Abnormal operator detection method and device, computer device, and storage medium

Abstract

The application discloses an abnormal operator detection method and device, computer equipment and a storage medium. The method comprises the following steps: obtaining a target learning model, wherein the target learning model is composed of a plurality of target operators in a software stack to be detected; performing multi-round training on the target learning model, and generating an operator statistical feature set corresponding to each target operator according to the operator description parameters of each target operator in the training process; clustering each target operator into a plurality of network clusters in a network cluster set according to the operator statistical feature set of each target operator; identifying an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set, and identifying the target operator clustered into the abnormal network cluster as an abnormal operator. Through the technical scheme of the embodiment of the application, the dependence on artificial experience in the detection process of the abnormal operator can be reduced, and the detection efficiency and accuracy of the abnormal operator in the software stack can be improved.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to computer software technology, and particularly relate to an abnormal operator detection method and device, a computer device and a storage medium. BACKGROUND

[0002] In order to ensure the calculation accuracy of each operator in the chip software stack, it is necessary to detect the abnormality of each operator in the software stack. In the prior art, the work experience of the staff is usually relied on, and the staff manually identifies the abnormal operator.

[0003] However, the method used in the prior art has high dependence on the work experience of the staff, lacks quantitative abnormal operator evaluation criteria, and the detection efficiency of the abnormal operator is low. Therefore, how to quickly and accurately detect the abnormal operator is a problem to be solved at present. SUMMARY

[0004] Embodiments of the present application provide an abnormal operator detection method and device, a computer device and a storage medium to quickly and accurately detect abnormal operators in a software stack.

[0005] In a first aspect, embodiments of the present application provide an abnormal operator detection method, comprising:

[0006] obtaining a target learning model, the target learning model being composed of a plurality of target operators in a software stack to be tested;

[0007] training the target learning model for multiple rounds, and generating a set of operator statistical features corresponding to each target operator according to the operator description parameters of each target operator in the training process;

[0008] clustering each target operator into a plurality of network clusters in a network cluster set according to the set of operator statistical features of each target operator;

[0009] identifying an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set, and identifying the target operator clustered into the abnormal network cluster as an abnormal operator.

[0010] In a second aspect, embodiments of the present application also provide an abnormal operator detection device, which comprises:

[0011] a model obtaining module configured to obtain a target learning model, the target learning model being composed of a plurality of target operators in a software stack to be tested;

[0012] a data processing module configured to train the target learning model for multiple rounds, and generate a set of operator statistical features corresponding to each target operator according to the operator description parameters of each target operator in the training process;

[0013] a network cluster generation module, configured to cluster each target operator into a plurality of network clusters in a network cluster set according to a set of operator statistical features of each target operator;

[0014] an abnormal operator identification module, configured to identify an abnormal network cluster in the network cluster set according to a distance difference between cluster center points of each network cluster in the network cluster set, and identify a target operator clustered into the abnormal network cluster as an abnormal operator.

[0015] In a third aspect, an embodiment of the present application further provides a computer device, which comprises:

[0016] one or more processors;

[0017] a storage device configured to store one or more programs,

[0018] When the one or more programs are executed by the one or more processors, the one or more processors implement the detection method of the abnormal operator according to any embodiment of the present application.

[0019] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the detection method of the abnormal operator according to any embodiment of the present application.

[0020] The technical scheme of the embodiment of the present application solves the problem of high dependence on artificial experience in the prior art when detecting an abnormal operator, and the problem of low detection efficiency and accuracy of the abnormal operator, and can improve the detection efficiency and accuracy of the abnormal operator in the software stack, by the following technical means: performing multi-round training on a target learning model comprising a plurality of target operators, and generating a set of operator statistical features corresponding to each target operator according to operator description parameters of each target operator in the training process; clustering each target operator into a plurality of network clusters in a network cluster set according to the set of operator statistical features of each target operator; identifying an abnormal network cluster in the network cluster set according to a distance difference between cluster center points of each network cluster in the network cluster set, and identifying a target operator clustered into the abnormal network cluster as an abnormal operator. BRIEF DESCRIPTION OF DRAWINGS

[0021] Figure 1 is a flowchart of the detection method of the abnormal operator in the first embodiment of the present application;

[0022] Figure 2a is a flowchart of the detection method of the abnormal operator in the second embodiment of the present application;

[0023] Figure 2b is a flow chart of an optional abnormal operator detection method in the second embodiment of the present application;

[0024] Figure 2c is a flow chart of an optional abnormal network cluster discrimination method in the second embodiment of the present application;

[0025] Figure 3 is a structural schematic diagram of an abnormal operator detection device in the third embodiment of the present application;

[0026] Figure 4a is a structural schematic diagram of a computer device in the fourth embodiment of the present application;

[0027] Figure 4b is a structural schematic diagram of an optional abnormal operator detection system in the fourth embodiment of the present application. DETAILED DESCRIPTION

[0028] The present application will be further described below in conjunction with the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, but not all the structures.

