the cluster closest to each node, and calculating the shortest distance between each node and its corresponding closest cluster; determining the inference error based on the shortest distance; and then determining and outputting the anomalous nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error. By combining node reconstruction and clustering perspectives to detect anomalies, this method assists in decision-making, improves the accuracy of spatiotemporal data-based anomaly detection methods, and helps in the timely avoidance of anomalous events.

Description

Technical Field

[0001] This application relates to the field of smart city technology, and more particularly to the field of urban governance technology, specifically to an anomaly detection method and device based on spatiotemporal data. Background Technology

[0002] Detection of abnormal residency status is usually based on business knowledge, which involves designing relevant anomaly rules for detection. However, this approach is dependent on the business scenario and has poor versatility.

[0003] In the process of developing this application, the inventors discovered at least the following problems in the prior art:

[0004] Detection of abnormal residency based on business knowledge has poor versatility. Summary of the Invention

[0005] In view of this, embodiments of this application provide an anomaly detection method and apparatus based on spatiotemporal data, which can solve the problem that existing detection methods based on business knowledge for resident anomalies have poor versatility.

[0006] To achieve the above objectives, according to one aspect of the embodiments of this application, an anomaly detection method based on spatiotemporal data is provided, comprising:

[0007] Receive anomaly detection requests, obtain corresponding driving trajectory data, and generate an undirected graph based on the driving trajectory data;

[0008] Perform node reconstruction tasks on each node in the undirected graph, and then determine the reconstruction loss value corresponding to each node;

[0009] Cluster each node to generate the corresponding clusters;

[0010] Determine the cluster closest to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster;

[0011] The inference error is determined based on the shortest distance, and then the abnormal nodes in the undirected graph are determined and output based on the reconstruction loss value, the shortest distance, and the inference error.

[0012] Optionally, an undirected graph is generated based on the driving trajectory data, including:

[0013] Extract the dwell time from the driving trajectory data, and then determine the dwelling location based on the dwell time;

[0014] Based on the driving trajectory data, determine the connection frequency between each stationing site;

[0015] An undirected graph is generated based on the number of resident plots and the frequency of connections.

[0016] Optionally, an undirected graph is generated based on the number of resident plots and the frequency of connections, including:

[0017] The trajectory information corresponding to each resident plot is extracted as node trajectory features, and the connection frequency is used as edge features. Then, an undirected graph is generated based on the trajectory features of each node and the edge features.

[0018] Optionally, outlier nodes in the undirected graph are determined based on the reconstruction loss value, the shortest distance, and the inference error, including:

[0019] Anomaly scores are determined based on reconstruction loss, shortest distance, and inference error;

[0020] Based on the anomaly scores, identify the abnormal nodes in the undirected graph.

[0021] Optionally, a node reconstruction task is performed on each node in the undirected graph, including:

[0022] A node reconstruction task is generated based on each node in an undirected graph;

[0023] The network model is invoked to perform reconstruction tasks at each node, thereby generating reconstruction features for each node.

[0024] Optionally, the reconstruction loss value corresponding to each node is determined, including:

[0025] For each node in the undirected graph, calculate the difference between the corresponding reconstructed feature and the corresponding node trajectory feature, and then determine the difference as the reconstructed loss value for that node.

[0026] Optionally, the shortest distance between each node and its nearest cluster is calculated, including:

[0027] Determine the center point of each cluster;

[0028] The inference network model is invoked to calculate the shortest distance between each node and the centroid of its nearest cluster, thereby determining the shortest distance between each node and its nearest cluster.

[0029] Optionally, the shortest distance between each node and the centroid of its nearest cluster is calculated, including:

[0030] Determine the shortest hop count and total connection frequency from each node to the nearest cluster center;

[0031] Based on the shortest hop count and total connection frequency, calculate the shortest distance between each node and the center of the nearest cluster.

[0032] Optionally, the method may also include the following before invoking the reconstructed network model:

[0033] Obtain the first initial neural network model;

[0034] A training sample set is obtained, which includes sample node trajectory features. The sample node trajectory features are used as the input of the first initial neural network model and as the expected output of the first initial neural network model. The first initial neural network model is trained with the goal of minimizing the reconstruction loss value to obtain the reconstructed network model.

[0035] Optionally, the method may further include the following before invoking the inference network model:

[0036] Obtain the second initial neural network model;

[0037] The output node trajectory features of the last layer of the encoder in the reconstructed network model are obtained and used as the input of the second initial neural network model. The shortest distance from the node corresponding to the output node trajectory feature to the center point of the corresponding cluster is obtained and used as the expected output of the second initial neural network model. The second initial neural network model is trained with the goal of minimizing the inference error to obtain the inference network model.

[0038] Optionally, an undirected graph is generated based on the driving trajectory data, including:

[0039] Acquire road network data and point-of-interest (POI) data;

[0040] An undirected graph is generated based on driving trajectory data, road network data, and point of interest data.

[0041] In addition, this application also provides an anomaly detection device based on spatiotemporal data, comprising:

[0042] The receiving unit is configured to receive anomaly detection requests, obtain corresponding driving trajectory data, and generate an undirected graph based on the driving trajectory data.

[0043] The reconstruction unit is configured to perform node reconstruction tasks on each node in the undirected graph, thereby determining the reconstruction loss value corresponding to each node.

[0044] The cluster generation unit is configured to cluster each node and generate the corresponding cluster;

[0045] The distance calculation unit is configured to determine the nearest cluster to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster.

[0046] The anomaly detection unit is configured to determine the inference error based on the shortest distance, and then determine and output the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error.

[0047] Optionally, the receiving unit is further configured to:

[0048] Extract the dwell time from the driving trajectory data, and then determine the dwelling location based on the dwell time;

[0049] Based on the driving trajectory data, determine the connection frequency between each stationing site;

[0050] An undirected graph is generated based on the number of resident plots and the frequency of connections.

[0051] Optionally, the receiving unit is further configured to:

[0052] The trajectory information corresponding to each stationed site is extracted as node trajectory features, and the connection frequency is used as edge features. Then, an undirected graph is generated based on the trajectory features of each node and the edge features.

[0053] Optionally, the anomaly detection unit is further configured to:

[0054] Anomaly scores are determined based on reconstruction loss, shortest distance, and inference error;

[0055] Based on the anomaly scores, identify the abnormal nodes in the undirected graph.