[0029] Embodiment I

[0030] Figure 1 is a flow chart of an abnormal operator detection method provided by the first embodiment of the present application. The present embodiment can be applicable to the case of detecting an abnormal operator in a software stack whose computing performance is different from that of most normal operators. The method can be executed by an abnormal operator detection device, which can be realized in the form of hardware and / or software, and generally can be integrated in a computer device. The method specifically includes the following steps:

[0031] S110, obtaining a target learning model, the target learning model being composed of a plurality of target operators in a software stack to be tested.

[0032] The target operator can refer to an operator to be detected in the software stack. The operator can refer to a symbol for mapping, transforming or operating functions or parameters, for example, an addition operator, an integral operator or a probability operator, etc. The target learning model can refer to a machine learning model constructed by a plurality of target operators and the connection relationship between the plurality of target operators.

[0033] S120, performing multiple rounds of training on the target learning model, and generating a set of operator statistical features corresponding to each target operator according to the operator description parameters of each target operator in the training process.

[0034] The operator description parameter can refer to original sample data used to describe each target operator in the training process of the target learning model. For example, the original data sample of the forward step of each target operator, such as a parameter matrix, or the original data sample of the backward step of each target operator, such as a gradient matrix. Embodiments of the present application do not limit this. The operator statistical feature set can refer to a feature set generated by analyzing and counting the features of each target operator according to the operator description parameter. One operator statistical feature set includes one or more operator statistical features. Each operator statistical feature can be understood as one or more scalar statistical values in a set statistical dimension.

[0035] That is, in the process of training the target learning model for multiple rounds, multiple original sample data (typically, one or more of the parameter matrix and the gradient matrix) can be calculated for each target operator used in the target learning model. The original sample data in the form of the above matrix cannot be directly clustered for each target operator. Further, the inventors creatively propose to convert the original sample data in the form of the above matrix into operator statistical features in the form of scalar to better cluster each target operator.

[0036] In an optional embodiment, the target learning model is trained for multiple rounds, and operator statistical feature sets corresponding to each target operator are generated according to the operator description parameters of each target operator in the training process, which can include:

[0037] The target learning model is trained for multiple rounds, and the operator description parameters of each target operator are obtained when each round of training is completed. A plurality of operator statistical features corresponding to each target operator are generated by statistically analyzing a plurality of sets of operator description parameters of each target operator. The operator statistical feature is a statistical value in a set statistical dimension. An operator statistical feature set corresponding to each target operator is generated according to the plurality of operator statistical features corresponding to each target operator. The operator statistical feature can refer to a new feature obtained by preprocessing according to feature conversion, so that the feature dimensions of each target operator are consistent.

[0038] Optionally, the operator description parameter includes at least one of an operator parameter matrix and an operator gradient matrix. The operator statistical feature includes at least one of the following: an L1 norm of a matrix, an L2 norm of a matrix, a matrix mean, a matrix standard deviation, a 25% quantile of a matrix, and a 75% quantile of a matrix.

[0039] Optionally, each operator statistical feature of each target operator includes a plurality of operator statistical features, and each operator statistical feature can include one or more statistical values in a set statistical dimension. Specifically, during the multiple rounds of training, a plurality of operator parameter matrices or operator gradient matrices (the number corresponds to the number of rounds) can be obtained, and for the plurality of operator parameter matrices or operator gradient matrices, a plurality of statistical values corresponding to the same operator statistical feature can be calculated. Furthermore, the plurality of statistical values corresponding to each operator statistical feature can be directly stored, or the plurality of statistical values can be statistically averaged to obtain one statistical value corresponding to each operator statistical feature, and the embodiment does not limit this.

[0040] Taking the plurality of statistical values of each operator statistical feature of each target operator as an example, specifically, first, the target learning model is trained for multiple rounds, and at least one of the operator parameter matrix and the operator gradient matrix of each target operator is obtained when each round of training is completed; then, the default initial value of the operator description parameter stored before the first round of training of the target learning model is filtered out, and the remaining operator description parameters are statistically analyzed to obtain each statistical value of the operator statistical feature of each target operator after each round of training, such as at least one of the L1 norm of the matrix, the L2 norm of the matrix, the matrix mean, the matrix standard deviation, the 25% quantile of the matrix, and the 75% quantile of the matrix.

[0041] Further, considering that the dimensions of the obtained operator statistical features are different, in order to improve the accuracy of subsequent clustering processing, a preset unified dimension algorithm, typically a z-score (Z-score) standardization processing algorithm, can be used to unify the dimensions of different operator statistical features.

[0042] Specifically, the formula The plurality of statistical values of each operator statistical feature of each target operator after each round of training can be standardized respectively.

[0043] Wherein, X can be any statistical value corresponding to the same operator statistical feature, Mean can be the mean of the statistical values corresponding to the same operator statistical feature, and Std can be the standard deviation of the statistical values corresponding to the same operator statistical feature.

[0044] Specifically, assuming that the target operator A obtains three L1 norms (X1, X2 and X3) corresponding to the parameter matrix of the target operator after three rounds of training. Furthermore, the Mean and Std corresponding to the three L1 norms can be calculated, and then the Z-score of X1, X2 and X3 can be calculated by the above formula as the L1 norm of the parameter matrix of the target operator A.

[0045] Finally, the target operators and the corresponding multiple operator statistical features are collected to generate an operator statistical feature set corresponding to each target operator. Thus, the operator statistical feature set corresponding to each target operator can be generated by the operator description parameters of the target operators, providing an effective basis for subsequent steps.

[0046] S130, according to the operator statistical feature set of each target operator, clustering the target operators into multiple network clusters of the network cluster set.

[0047] The network cluster set can refer to a set of network clusters in the network topology graph corresponding to the target operators. For example, the network cluster division can be performed by pre-specifying the number of network clusters, or by automatic clustering.

[0048] In an optional embodiment, according to the operator statistical feature set of each target operator, the target operators can be clustered into multiple network clusters of the network cluster set, which can include:

[0049] A growing neural gas algorithm is used to generate a network topology graph matching the operator statistical feature set of each target operator, the network topology graph including multiple neurons, and the neurons having neuron feature sets identical to the data form of the operator statistical feature set. The network topology graph is pruned to form a network cluster set. The cluster center point corresponding to each network cluster in the network cluster set is determined, and each target operator is clustered into a matching network cluster according to the distance between the target operator and each cluster center point.

[0050] The growing neural gas (GNG) algorithm can refer to an algorithm that allows adaptive clustering of input data, thereby avoiding the need to pre-set the number of clustering clusters in existing clustering algorithms and improving the accuracy of clustering. The pruning process can refer to deleting edges in the network topology graph that do not meet the set requirements, so that the processed network cluster set is more accurate.

[0051] Specifically, first, a network topology graph matching the operator statistical feature set of each target operator is generated. Then, the network topology graph is pruned to form a network cluster set. Further, the cluster center point corresponding to each network cluster in the network cluster set is determined, and the network cluster is associated with the target operator using the cluster center point. Thus, the network cluster corresponding to the target operator statistical feature set can be obtained, providing an effective basis for subsequent identification of abnormal operators based on the state of the network cluster.

[0052] S140, according to the distance difference between the cluster center points of each network cluster in the network cluster set, identifying an abnormal network cluster in the network cluster set, and identifying the target operator clustered into the abnormal network cluster as an abnormal operator.

[0053] The abnormal network cluster can refer to a network cluster whose distance from the cluster center point of the network cluster to the cluster center point of another network cluster does not satisfy a set condition. The abnormal operator can refer to a target operator corresponding to the abnormal network cluster, that is, an operator that can affect the target learning model. Therefore, by identifying the abnormal network cluster, the detection of the abnormal operator can be realized, which can significantly improve the detection efficiency and accuracy of the abnormal operator.

[0054] The technical scheme of the embodiment of the application trains the target learning model containing multiple target operators in multiple rounds, generates operator statistical feature sets corresponding to each target operator according to the operator description parameters of each target operator in the training process, clusters each target operator into multiple network clusters of a network cluster set according to the operator statistical feature sets of each target operator, identifies an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set, and identifies the target operator clustered into the abnormal network cluster as an abnormal operator. By applying the operator to the machine learning model to assign model parameters to the operator, the operator can be expressed in the dimension of numerical values, and the abnormal operator whose numerical features deviate from the normal operator numerical range can be obtained through clustering and other means. The problem of high dependence on manual experience in the prior art for detecting abnormal operators, resulting in low detection efficiency and accuracy of abnormal operators, can be solved, and the detection efficiency and accuracy of abnormal operators in the software stack can be improved.

[0055] Embodiment two

[0056] Figure 2a The flowchart of the abnormal operator detection method provided by the second embodiment of the application is based on the above-mentioned embodiment and is further refined. In this embodiment, the operation of identifying an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set is further refined as follows: calculating the average distance of each cluster center point from other cluster center points; calculating the normalized probability value of each cluster center point according to the average distance corresponding to each cluster center point; determining whether there is a network cluster with a normalized probability value greater than or equal to a normalized probability threshold; if yes, determining the network cluster as an abnormal network cluster; otherwise, merging the two network clusters with the highest and second highest normalized probability values to obtain a new network cluster; calculating the average of the average distances corresponding to the cluster center points of the two network clusters, and determining the average calculation result as the average distance corresponding to the cluster center point of the new network cluster; returning to perform the operation of calculating the normalized probability value of each cluster center point according to the average distance corresponding to each cluster center point until the cluster merging times reach a merging times threshold. As shown in FIG. 8, the method comprises the following steps. Figure 2a

[0057] ​S210, acquire a target learning model, the target learning model is composed of a plurality of target operators in the software stack to be tested.