[0056] Optionally, the reconfiguration unit is further configured to:

[0057] A node reconstruction task is generated based on each node in an undirected graph;

[0058] The network model is invoked to perform reconstruction tasks at each node, thereby generating reconstruction features for each node.

[0059] Optionally, the reconfiguration unit is further configured to:

[0060] For each node in the undirected graph, calculate the difference between the corresponding reconstructed feature and the corresponding node trajectory feature, and then determine the difference as the reconstructed loss value for that node.

[0061] Optionally, the distance calculation unit is further configured to:

[0062] Determine the center point of each cluster;

[0063] The inference network model is invoked to calculate the shortest distance between each node and the centroid of its nearest cluster, thereby determining the shortest distance between each node and its nearest cluster.

[0064] Optionally, the distance calculation unit is further configured to:

[0065] Determine the shortest hop count and total connection frequency from each node to the nearest cluster center;

[0066] Based on the shortest hop count and total connection frequency, calculate the shortest distance between each node and the center of the nearest cluster.

[0067] Optionally, the anomaly detection device based on spatiotemporal data further includes a first model training unit, configured to:

[0068] Obtain the first initial neural network model;

[0069] A training sample set is obtained, which includes sample node trajectory features. The sample node trajectory features are used as the input of the first initial neural network model and as the expected output of the first initial neural network model. The first initial neural network model is trained with the goal of minimizing the reconstruction loss value to obtain the reconstructed network model.

[0070] Optionally, the anomaly detection device based on spatiotemporal data further includes a second model training unit, configured to:

[0071] Obtain the second initial neural network model;

[0072] The output node trajectory features of the last layer of the encoder in the reconstructed network model are obtained and used as the input of the second initial neural network model. The shortest distance from the node corresponding to the output node trajectory feature to the center point of the corresponding cluster is obtained and used as the expected output of the second initial neural network model. The second initial neural network model is trained with the goal of minimizing the inference error to obtain the inference network model.

[0073] Optionally, the receiving unit is further configured to:

[0074] Acquire road network data and point-of-interest (POI) data;

[0075] An undirected graph is generated based on driving trajectory data, road network data, and point of interest data.

[0076] In addition, this application also provides an anomaly detection electronic device, including: one or more processors; and a storage device for storing one or more programs, which, when executed by one or more processors, enable the one or more processors to implement the anomaly detection method based on spatiotemporal data as described above.

[0077] In addition, this application also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processor, implements the above-described anomaly detection method based on spatiotemporal data.

[0078] One embodiment of the above invention has the following advantages or beneficial effects: This application receives anomaly detection requests, obtains corresponding driving trajectory data, and generates an undirected graph based on the driving trajectory data; performs node reconstruction tasks on each node in the undirected graph, thereby determining the reconstruction loss value corresponding to each node; clusters each node to generate corresponding clusters; determines the cluster closest to each node, and then calculates the shortest distance between each node and its corresponding closest cluster; determines the inference error based on the shortest distance, and then determines and outputs the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error. By combining node reconstruction and clustering to detect abnormal points, this application assists in decision-making, improves the accuracy of anomaly detection methods based on spatiotemporal data, and helps to avoid abnormal events in a timely manner.

[0079] The further effects of the aforementioned unconventional alternative methods will be explained below in conjunction with specific implementation methods. Attached Figure Description

[0080] The accompanying drawings are provided to better understand this application and do not constitute an undue limitation thereof. Wherein:

[0081] Figure 1 This is a schematic diagram of the main flow of the anomaly detection method based on spatiotemporal data according to the first embodiment of this application;

[0082] Figure 2 This is a schematic diagram of the main flow of the anomaly detection method based on spatiotemporal data according to the second embodiment of this application;

[0083] Figure 3 This is a schematic diagram illustrating an application scenario of the anomaly detection method based on spatiotemporal data according to the third embodiment of this application;

[0084] Figure 4 This is a schematic diagram of the main units of an anomaly detection device based on spatiotemporal data according to an embodiment of this application;

[0085] Figure 5 This is an exemplary system architecture diagram to which embodiments of this application can be applied;

[0086] Figure 6 This is a schematic diagram of the structure of a computer system suitable for implementing terminal devices or servers in the embodiments of this application. Detailed Implementation

[0087] The following description, in conjunction with the accompanying drawings, illustrates exemplary embodiments of this application, including various details to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of this application. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description. The acquisition, storage, use, and processing of data in the technical solutions of this application all comply with relevant national laws and regulations.

[0088] Figure 1 This is a schematic diagram of the main flow of the anomaly detection method based on spatiotemporal data according to the first embodiment of this application, as shown below. Figure 1 As shown, anomaly detection methods based on spatiotemporal data include:

[0089] Step S101: Receive an anomaly detection request, obtain the corresponding driving trajectory data, and generate an undirected graph based on the driving trajectory data.

[0090] In this embodiment, the execution entity of the spatiotemporal data-based anomaly detection method (e.g., a server) can receive anomaly detection requests via wired or wireless connections. Specifically, the anomaly detection request may be a request to detect whether a vehicle is abnormally stationed. After receiving the anomaly detection request, the execution entity can obtain the vehicle identifier, such as the license plate number, and then query the corresponding driving trajectory data based on the license plate number. The driving trajectory data may include station points and the station time corresponding to each station point.

[0091] Specifically, generating an undirected graph based on driving trajectory data includes:

[0092] Acquire road network data and point of interest (POI) data; generate an undirected graph based on driving trajectory data, road network data, and POI data.

[0093] After obtaining the vehicle's trajectory data corresponding to the anomaly detection request, the executing entity can also obtain road network data and Points of Interest (POI) data. Specifically, the executing entity can perform feature processing on the trajectory, road network, and POI data to obtain, for example... Figure 3 The undirected graph A shown is modeled as an undirected graph because the trajectory order of the nodes is not considered during the anomaly detection process. In the undirected graph A, the gray nodes are examples of normal nodes and the black nodes are examples of abnormal nodes.