[0058] S220, perform multi-round training on the target learning model, and acquire operator description parameters of each target operator when each round of training is completed.

[0059] S230, statistically analyze a plurality of sets of operator description parameters of each target operator, generate a plurality of operator statistical features respectively corresponding to each target operator, and the operator statistical features are statistical values under a set statistical dimension.

[0060] S240, generate an operator statistical feature set respectively corresponding to each target operator according to a plurality of operator statistical features respectively corresponding to each target operator.

[0061] S250, generate a network topology graph matched with the operator statistical feature set of each target operator by using a growing neural gas algorithm, the network topology graph includes a plurality of neurons, and the neurons have a neuron feature set in the same data form as the operator statistical feature set.

[0062] S260, prune the network topology graph to form a network cluster set.

[0063] In an optional implementation, pruning the network topology graph includes at least one of the following: deleting an edge in the network topology graph whose utilization is less than or equal to the network average utilization; and deleting an edge in the network topology graph whose distance to other edges is greater than or equal to twice the network average edge distance. The utilization can refer to the use probability of each edge in the network topology graph. Specifically, when there is an edge in the network topology graph whose utilization is less than or equal to the network average utilization or whose distance to other edges is greater than or equal to twice the network average edge distance, the edge satisfying any of the above conditions is deleted, thereby ensuring the accuracy of the network cluster set.

[0064] S270, determine a neuron set belonging to different network clusters in the network cluster set by using a breadth-first search algorithm.

[0065] The breadth-first search algorithm can refer to a graph search algorithm that starts from a root node and traverses the nodes of a tree along the width of the tree. The neuron set of different clusters can be obtained by traversing the network topology graph by using the breadth-first search algorithm.

[0066] S280, determine a cluster center point respectively corresponding to each network cluster according to the neuron feature set of each neuron in each neuron set.

[0067] The neuron feature set can refer to a set containing various neuron features. Specifically, the neuron feature set of each neuron in each neuron set can be averaged to obtain a cluster center point corresponding to each network cluster.

[0068] S290, according to the distance between each target operator and each cluster center point, the target operators are clustered into the matched network cluster.

[0069] Specifically, the distance between each target operator and each cluster center point can be calculated by the Euclidean distance formula 1i x i represents the i-th dimensional coordinate of the target operator, x 2i x i represents the i-th dimensional coordinate of the cluster center point, and then the network cluster corresponding to the cluster center point closest to the target operator is taken as the network cluster matched with the target operator according to the nearest distance principle. Thus, the matching between the target operator and the network cluster is realized, which provides an effective basis for subsequent abnormal operator identification.

[0070] S2100, the average distance between each cluster center point and other cluster center points is calculated.

[0071] The average distance can refer to the average value of the Euclidean distance between each cluster center point and other cluster center points.

[0072] S2110, according to the average distance corresponding to each cluster center point, the normalized probability value of each cluster center point is calculated.

[0073] The normalized probability value can be calculated by the formula wherein, softmax( y ) i y i can refer to the normalized probability value of the i-th cluster center point, y i n can refer to the total number of cluster center points. Thus, each normalized probability value can be mapped to the interval of 0 to 1, and the sum of all normalized probability values is 1.

[0074] S2120, it is judged whether there is a network cluster with a normalized probability value greater than or equal to a normalized probability threshold value, if yes, S2160 is executed; if no, S2130 is executed.

[0075] ​The normalized probability threshold value can be a value for evaluating the normalized probability. For example, in an embodiment of the present application, the normalized probability threshold value can be set to 0.5. That is, when the normalized probability is greater than or equal to 0.5, it indicates that the distance from the cluster center point of the network cluster to the cluster center points of other network clusters is half of the sum of the average distances from each cluster center point to the cluster center points of other clusters, that is, the network cluster deviates from the remaining network clusters, and the network cluster can be determined as an abnormal network cluster.

[0076] S2130, detecting whether the current cluster merging number reaches a merging number threshold value. If yes, ending the flow and determining that the abnormal operator is not included in each target operator; otherwise, performing S2140.

[0077] The merging number threshold value can be a value for evaluating the cluster merging number. For example, the merging number threshold value can be twice or three times, and the embodiment of the present application does not limit this.

[0078] Specifically, according to the average distance from the cluster center point of the new network cluster to the cluster center points of other clusters, the normalized probability value of each cluster center point is recalculated. If there is a network cluster with a normalized probability value greater than or equal to the normalized probability threshold value, the network cluster is determined as an abnormal network cluster. Otherwise, the operation of merging the two network clusters with the highest and second highest normalized probability values to obtain a new network cluster is continued until the cluster merging number reaches the merging number threshold value.

[0079] S2140, merging the two network clusters with the highest and second highest normalized probability values to obtain a new network cluster.

[0080] Specifically, if there is no network cluster with a normalized probability value greater than or equal to the normalized probability threshold value, the network clusters are sorted in descending order of the normalized probability value, and the depth-first search algorithm is used to merge the network clusters with the highest and second highest normalized probability values to generate a new network cluster. In this way, when the average distances of the two network clusters with the highest and second highest normalized probability values are both greater than the average distances of most normal network clusters, the two network clusters can share a certain normalized probability value, and neither of them exceeds 50%. Thus, the situation that both of the two network clusters are abnormal network clusters and are missed can be avoided, and the accuracy of the abnormal operator detection is improved.

[0081] S2150, calculating the average distance corresponding to the cluster center points of the two network clusters, and determining the average distance as the average distance corresponding to the cluster center point of the new network cluster, and returning to perform S2110.

[0082] Specifically, the average distances corresponding to the network clusters with the highest and the second highest normalized probability values are averaged to obtain the average distance corresponding to the cluster center point of the new network cluster, thereby ensuring the accuracy of the anomaly operator detection while reducing the computational burden of the computing device and improving the detection efficiency of the anomaly operator.

[0083] S2160, determining the network cluster as an abnormal network cluster.

[0084] S2170, identifying the target operator clustered into the abnormal network cluster as an abnormal operator.

[0085] The technical scheme of the embodiment of the present application comprises the following steps: performing multi-round training on a target learning model containing multiple target operators, and statistically analyzing the operator description parameters of each target operator in the training process to generate multiple operator statistical features corresponding to each target operator respectively; then generating a network topology graph matched with the operator statistical feature set of each target operator according to the operator statistical feature set of each target operator; performing pruning processing on the network topology graph to form a network cluster set; determining a cluster center point corresponding to each network cluster according to the neuron feature set of each neuron in each neuron set; and clustering each target operator into a matched network cluster according to the distance between each target operator and each cluster center point; finally, calculating the average distance between each cluster center point and other cluster center points, and calculating the normalized probability value of each cluster center point according to the average distance corresponding to each cluster center point; when there is a network cluster with a normalized probability value greater than or equal to a normalized probability threshold, the network cluster is determined as an abnormal network cluster, and the target operator clustered into the abnormal network cluster is identified as an abnormal operator; when there is no network cluster with a normalized probability value greater than or equal to a normalized probability threshold, the two network clusters with the highest and the second highest normalized probability values are merged to obtain a new network cluster; further, the average distances corresponding to the cluster center points of the two network clusters are averaged, and the average calculation result is determined as the average distance corresponding to the cluster center point of the new network cluster; the operation of calculating the normalized probability value of each cluster center point according to the average distance corresponding to each cluster center point is returned to be executed until the number of cluster mergers reaches a merging threshold. The problem of high dependence on artificial experience in the prior art for detecting abnormal operators, resulting in low detection efficiency and accuracy of abnormal operators, is solved, and the detection efficiency and accuracy of abnormal operators in the software stack can be improved.

[0086] Figure 2bAn optional flowchart of an abnormal operator detection method provided by the embodiment of the present application is provided; specifically, a target learning model is obtained and multiple rounds of training are performed on the target learning model to obtain operator description parameters of each target operator in the training process; then, the operator description parameters of each target operator are preprocessed to generate an operator statistical feature set corresponding to each target operator; further, a growing neural gas algorithm is used to generate a network topology graph matched with the operator statistical feature set of each target operator, and edges with utilization less than or equal to the average network utilization in the network topology graph are deleted; and edges with a distance greater than or equal to twice the average edge distance of the network in the network topology graph are deleted to realize pruning processing of the network topology graph, forming a network cluster set; further, a breadth-first search algorithm is used to determine a neuron set belonging to different network clusters in the network cluster set, and a cluster center point corresponding to each network cluster is determined according to the neuron feature set of each neuron in each neuron set; finally, differences in Euclidean distances between the cluster center points of each network cluster in the network cluster set are used to identify an abnormal network cluster in the network cluster set, and if the abnormal network cluster meets the abnormal network cluster determination method, an abnormal operator is output, and if the abnormal network cluster does not meet the abnormal network cluster determination method, "no abnormal operator" is returned.