[0094] Specifically, the driving trajectory data: the relationships between nodes used to generate the undirected graph are mainly obtained from the driving trajectory data. First, the driving trajectory data undergoes dwell detection analysis (if the dwell time at the same location exceeds K hours, it is marked as a dwell point), obtaining the dwell points (latitude and longitude) of each trajectory. Then, dwell points that are close to each other are aggregated to obtain dwelling plots (i.e., the nodes in the corresponding undirected graph). Statistics are performed on each trajectory, and the dwelling plots are connected sequentially (edges in the undirected graph), with the connection frequency used as an edge feature. Information such as arrival time and departure time in the trajectory data is extracted as node trajectory features, and the node trajectory... The trace feature is represented as a time period distribution. For example, if the arrival times of each vehicle at node i are 8:23, 9:10, 12:00, and 13:20, and the time period is divided into 3 segments (8:00-11:00, 11:00-13:00, and 13:00-16:00), it is represented as (2, 1, 1). That is, in the first time period 8:00-11:00, there are 2 corresponding times 8:23 and 9:10, in the second time period 11:00-13:00, there is 1 corresponding time 12:00, and in the third time period 13:00-16:00, there is 1 corresponding time 13:20. The executing entity can eliminate the dwell time information for each trajectory, extract the dwell time feature separately, and bin the dwell time of each node to obtain the dwell time distribution of each node. For example, if the dwell time sequence (minutes) of a certain node is 20, 30, 5, 45, 59, it can be divided into two bins according to the maximum and minimum values: 1-30 and 31-60. Then the first bin contains three values: 20, 30, and 5, and the second bin contains two values: 45 and 59. The dwell time distribution is represented as (3, 2). In other words, the node trajectory features of each node in the undirected graph can be represented by the time period distribution (2, 1, 1) and the node dwell time distribution (3, 2). For example, the node trajectory features used to generate the undirected graph A can be specifically represented as {(2, 1, 1), (3, 2)}.

[0095] Road network data: Road network features such as the number of roads, road length, maximum number of lanes, and distribution of the number of roads of different levels are used as node trajectory features.

[0096] Point of Interest (POI) data: Extract the top P POIs of interest (such as shopping, transportation facilities, public toilets, medical facilities, etc.) and construct the POI distribution characteristics (2, 1, 1, 0) for each resident plot (i.e., each node in the undirected graph), that is, 2 shopping interest points (e.g., 2 shopping malls with high user traffic), 1 transportation facility, and 1 public toilet.

[0097] In summary, the node trajectory features used to generate an undirected graph can include: time period distribution, node dwell time distribution, road network features, and POI distribution features.

[0098] After obtaining the node trajectory features of each node used to generate the undirected graph, the executing entity can connect the nodes corresponding to the parking plots in sequence according to the parking order of the vehicles to generate the undirected graph, since each node used to generate the undirected graph actually corresponds to the parking plot of the vehicle.

[0099] Step S102: Perform node reconstruction tasks on each node in the undirected graph to determine the reconstruction loss value corresponding to each node.

[0100] For example, for node 'a' in an undirected graph, the executing entity can first determine the initial feature 'x' of node 'a'. i When performing a node reconstruction task, information from node a's neighboring nodes is aggregated. When node a's initial features are set to 0, that is, when node a's features are reconstructed using its neighboring node information, the reconstructed features of node a are obtained. This reconstruction feature The initial feature x of node a i The greater the difference, the greater the reconstruction loss, indicating that node 'a' is less similar to its neighboring nodes, i.e., different from a "normal point". Then, the executing agent can base its work on the initial feature x. i and reconstructed features Determine the reconstruction loss value corresponding to node 'a'. Example reconstruction loss value:

[0101] Step S103: Cluster each node to generate the corresponding cluster.

[0102] The executing entity can determine the distances between nodes and cluster two or more nodes whose distance is less than a preset distance threshold to generate clusters. Specifically, clustering can be performed using graph clustering methods. Multiple clusters are obtained through graph clustering methods (such as community detection methods), and the centroid k of each cluster is found (e.g., the node with the highest degree is the most critical node).

[0103] Step S104: Determine the cluster closest to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster.

[0104] Specifically, the executor can perform graph-level auxiliary tasks: inferring the shortest distance from each node to the nearest cluster center.

[0105] For example, the executing entity can statistically analyze the shortest distances from each node used to construct the training set to the nearest cluster center, thereby constructing the training set (z). i d ik The inference network model is obtained by training, where i is the node number and z is the node number. i For nodes (specifically, the encoder network output of node-level auxiliary tasks), k is the cluster center, and d is the node.ik For node z i The shortest distance to the nearest cluster.

[0106] The shortest distance d in the constructed training set can be obtained as follows: The executing agent can use graph clustering methods (such as community detection methods) to obtain multiple clusters based on each node used to construct the training set, and find the center point k of each cluster (e.g., the node with the highest degree is the most critical node). Calculate the shortest distance d from each node used to construct the training set to the nearest cluster center point.

[0107] Considering that the degree of node anomaly is proportional to the number of hops from the node to the center of the nearest cluster (hop count is a network routing term that indicates how many nodes a message needs to pass through to travel from one router to another), and also proportional to the node degree (node ​​degree refers to the number of edges associated with that node, also known as the degree of association, considering edge characteristics), it is a direct correlation between the degree of node anomaly and the number of hops from the node to the center of the nearest cluster (hop count is a network routing term that indicates how many nodes a message needs to pass through to travel from one router to another), and also proportional to the node degree (node ​​degree refers to the number of edges associated with that node, also known as the degree of association, considering edge characteristics). Where wij is the connection frequency of each edge, eij can be 0 or 1, indicating whether nodes i and j have edges, and is inversely proportional to the frequency of each edge. The shortest distance d is defined as hop. ik / l i The numerator is the shortest hop count from node i to cluster center k, and the denominator is the total connection frequency of node i. This metric avoids misclassifying nodes that are geographically distant but actually have many connections. i It is the sum of the frequencies of all edges of node i.

[0108] In the construction-based training set (z) i d ik After training the inference network model, the executing entity can input each node in the undirected graph generated in this embodiment, along with the clusters closest to each node, into the trained inference network model, thereby obtaining the inferred shortest distances for each node output by the inference network model. Then the output of each inferred shortest distance This is the shortest distance from each node in the undirected graph to the center of the nearest cluster.

[0109] Step S105: Determine the inference error based on the shortest distance, and then determine and output the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error.

[0110] The executing entity obtains the inferred shortest distance for each node from the output of the inference network model. Then, based on each inferred shortest distance Determine the inference error for each node. For example, the inference error... The meaning is that d is the shortest distance as defined above, and the outer layer is a squared difference, which is the inferred shortest distance. and the actual distance d ik The squared error. Where, the true distance d ik The inferred distance can be obtained by the executing entity through actual statistical analysis of each node in the generated undirected graph. It can be:

[0111] Furthermore, the implementing entity can reconstruct the loss value. Inferred shortest distance and inference error Identify and output the abnormal nodes in the undirected graph.