[0087] Figure 2c An optional flowchart of an abnormal network cluster determination method provided by the embodiment of the present application is provided; specifically, the Euclidean distance between each cluster center point and other cluster center points is calculated; the average distance between each cluster center point and other cluster center points is calculated, and the normalized probability value of each cluster center point is calculated according to the average distance corresponding to each cluster center point; it is determined whether there is a network cluster with a normalized probability value greater than or equal to a normalized probability threshold; if yes, the network cluster is determined as an abnormal network cluster, and the target operator clustered into the abnormal network cluster is identified as an abnormal operator; otherwise, the two network clusters with the highest and second highest normalized probability values are merged to obtain a new network cluster; the average distance corresponding to the cluster center points of the two network clusters is calculated, and the average distance is determined as the average distance corresponding to the cluster center point of the new network cluster; the operation of calculating the normalized probability value of each cluster center point according to the average distance corresponding to each cluster center point is returned until the cluster merging times reach a merging times threshold, and "no abnormal cluster" is returned.

[0088] Embodiment three

[0089] Figure 3 A structural schematic diagram of an abnormal operator detection device provided by the third embodiment of the present application is provided, which can execute the abnormal operator detection method involved in each of the above embodiments. The device can be realized in the form of software and / or hardware, such as Figure 3As shown, the detection device of the abnormal operator specifically comprises: a model acquisition module 310, a data processing module 320, a network cluster generation module 330, and an abnormal operator identification module 340.

[0090] The model acquisition module 310 is configured to acquire a target learning model, wherein the target learning model is composed of a plurality of target operators in a software stack to be tested.

[0091] The data processing module 320 is configured to perform multi-round training on the target learning model, and generate a set of operator statistical features corresponding to each target operator according to the operator description parameters of each target operator in the training process.

[0092] The network cluster generation module 330 is configured to cluster each target operator into a plurality of network clusters of a network cluster set according to the set of operator statistical features of each target operator.

[0093] The abnormal operator identification module 340 is configured to identify an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set, and identify the target operator clustered into the abnormal network cluster as an abnormal operator.

[0094] The technical scheme of the embodiment of the application performs multi-round training on the target learning model containing a plurality of target operators, generates a set of operator statistical features corresponding to each target operator according to the operator description parameters of each target operator in the training process, clusters each target operator into a plurality of network clusters of a network cluster set according to the set of operator statistical features of each target operator, identifies an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set, and identifies the target operator clustered into the abnormal network cluster as an abnormal operator. By applying the operator to the machine learning model to assign model parameters to the operator, the operator can be expressed in the dimension of numerical values, and the abnormal operator whose numerical features deviate from the normal operator can be obtained through clustering and other means. The problem of high dependence on manual experience in the prior art, resulting in low detection efficiency and accuracy of the abnormal operator, can be solved, and the detection efficiency and accuracy of the abnormal operator in the software stack can be improved.

[0095] Optionally, the data processing module 320 can specifically include a data acquisition unit, a first data processing unit, and a second data processing unit.

[0096] The data acquisition unit is configured to perform multi-round training on the target learning model, and acquire the operator description parameters of each target operator when each round of training is completed.

[0097] The first data processing unit is configured to perform statistical analysis on the multiple sets of operator description parameters of each target operator, and generate multiple operator statistical features corresponding to each target operator respectively, the operator statistical feature being a statistical value under a set statistical dimension;

[0098] The second data processing unit is configured to generate an operator statistical feature set corresponding to each target operator respectively according to the multiple operator statistical features corresponding to each target operator respectively.

[0099] Optionally, the operator description parameter comprises at least one of an operator parameter matrix and an operator gradient matrix; and the operator statistical feature comprises at least one of an L1 norm of a matrix, an L2 norm of a matrix, a matrix mean value, a matrix standard deviation, a 25% quantile of a matrix, and a 75% quantile of a matrix.

[0100] Optionally, the network cluster generation module 330 can specifically include a network topology graph generation unit, a network cluster set generation unit, and an operator clustering unit.

[0101] The network topology graph generation unit is configured to generate a network topology graph matched with the operator statistical feature set of each target operator by using a growing neural gas algorithm, the network topology graph including multiple neurons, and each neuron having a neuron feature set in the same data form as the operator statistical feature set.

[0102] The network cluster set generation unit is configured to perform pruning processing on the network topology graph to form a network cluster set.

[0103] The operator clustering unit is configured to determine a cluster center point corresponding to each network cluster in the network cluster set, and cluster each target operator into a matched network cluster according to the distance between each target operator and each cluster center point.

[0104] Optionally, the network cluster set generation unit can specifically include at least one of the following:

[0105] an edge in the network topology graph with a utilization less than or equal to a network average utilization is deleted; and

[0106] an edge in the network topology graph with a distance greater than or equal to twice a network average edge distance is deleted.

[0107] Optionally, the operator clustering unit can specifically be configured to determine a neuron set belonging to different network clusters in the network cluster set by using a breadth-first search algorithm, and determine a cluster center point corresponding to each network cluster according to the neuron feature set of each neuron in each neuron set.