[0112] Specifically, outlier nodes in an undirected graph are determined based on the reconstruction loss value, the shortest distance, and the inference error, including:

[0113] Anomaly scores are determined based on the reconstruction loss value, shortest distance, and inference error. Specifically, the anomaly scores can be calculated using a preset formula (e.g., anomaly score = reconstruction loss value + true distance from each node to the nearest cluster center + inference error; this is just an example, and the embodiments of this application do not specifically limit the preset formula) based on the anomaly scores. Anomaly nodes in the undirected graph are then identified.

[0114] This embodiment receives anomaly detection requests, acquires corresponding driving trajectory data, and generates an undirected graph based on the driving trajectory data. It then performs node reconstruction tasks on each node in the undirected graph to determine the reconstruction loss value for each node. Next, it clusters the nodes to generate corresponding clusters. It determines the cluster closest to each node and calculates the shortest distance between each node and its nearest cluster. Based on the shortest distance, it determines the inference error, and then identifies and outputs the anomalous nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error. By combining node reconstruction and clustering perspectives to detect anomalies, this approach assists decision-making, improves the accuracy of spatiotemporal data-based anomaly detection methods, and helps in the timely avoidance of anomalous events.

[0115] Figure 2 This is a schematic diagram of the main flow of the anomaly detection method based on spatiotemporal data according to the second embodiment of this application, as follows: Figure 2 As shown, anomaly detection methods based on spatiotemporal data include:

[0116] Step S201: Receive an anomaly detection request and obtain the corresponding driving trajectory data.

[0117] Step S202: Extract the dwell time from the driving trajectory data, and then determine the dwelling location based on the dwell time.

[0118] For example, for the driving trajectory data of each vehicle, based on the successively passed stop points, the stop time corresponding to each stop point is extracted from the driving trajectory data, for example, 3 hours, 4 hours, and 4.5 hours respectively. The executing entity can determine the difference between two adjacent stop times, and merge the stop points corresponding to adjacent stop times when the difference between two adjacent stop times is less than a threshold into a stop plot. For example, the differences between two adjacent stop times of 3 hours, 4 hours, and 4.5 hours are 1 hour and 0.5 hours respectively. Assuming the time difference threshold is 2 hours, then 1 hour and 0.5 hours are both less than the time difference threshold of 2 hours, so the executing entity can merge the stop points corresponding to stop times of 3 hours, 4 hours, and 4.5 hours into a stop plot. This application embodiment does not limit the threshold.

[0119] Step S203: Determine the connection frequency between each stationing site based on the driving trajectory data.

[0120] The number of connections between each resident site and other resident sites is determined as the connection frequency between resident sites.

[0121] Step S204: Generate an undirected graph based on the resident plots and connection frequency.

[0122] Specifically, generating an undirected graph based on the resident plots and connection frequencies includes: extracting the trajectory information corresponding to each resident plot as node trajectory features, using the connection frequency as edge features, and then generating an undirected graph based on the trajectory features of each node and the edge features.

[0123] Step S205: Perform node reconstruction tasks on each node in the undirected graph to determine the reconstruction loss value corresponding to each node.

[0124] Specifically, the node reconstruction task is performed on each node in the undirected graph, including:

[0125] A node reconstruction task is generated based on each node in an undirected graph.

[0126] Determine the execution time of each node's reconstruction task. In response to determining that the current time has reached any of the execution times, invoke the reconstruction network model to execute the node reconstruction task that has reached its execution time.

[0127] The network model is invoked to perform reconstruction tasks at each node, thereby generating reconstruction features for each node.

[0128] Specifically, when the executing entity calls the reconstruction network model to perform the reconstruction task for each node, for example, for node 'a' in an undirected graph, the initial feature x of node 'a' can be determined first. iWhen performing a node reconstruction task, information from node 'a's neighboring nodes is aggregated. When the initial features of node 'a' are set to 0, that is, when the features of node 'a' are reconstructed using the neighboring node information, the reconstructed features of node 'a' are obtained.

[0129] In this embodiment, the abnormal dwelling detection problem is modeled as a graph node abnormality detection problem. Spatiotemporal features are extracted into node and edge features. Through graph node learning, the spatiotemporal correlation between nodes is embedded to improve the accuracy of abnormality judgment. Based on existing business knowledge of abnormality patterns, the main anomalies involved in the application scenarios of this application include: The first type of anomaly: the characteristics of the dwelling point are different from normal locations. In addition to conventional anomaly judgments such as a relatively sparse POI distribution, i.e., a sparsely populated area, the anomaly is relatively large. Furthermore, the trajectory dwell time feature is combined to detect locations that appear at the wrong time, such as going to a sparsely populated area during mealtime and staying for a different time than normal. The second type of anomaly: the dwelling point is far from the normal area, which is represented on the modeled graph as being far from the cluster center.

[0130] Based on the two anomaly patterns mentioned above, two self-supervised auxiliary tasks are designed. For the first anomaly, a node reconstruction task is designed, using the node reconstruction loss as an anomaly score (the larger the loss, the higher the anomaly). That is, if the representation recovered from the graph structure differs significantly from its original representation, it indicates an anomaly compared to normal nodes. For the second anomaly, an inference auxiliary task is designed: inferring the distance of a node from its normal center point (specific statistical indicators are detailed in the section on inference). A larger distance indicates a greater anomaly. The self-supervised task uses the statistically calculated distance indicators as pseudo-labels for supervised training, and then combines the inferred distance and inference error as the anomaly score. Compared to other methods that directly use statistical indicators, this approach filters out some noise during the graph construction process, enhancing the model's robustness. Furthermore, in distance calculation, the total link frequency of nodes is considered to avoid misjudging nodes that are geographically distant but actually have many connections, thus improving the accuracy of anomaly detection.

[0131] In this embodiment, two graph self-supervised learning auxiliary tasks are designed to learn from unsupervised graph information, thereby training a reconstruction network model and an inference network model, respectively. The two tasks correspond to the two abnormal modes mentioned above: Task 1, where the characteristics of the dwelling points differ from normal locations; and Task 2, where the dwelling points are far from normal regions. Task 1 is a node-level auxiliary task: node reconstruction. Task 1 uses the reconstruction network model. Task 2 is a graph-level auxiliary task: inferring the shortest distance from each node in the undirected graph to the center of its nearest cluster. Task 2 uses the inference network model. The input to the inference network model is the output z of the hidden layer representation of the nodes in the reconstruction network model. i Both the reconstructed network model and the inference network model are obtained through training. The training process is as follows:

[0132] Specifically, before invoking the reconstructed network model, the method also includes:

[0133] Obtain an initial neural network model, such as an encoder-decoder network;

[0134] A training sample set is obtained, which includes sample node trajectory features. The sample node trajectory features are used as the input of the first initial neural network model and as the expected output of the first initial neural network model. The first initial neural network model is trained with the goal of minimizing the reconstruction loss value to obtain the reconstructed network model.

[0135] For example, a node-level auxiliary task is invoked to train and reconstruct the network model. Node reconstruction. A graph encoder (GNN encoder) is used to reconstruct the node x. i Dimensionality reduction representation learning is performed to obtain the hidden layer representation z of the nodes. i Then, a decoder (GNNdecoder) is used to reconstruct the node trajectory features. Use minimizing reconstruction loss The encoder-decoder network is trained. The encoder and decoder (both are the same type of learner, forming a symmetric structure) can use learners such as GAT or GIN. The trained node hidden layer representation z... i Continuing as input for the graph-level auxiliary task. Since undirected graphs have edge features, edge features are added to the aggregation of neighbor node information for node trajectory features. The GAT node update formula is as follows:

[0136]

[0137] in Let f be the representation of node v at layer k; f is the activation function (non-linear), typically using the LeakyReLU function; the first term in the f function is the representation of node v at layer k-1, and the second term is the aggregated neighbor node information. (where W is the neighboring node of node v), where W is the characteristic transformation matrix, α uv Let e ​​be the attention coefficient for nodes u and v. uv Let e ​​be the edge feature between nodes u and v, where e uv The added edge features.

[0138] The GIN node update formula is as follows:

[0139]

[0140] Where ε kThe combination coefficients of the aggregated information of node v and its neighbors can be set experimentally; unlike f in GAT, which is the activation function, f here is the encoder, such as a multilayer perceptron (MLP).

[0141] Specifically, the reconstruction loss value corresponding to each node is determined, including:

[0142] For each node in the undirected graph, calculate the difference between the corresponding reconstructed feature and the corresponding node trajectory feature, and then determine the difference as the reconstructed loss value for that node.

[0143] Step S206: Cluster each node to generate the corresponding cluster.

[0144] Step S207: Determine the cluster closest to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster.

[0145] Specifically, the shortest distance between each node and its nearest cluster is calculated, including:

[0146] Determine the centroid of each cluster; invoke the inference network model to calculate the shortest distance between each node and the centroid of its nearest cluster, and then determine the shortest distance between each node and its nearest cluster.

[0147] Specifically, the method also includes the following steps before invoking the inference network model:

[0148] Obtain the second initial neural network model;

[0149] The output node trajectory features of the last layer of the encoder in the reconstructed network model are obtained and used as the input of the second initial neural network model. The shortest distance from the node corresponding to the output node trajectory feature to the center point of the corresponding cluster is obtained and used as the expected output of the second initial neural network model. The second initial neural network model is trained with the goal of minimizing the inference error to obtain the inference network model.

[0150] Specifically, the executor can perform graph-level auxiliary tasks to train the inference network model. By performing graph-level auxiliary tasks, the shortest distance from each node to the nearest cluster center can be inferred.

[0151] For example, the executing entity can statistically analyze the shortest distances from each node used to construct the training set to the nearest cluster center, thereby constructing the training set (z). i d ik The inference network model is obtained by training, where i is the node number and z is the node number. i For nodes (specifically, the encoder network output of node-level auxiliary tasks), k is the cluster center, and d is the node. ik For node zi The shortest distance to the nearest cluster.

[0152] The shortest distance d in the constructed training set can be obtained as follows: The executing agent can use graph clustering methods (such as community detection methods) to obtain multiple clusters based on each node used to construct the training set, and find the center point k of each cluster (e.g., the node with the highest degree is the most critical node). Calculate the shortest distance d from each node used to construct the training set to the nearest cluster center point.

[0153] Considering that the degree of node anomaly is proportional to the number of hops from the node to the center of the nearest cluster (hop count is a network routing term that indicates how many nodes a message needs to pass through to travel from one router to another), and also proportional to the node degree (node ​​degree refers to the number of edges associated with that node, also known as the degree of association, considering edge characteristics), it is a direct correlation between the degree of node anomaly and the number of hops from the node to the center of the nearest cluster (hop count is a network routing term that indicates how many nodes a message needs to pass through to travel from one router to another), and also proportional to the node degree (node ​​degree refers to the number of edges associated with that node, also known as the degree of association, considering edge characteristics). (e) ij The shortest distance d is defined as hop, which is inversely proportional to the edge features between nodes i and j. ik / l i The numerator is the shortest hop count from node i to cluster center k, and the denominator is the total connection frequency of node i. This metric avoids misclassification of nodes that are geographically distant but actually have many connections.

[0154] After obtaining the above training set, a two-layer MLP (Shortest Range Inference Network) is used to learn the shortest range inference task, minimizing the inference error. Network training is performed. The node input is the output of the encoder network for the node-level auxiliary task, i.e., node z. i Finally, a well-trained inference network model is obtained.

[0155] Specifically, the shortest distance between each node and the centroid of its nearest cluster is calculated, including:

[0156] Determine the shortest hop count and total connection frequency from each node to the nearest cluster center; based on the shortest hop count and total connection frequency, calculate the shortest distance between each node and the center of the nearest cluster.

[0157] The implementing entity can use graph clustering methods (such as community detection methods) to obtain multiple clusters based on the nodes in the generated undirected graph, and find the centroid k of each cluster (e.g., the node with the highest degree is the most critical node). The shortest distance d from each node used to construct the training set to the nearest cluster centroid is calculated.

[0158] Since the degree of node anomaly is directly proportional to the number of hops from the node to the center of the nearest cluster (hop count is a network routing term that indicates how many nodes a message needs to pass through to travel from one router to another), and also proportional to the node degree (node ​​degree refers to the number of edges associated with that node, also known as the degree of association, taking edge characteristics into account), the anomaly of a node is directly proportional to the number of hops from the node to the center of the nearest cluster (hop count is a network routing term that indicates how many nodes a message needs to pass through to travel from one router to another), and also proportional to the node degree (node ​​degree refers to the number of edges associated with that node, also known as the degree of association, taking edge characteristics into account). (eij is the edge feature between nodes i and j) is inversely proportional, and the shortest distance d is defined as hop. ik / l i , where the numerator is the shortest hop count from node i to cluster center k, and the denominator is the total connection frequency of node i.