[0108] Optionally, the anomaly operator identification module 340 can specifically be used to calculate the average distance between each cluster center point and the other cluster center points; calculate the normalized probability value of each cluster center point based on the average distance corresponding to each cluster center point; determine whether there is a network cluster with a normalized probability value greater than or equal to the normalized probability threshold; if so, the network cluster is identified as an abnormal network cluster; otherwise, the two network clusters with the highest and second highest normalized probability values ​​are merged to obtain a new network cluster; the average distances corresponding to the cluster center points of the two network clusters are averaged, and the average result is determined as the average distance corresponding to the cluster center point of the new network cluster; return to execute the operation of calculating the normalized probability value of each cluster center point based on the average distance corresponding to each cluster center point, until the number of cluster merging reaches the merging number threshold.

[0109] The anomaly operator detection device provided in this embodiment of the invention can execute the anomaly operator detection method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0110] Example 4

[0111] Figure 4a This is a schematic diagram of the structure of a computer device provided in Embodiment 4 of the present invention, as shown below. Figure 4a As shown, the computer device includes a processor 410, a memory 420, an input device 430, and an output device 440; the number of processors 410 in the computer device can be one or more. Figure 4a Taking a processor 410 as an example; the processor 410, memory 420, input device 430, and output device 440 in a computer device can be connected via a bus or other means. Figure 4a Taking the example of a connection between China and Israel via a bus.

[0112] The memory 420, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the anomaly operator detection method in this embodiment of the invention (e.g., the model acquisition module 310, data processing module 320, network cluster generation module 330, and anomaly operator identification module 340 in the anomaly operator detection device). The processor 410 executes various functional applications and data processing of the computer device by running the software programs, instructions, and modules stored in the memory 420, thereby implementing the aforementioned anomaly operator detection method.

[0113] The method includes:

[0114] Obtain the target learning model, which is composed of multiple target operators in the software stack under test;

[0115] The target learning model is trained for multiple rounds, and according to the operator description parameters of each target operator in the training process, an operator statistical feature set corresponding to each target operator is generated;

[0116] According to the operator statistical feature set of each target operator, each target operator is clustered into a plurality of network clusters in the network cluster set;

[0117] According to the distance difference between the cluster center points of each network cluster in the network cluster set, an abnormal network cluster is identified in the network cluster set, and the target operator clustered into the abnormal network cluster is identified as an abnormal operator.

[0118] The memory 420 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the terminal, etc. In addition, the memory 420 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some examples, the memory 420 can further include a memory remotely arranged with respect to the processor 410, which can be connected to the computer device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0119] The input device 430 can be used to receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device. The output device 440 can include a display device such as a display screen.

[0120] Figure 4b An optional abnormal operator detection system structure schematic diagram provided by the embodiment of the application; specifically, the preferred abnormal operator detection system can include: an I / O bus 0001, a PCIE bus 0002, a user interface 0003, a network interface 0004, a disk controller 0005, a main memory 0006, a processor 0007 such as a CPU, and a coprocessor 0008 such as a GPU or a DTU. Wherein, the I / O bus 0001 is used to realize the connection communication between the components user interface 0003, the network interface 0004, the disk controller 0005 and the main memory 0006. The user interface 0003 can include a display screen and other input units such as a keyboard. The network interface 0004 can include a standard wired interface or a wireless interface (such as a WI-FI interface). The main memory 0006 can be a high-speed DRAM memory.

[0121] Embodiment five

[0122] The fifth embodiment of the present application also provides a storage medium comprising computer executable instructions for executing an abnormal operator detection method when executed by a computer processor, the method comprising:

[0123] obtaining a target learning model, the target learning model being constructed using a plurality of target operators in the software stack to be tested;

[0124] training the target learning model for multiple rounds, and generating a set of operator statistical features corresponding to each target operator according to the operator description parameters of each target operator in the training process;

[0125] clustering each target operator into a plurality of network clusters in the network cluster set according to the set of operator statistical features of each target operator;

[0126] identifying an abnormal network cluster in the network cluster set according to the distance difference between the cluster center points of each network cluster in the network cluster set, and identifying the target operators clustered into the abnormal network cluster as abnormal operators.

[0127] Of course, the computer executable instructions of the storage medium provided by the embodiment of the present application are not limited to the method operations described above, and can also perform related operations in the abnormal operator detection method provided by any embodiment of the present application.

[0128] From the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary general hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH, a hard disk or an optical disk, etc., including a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present application.

[0129] It is worth noting that in the above embodiments of the abnormal operator detection device, each unit and module included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of each functional unit are only for easy differentiation, and do not limit the protection scope of the present application.

[0130] Note that the above merely describes preferred embodiments of the present application and the principles of the technology applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and that various obvious changes, modifications and substitutions can be made without departing from the scope of the present application. Therefore, although the present application has been described in detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the claims.

Claims

1. A method for detecting anomaly operators, characterized in that, include: Obtain the target learning model, which is composed of multiple target operators in the software stack under test; The target learning model is trained in multiple rounds, and the operator description parameters of each target operator are obtained at the end of each round of training; where the operator description parameters refer to the original sample data that describes each target operator during the training process of the target learning model. Statistical analysis is performed on multiple sets of operator description parameters for each target operator to generate multiple operator statistical features corresponding to each target operator. The operator statistical features are statistical values ​​under a set statistical dimension. Based on the statistical features of multiple operators corresponding to each target operator, generate a set of operator statistical features corresponding to each target operator. Based on the operator statistical feature set of each objective operator, each objective operator is clustered into multiple network clusters in the network cluster set; Based on the distance differences between the cluster centers of each network cluster in the network cluster set, abnormal network clusters are identified in the network cluster set, and the target operators that are clustered into abnormal network clusters are identified as abnormal operators; where abnormal network clusters refer to network clusters whose distances from the cluster center of a network cluster to the cluster centers of other network clusters do not meet the set conditions.

2. The method according to claim 1, characterized in that, The operator description parameters include at least one of the operator parameter matrix and the operator gradient matrix; The statistical characteristics of the operator include at least one of the following: the L1 norm of the matrix, the L2 norm of the matrix, the mean of the matrix, the standard deviation of the matrix, the 25th percentile of the matrix, and the 75th percentile of the matrix.

3. The method according to claim 1, characterized in that, Based on the operator statistical feature set of each objective operator, each objective operator is clustered into multiple network clusters in the network cluster set, including: The growing neural gas algorithm is used to generate a network topology graph that matches the operator statistical feature set of each target operator. The network topology graph includes multiple neurons, and each neuron has a neuron feature set with the same data format as the operator statistical feature set. Pruning is performed on the network topology graph to form a set of network clusters; Determine the cluster center point corresponding to each network cluster in the network cluster set, and cluster each target operator into the matching network cluster based on the distance between each target operator and each cluster center point.

4. The method according to claim 3, characterized in that, Pruning a network topology graph includes at least one of the following: Delete edges in the network topology graph whose utilization is less than or equal to the average network utilization; and Delete edges in the network topology graph that are at least twice the average distance to other edges.

5. The method according to claim 3, characterized in that, Determine the cluster center point corresponding to each network cluster in the network cluster set, including: A breadth-first search algorithm is used to determine the set of neurons belonging to different network clusters in the network cluster set; Based on the neuron feature set of each neuron in each neuron set, determine the cluster center point corresponding to each network cluster.

6. The method according to any one of claims 1-5, characterized in that, Based on the distance differences between the cluster centers of each network cluster in the network cluster set, abnormal network clusters are identified in the network cluster set, including: Calculate the average distance between each cluster center and all other cluster centers; Calculate the normalized probability value of each cluster center point based on the average distance to each cluster center point; Determine whether there are network clusters whose normalized probability values ​​are greater than or equal to the normalized probability threshold; If so, the network cluster is identified as an abnormal network cluster; otherwise, the two network clusters with the highest and second highest normalized probability values ​​are merged to obtain a new network cluster. The average distances to the cluster centers of the two network clusters are calculated and the average distances are determined as the average distances to the cluster centers of the new network cluster. Return to the previous step and calculate the normalized probability value of each cluster center point based on the average distance to each cluster center point, until the number of cluster merges reaches the merge count threshold.

7. A device for detecting anomaly operators, characterized in that, include: The model acquisition module is used to acquire the target learning model, which is composed of multiple target operators in the software stack under test. The data processing module is used to train the target learning model in multiple rounds and obtain the operator description parameters of each target operator at the end of each training round. The operator description parameters refer to the original sample data describing each target operator during the training process of the target learning model. Statistical analysis is performed on multiple sets of operator description parameters for each target operator to generate multiple operator statistical features corresponding to each target operator. These operator statistical features are statistical values ​​under a set statistical dimension. Based on the multiple operator statistical features corresponding to each target operator, a set of operator statistical features corresponding to each target operator is generated. The network cluster generation module is used to cluster each target operator into multiple network clusters in the network cluster set based on the operator statistical feature set of each target operator; The abnormal operator identification module is used to identify abnormal network clusters in the network cluster set based on the distance differences between the cluster centers of each network cluster in the network cluster set, and to identify the target operators that are clustered into the abnormal network clusters as abnormal operators; wherein, the abnormal network cluster refers to the network cluster whose distance from the cluster center of the network cluster to the cluster center of other network clusters does not meet the set conditions.

8. A computer device, characterized in that, The computer device includes: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method for detecting anomaly operators as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the method for detecting the anomaly operator as described in any one of claims 1-6.

Images