[0159] Step S208: Determine the inference error based on the shortest distance, and then determine and output the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error.

[0160] The execution entity obtains relevant metrics (reconstruction loss, inference shortest distance, and inference error) for each node based on the reconstructed network model and inference network model obtained from training, and calculates anomaly scores for them. The anomaly scores are defined as follows, where γ and ∈ are balance factors.

[0161] Reconstruction loss:

[0162] Inferred distance and inference error:

[0163] Abnormal scores:

[0164] As shown above, after obtaining the anomaly score of each node in the undirected graph, based on business requirements, select the top T nodes or nodes with scores greater than a certain threshold, output the anomalies, and the task ends.

[0165] Figure 3 This is a schematic diagram illustrating an application scenario of the spatiotemporal data-based anomaly detection method according to the third embodiment of this application. The spatiotemporal data-based anomaly detection method of this application can be applied to scenarios involving the detection of abnormal vehicle parking. Figure 3 As shown, the execution entity first performs feature processing on multi-source heterogeneous spatiotemporal data (such as acquired vehicle trajectories, road networks, POIs, etc.) to obtain an undirected graph A. The learning task is to output the abnormal nodes in the graph (e.g., Figure 3(The black nodes in the undirected graph A). This application embodiment designs two graph self-supervised learning tasks: 1) Node-level auxiliary task: Node reconstruction. Reconstructing and calculating the trajectory features of nodes; 2) Graph-level auxiliary task: Inferring the shortest distance from a node to the nearest cluster center. Calculating the shortest distance from a node to the nearest cluster center. After the graph self-supervised task is completed, the relevant indicators of each node (node ​​reconstruction loss, shortest distance + inference error) are obtained, and then anomaly scores are calculated to obtain the anomaly scores of each node. Then, based on business rules, the top K anomaly nodes are output. Self-supervised learning: Constructing label information through the dataset itself to enhance the existing small amount of supervision information, so as to make full use of the large amount of unlabeled data in the actual scenario, is a popular research direction. It includes generative (learning through reconstruction loss, etc., which is widely used in natural language processing (NLP), contrastive (constructing contrastive triples based on business knowledge or data augmentation, which is currently widely studied), and prediction (designing auxiliary tasks to construct labeled training samples based on the known features of the dataset itself for prediction learning), among which contrastive methods perform relatively better in classification tasks. In this application embodiment, the node-level auxiliary task is generative, and the graph-level auxiliary task is predictive.

[0166] The specific execution process of this application is illustrated below:

[0167] Taking the abnormal parking of hazardous chemical transport vehicles as an example, the goal of this task is to determine the abnormal parking of transport vehicles (which can be used to further investigate whether there are illegal hazardous chemical factories at the parking location).

[0168] Step 1: Input the trajectory data of the transport vehicles, as well as auxiliary static data such as POIs and road networks. First, perform data processing to obtain the stationary graph network of the transport vehicles, i.e., an undirected graph (node ​​trajectory features include three types of features: trajectory, POI, and road network; edge features are connection frequencies).

[0169] Step 2: Based on the undirected graph network obtained in Step 1, the network is trained by constructing two types of auxiliary tasks, which are performed sequentially.

[0170] Auxiliary Task 1 (Training and Reconstructing the Network): The training set is (x i x i This involves recovering the node's own features. A graph encoder-decoder network is used for training, with the goal of minimizing the reconstruction loss. After training, the last layer of the encoder is used as the node trajectory features for auxiliary task 2.

[0171] Auxiliary Task 2 (Training the Inference Network): As above, the shortest distance from each node to the center of the nearest cluster is used as the auxiliary label. The training set is then (z... i d ik ), zi This is to assist in the feature analysis of node trajectories after Task 1. This is a supervised learning task, with the goal of minimizing the inference error during training.

[0172] Step 3: After the above training is completed, the following metrics can be obtained for each node: reconstruction loss (auxiliary task 1), inference distance and inference error (auxiliary task 2), and the weighted sum of the two is the anomaly score.

[0173] Abnormal scores:

[0174] Step 4: After obtaining the anomaly score for each node, based on business requirements, select the top T nodes or nodes greater than a certain threshold as anomaly dwell points for output, and the task ends.

[0175] This application implements an anomaly detection method based on graph self-supervised learning for spatiotemporal data. It can be widely applied in smart city and urban governance scenarios, such as vehicle management with relatively fixed transportation tasks, like hazardous chemical transport and logistics. Anomaly detection of vehicle parking locations helps to avoid abnormal events in a timely manner and ensure public safety. It can also be used for anomaly detection of important personnel trajectories to find anomalous parking points and assist in decision-making. The method is designed for multi-source heterogeneous spatiotemporal data such as trajectories, road networks, and POIs. It models the trajectory anomaly detection problem as a graph node anomaly detection problem, extracting spatiotemporal features into node and edge features, and embedding the spatiotemporal correlation between nodes through graph node learning. For unsupervised task scenarios, it comprehensively considers two anomaly modes and designs a self-supervised learning auxiliary task. It comprehensively calculates the node anomaly degree from two levels: node trajectory features and global graph connectivity, improving the accuracy of anomaly judgment. Auxiliary Task 1, combining features such as trajectory dwell time, POIs, and road network, can further detect POI-related locations where erroneous dwell times occur. Auxiliary Task 2, on the one hand, enhances traditional distance statistics methods through a self-supervised task, filtering out some noise and improving the robustness of the method; on the other hand, it incorporates the total number of connections of nodes into the distance metric to avoid misjudging nodes that are geographically distant but actually have many connections, thus improving the accuracy of anomaly detection. The learning networks mentioned in the auxiliary tasks, such as GNN encoders / decoders, shortest path inference networks, and graph clustering methods, can all be replaced with other commonly used methods.

[0176] Figure 4 This is a schematic diagram of the main units of an anomaly detection device based on spatiotemporal data according to an embodiment of this application. Figure 4 As shown, the anomaly detection device based on spatiotemporal data includes a receiving unit 401, a reconstruction unit 402, a cluster generation unit 403, a distance calculation unit 404, and an anomaly detection unit 405.

[0177] The receiving unit 401 is configured to receive anomaly detection requests, obtain corresponding driving trajectory data, and generate an undirected graph based on the driving trajectory data.

[0178] Reconstruction unit 402 is configured to perform node reconstruction tasks on each node in the undirected graph, thereby determining the reconstruction loss value corresponding to each node.

[0179] Cluster generation unit 403 is configured to cluster each node and generate corresponding clusters.

[0180] The distance calculation unit 404 is configured to determine the nearest cluster to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster.

[0181] Anomaly detection unit 405 is configured to determine the inference error based on the shortest distance, and then determine and output the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance and the inference error.

[0182] In some embodiments, the receiving unit 401 is further configured to: extract the dwell time from the driving trajectory data, and then determine the dwelling plots based on the dwell time; determine the connection frequency between each dwelling plot based on the driving trajectory data; and generate an undirected graph based on the dwelling plots and the connection frequency.

[0183] In some embodiments, the receiving unit 401 is further configured to: extract the trajectory information corresponding to each resident plot as node trajectory features, use the connection frequency as edge features, and then generate an undirected graph based on the node trajectory features and edge features.

[0184] In some embodiments, the anomaly detection unit 405 is further configured to: determine anomaly scores based on reconstruction loss values, shortest distances, and inference errors; and determine anomalous nodes in the undirected graph based on the anomaly scores.

[0185] In some embodiments, the reconstruction unit 402 is further configured to: generate node reconstruction tasks based on each node in the undirected graph; call the reconstruction network model to execute each node reconstruction task, thereby generating reconstruction features for each node.

[0186] In some embodiments, the reconstruction unit 402 is further configured to: for each node in the undirected graph, calculate the difference between the corresponding reconstruction feature and the corresponding node trajectory feature, and then determine the difference as the reconstruction loss value corresponding to the node.

[0187] In some embodiments, the distance calculation unit 404 is further configured to: determine the center point of each cluster; invoke the inference network model to calculate the shortest distance between each node and the center point of the corresponding nearest cluster, and then determine the shortest distance between each node and the corresponding nearest cluster.

[0188] In some embodiments, the distance calculation unit 404 is further configured to: determine the shortest number of hops and the total connection frequency from each node to the corresponding nearest cluster center; and calculate the shortest distance between each node and the center point of the corresponding nearest cluster based on the shortest number of hops and the total connection frequency.

[0189] In some embodiments, the spatiotemporal data-based anomaly detection device further includes Figure 4 The first model training unit (not shown) is configured to: acquire a first initial neural network model; acquire a training sample set, which includes sample node trajectory features; use the sample node trajectory features as input to the first initial neural network model; use the sample node trajectory features as the expected output of the first initial neural network model; and train the first initial neural network model with the goal of minimizing the reconstruction loss value to obtain a reconstructed network model.

[0190] In some embodiments, the spatiotemporal data-based anomaly detection device further includes Figure 4 The second model training unit, not shown, is configured to: acquire a second initial neural network model; acquire the output node trajectory features of the last layer of the encoder in the reconstructed network model and use them as input to the second initial neural network model; acquire the shortest distance from the node corresponding to the output node trajectory features to the center point of the corresponding cluster and use it as the expected output of the second initial neural network model; and train the second initial neural network model with the goal of minimizing the inference error to obtain the inference network model.

[0191] In some embodiments, the receiving unit 401 is further configured to: acquire road network data and point of interest data; and generate an undirected graph based on driving trajectory data, road network data, and point of interest data.

[0192] It should be noted that the anomaly detection method and anomaly detection device based on spatiotemporal data in this application are related in terms of specific implementation, so the repeated content will not be described again.

[0193] Figure 5 An exemplary system architecture 500 is shown that can be applied to the spatiotemporal data-based anomaly detection method or spatiotemporal data-based anomaly detection device according to the embodiments of this application.

[0194] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, and 503, a network 504, and a server 505. Network 504 serves as the medium for providing communication links between terminal devices 501, 502, and 503 and server 505. Network 504 may include various connection types, such as wired or wireless communication links, or fiber optic cables, etc.

[0195] Users can use terminal devices 501, 502, and 503 to interact with server 505 via network 504 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 501, 502, and 503, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social media platform software, etc. (for example only).

[0196] Terminal devices 501, 502, and 503 can be various electronic devices with an anomaly detection and processing screen that support web browsing, including but not limited to smartphones, tablets, laptops, and desktop computers.

[0197] Server 505 can be a server providing various services, such as a backend management server supporting anomaly detection requests submitted by users using terminal devices 501, 502, and 503 (this is just an example). The backend management server can receive anomaly detection requests, obtain corresponding driving trajectory data, generate an undirected graph based on the driving trajectory data, perform node reconstruction tasks on each node in the undirected graph, and then determine the reconstruction loss value corresponding to each node; cluster each node to generate corresponding clusters; determine the cluster closest to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster; determine the inference error based on the shortest distance, and then determine and output the anomalous nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error. By combining node reconstruction and clustering perspectives to detect anomalies, this approach assists decision-making, improves the accuracy of anomaly detection methods based on spatiotemporal data, and helps to avoid anomalous events in a timely manner.

[0198] It should be noted that the anomaly detection method based on spatiotemporal data provided in this application embodiment is generally executed by server 505, and correspondingly, the anomaly detection device based on spatiotemporal data is generally set in server 505.

[0199] It should be understood that Figure 5 The number of terminal devices, networks, and servers shown is merely illustrative. Depending on implementation needs, any number of terminal devices, networks, and servers can be included.

[0200] Reference below Figure 6 It shows a schematic diagram of the structure of a computer system 600 suitable for implementing a terminal device according to the embodiments of this application. Figure 6 The terminal device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0201] like Figure 6As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes based on programs stored in read-only memory (ROM) 602 or programs loaded from storage section 608 into random access memory (RAM) 603. The RAM 603 also stores various programs and data required for the operation of the computer system 600. The CPU 601, ROM 602, and RAM 603 are interconnected via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0202] The following components are connected to I / O interface 605: an input section 606 including a keyboard, mouse, etc.; an output section 607 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to I / O interface 605 as needed. A removable medium 611, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed on drive 610 as needed so that computer programs read from it can be installed into storage section 608 as needed.

[0203] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 609, and / or installed from removable medium 611. When the computer program is executed by central processing unit (CPU) 601, it performs the functions defined above in the system of this application.

[0204] It should be noted that the computer-readable medium shown in this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. Computer-readable storage media can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this application, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In this application, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0205] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0206] The units described in the embodiments of this application can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a receiving unit, a reconstruction unit, a cluster generation unit, a distance calculation unit, and an anomaly detection unit. The names of these units do not necessarily limit the specific unit itself.

[0207] In another aspect, this application also provides a computer-readable medium, which may be included in the device described in the above embodiments; or it may exist independently and not assembled into the device. The computer-readable medium carries one or more programs that, when executed by the device, cause the device to receive an anomaly detection request, acquire corresponding driving trajectory data, generate an undirected graph based on the driving trajectory data, perform node reconstruction tasks on each node in the undirected graph, and determine the reconstruction loss value corresponding to each node; cluster each node to generate corresponding clusters; determine the cluster closest to each node, and calculate the shortest distance between each node and its corresponding nearest cluster; determine the inference error based on the shortest distance, and then determine and output the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error.

[0208] According to the technical solution of this application embodiment, anomalies are detected by combining node reconstruction and clustering, which assists decision-making, improves the accuracy of anomaly detection methods based on spatiotemporal data, and helps to avoid abnormal events in a timely manner.

[0209] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can occur depending on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. An anomaly detection method based on spatiotemporal data, characterized in that, include: Receive an anomaly detection request, obtain the corresponding driving trajectory data, and generate an undirected graph based on the driving trajectory data; Perform a node reconstruction task on each node in the undirected graph, and then determine the reconstruction loss value corresponding to each node; Each node used to generate the undirected graph corresponds to a parking spot of a vehicle. The node trajectory features used to generate each node of the undirected graph include: time period distribution, node dwell time distribution, road network features, and POI distribution features; the node reconstruction task performed on each node in the undirected graph includes: for a node in the undirected graph, when performing the node reconstruction task, setting the initial features of the node to 0, and reconstructing the node trajectory features of the node based on the aggregated node trajectory features of the node's neighboring nodes in the undirected graph, to obtain the reconstructed features of the node; Cluster the nodes to generate corresponding clusters; Determine the cluster closest to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster. The inference error is determined based on the shortest distance, and then the abnormal nodes in the undirected graph are determined and output based on the reconstruction loss value, the shortest distance, and the inference error.

2. The method according to claim 1, characterized in that, The generation of an undirected graph based on the driving trajectory data includes: Extract the dwell time from the driving trajectory data, and then determine the dwelling location based on the dwell time; Based on the driving trajectory data, the connection frequency between each of the aforementioned parking sites is determined; An undirected graph is generated based on the residency plots and the connection frequency.

3. The method according to claim 2, characterized in that, The generation of an undirected graph based on the resident plots and the connection frequency includes: The trajectory information corresponding to each of the aforementioned residential plots is extracted as node trajectory features, and the connection frequency is used as edge features. Then, an undirected graph is generated based on the node trajectory features and edge features.

4. The method according to claim 1, characterized in that, The process of determining outlier nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error includes: An anomaly score is determined based on the reconstruction loss value, the shortest distance, and the inference error; Based on the anomaly score, the abnormal nodes in the undirected graph are determined.

5. The method according to claim 2, characterized in that, The node reconstruction task performed on each node in the undirected graph includes: A node reconstruction task is generated based on each node in the undirected graph; The network model is invoked to execute the reconstruction tasks of each node, thereby generating the reconstruction features of each node.

6. The method according to claim 5, characterized in that, Determining the reconstruction loss value corresponding to each node includes: For each node in the undirected graph, the difference between the corresponding reconstruction feature and the corresponding node trajectory feature is calculated, and then the difference value is determined as the reconstruction loss value corresponding to the node.

7. The method according to claim 5, characterized in that, The calculation of the shortest distance between each node and its nearest cluster includes: Determine the center point of each of the aforementioned clusters; The inference network model is invoked to calculate the shortest distance between each node and the center point of the nearest cluster, and then the shortest distance between each node and the nearest cluster is determined.

8. The method according to claim 7, characterized in that, The calculation of the shortest distance between each node and the centroid of the nearest cluster includes: Determine the shortest hop count and total connection frequency from each node to the nearest cluster center; Based on the shortest hop count and the total connection frequency, calculate the shortest distance between each node and the center point of the nearest cluster.

9. The method according to claim 7, characterized in that, Prior to the invocation of the reconstructed network model, the method further includes: Obtain the first initial neural network model; A training sample set is obtained, which includes sample node trajectory features. The sample node trajectory features are used as the input of the first initial neural network model and as the expected output of the first initial neural network model. The first initial neural network model is trained with the goal of minimizing the reconstruction loss value to obtain the reconstructed network model.

10. The method according to claim 8, characterized in that, Prior to invoking the inference network model, the method further includes: Obtain the second initial neural network model; The output node trajectory features of the last layer of the encoder in the reconstructed network model obtained through training are obtained and used as the input of the second initial neural network model. The shortest distance from the node corresponding to the output node trajectory features to the center point of the corresponding cluster is obtained and used as the expected output of the second initial neural network model. The second initial neural network model is trained with the goal of minimizing the inference error to obtain the inference network model.

11. The method according to claim 1, characterized in that, The generation of an undirected graph based on the driving trajectory data includes: Acquire road network data and point-of-interest (POI) data; An undirected graph is generated based on the driving trajectory data, the road network data, and the point of interest data.

12. An anomaly detection device based on spatiotemporal data, characterized in that, include: The receiving unit is configured to receive an anomaly detection request, obtain the corresponding driving trajectory data, and generate an undirected graph based on the driving trajectory data. The reconstruction unit is configured to perform node reconstruction tasks on each node in the undirected graph, thereby determining the reconstruction loss value corresponding to each node; Each node used to generate the undirected graph corresponds to a parking spot of a vehicle. The node trajectory features used to generate each node of the undirected graph include: time period distribution, node dwell time distribution, road network features, and POI distribution features; the node reconstruction task performed on each node in the undirected graph includes: for a node in the undirected graph, when performing the node reconstruction task, setting the initial features of the node to 0, and reconstructing the node trajectory features of the node based on the aggregated node trajectory features of the node's neighboring nodes in the undirected graph, to obtain the reconstructed features of the node; The cluster generation unit is configured to cluster the nodes to generate corresponding clusters; The distance calculation unit is configured to determine the cluster closest to each node, and then calculate the shortest distance between each node and its corresponding nearest cluster. An anomaly detection unit is configured to determine the inference error based on the shortest distance, and then determine and output the abnormal nodes in the undirected graph based on the reconstruction loss value, the shortest distance, and the inference error.

13. An anomaly detection electronic device, characterized in that, include: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-11.

14. A computer-readable medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-11.

Images