Active anomaly detection method and system combining density perception and detection difficulty

Abstract

This invention provides a proactive anomaly detection method and system that combines density perception and detection difficulty. The solution includes: employing an anomaly detection model based on a randomized binary tree, supporting rapid incremental updates; calculating query probability scores based on density variations and detection difficulty in leaf node regions, selecting the most valuable data samples for the current model; and updating the regional density and weights of leaf nodes using expert-labeled samples, effectively leveraging the domain knowledge provided by experts. This solution integrates expert domain knowledge with the anomaly detection model, improving the model's practical application performance.

Description

Technical Field

[0001] The present invention relates to the fields of machine learning and abnormal data processing, and in particular to an active anomaly detection method and system that combines density perception and detection difficulty in a data stream environment. Background Art

[0002] In the field of data stream processing, active anomaly detection aims to combine expert domain knowledge with anomaly detection models while minimizing manual judgment costs, thereby improving the actual application performance of the model. Figure 1 As shown in the figure, in a data stream environment, data samples arrive continuously. When a new data sample arrives, it is first evaluated by the anomaly detection model for anomaly scoring. Then, based on the sample's characteristics, the query strategy determines whether to submit it to the expert for judgment. After the query sample has been judged by the expert, it is returned to the anomaly detection model for real-time incremental updates. While ensuring anomaly detection performance, this process requires selecting as few samples as possible for expert judgment to reduce manual judgment costs.

[0003] Active anomaly detection needs to address two key issues:

[0004] (1) Query strategy formulation. In a data stream environment, data distribution changes over time. Query strategies need to adapt to data changes in a timely manner and accurately select valuable anomaly data. Existing methods often select the data with the highest anomaly score output by the current model as query data to update the model. This type of method has two problems: 1) It does not consider the impact of real-time data changes on the model, and the current model may no longer be applicable to newly arrived data; 2) The sample with the highest anomaly score does not necessarily bring the highest performance improvement for incremental model updates.

[0005] (2) Incremental update of anomaly detection models. In an active online anomaly detection environment, the number of samples that can be queried is small and the anomaly ratio in the data stream is low, making it difficult to select valid anomaly data. Incremental updates to the model directly based on query data will inevitably lead to deviations and make it difficult to learn the distribution characteristics of anomaly data. Existing methods mostly use all historically accumulated query data to retrain the model, which results in high computational and storage overhead. Summary of the Invention

[0006] In view of the above-mentioned problems existing in the prior art, the present invention provides a method and system for active anomaly detection that combines density perception and detection difficulty for data stream processing. Specifically, the present invention provides the following technical solutions:

[0007] In one aspect, the present invention provides a method for active anomaly detection that combines density perception and detection difficulty, the method comprising:

[0008] S1, build an anomaly detection model based on the data S accumulated in the initial stage of the data flow;

[0009] S2. Calculate the query probability score of the data sample based on the dynamic changes and detection difficulty of the data sample; select a preset percentage of data samples with the highest query probability score from each batch of data samples for expert judgment;

[0010] S3. After the current batch of data samples arrives, the anomaly detection model is updated, wherein the updating includes updating the density matrix and the weight matrix, wherein the weight matrix updating is based at least in part on the returned labeled samples determined by the expert;

[0011] S4. After the anomaly detection model is updated, the anomaly detection model is used to calculate the anomaly score of the data sample based at least in part on the updated density matrix and weight matrix; and the process returns to S2 to proceed to the detection of the next batch of data samples.

[0012] Preferably, in S1, the anomaly detection model uses a binary random tree to construct a binary forest model, specifically in the following manner:

[0013] S101. Initialize the root node root(None,None,None,|S|), assign S to the node root, and set the current layer number to 1;

[0014] S102, traverse each node in the current layer, select a feature f by random selection without replacement, and divide the node-bound sample set V into two subsets V = V1 UV2 based on the median value mean(f) of the feature f, thereby generating two child nodes node1 and node2;

[0015] S103. Increase the current number of layers by 1 and determine whether it has reached the preset height. If so, the construction ends; otherwise, return to S102.

[0016] Preferably, the node attributes in each tree are set as a four-tuple: feature, upper limit of value, lower limit of value, and number of samples.

[0017] Preferably, the two subsets are set as: V1 = {x|x∈V,x f <mean(f)},V2={x|x∈V,x f ≥mean(f)};

[0018] Among them, x f Indicates the value of sample x in feature f.

[0019] Preferably, in said S4, the data sample x i The anomaly score is:

[0020]

[0021] Among them, K is the number of trees, T k represents the kth tree, R ki Represents x i In the tree T k The leaf node number in Represents the tree T k R ki The weight of a leaf node in the calculation of the anomaly score, Represents the tree T k R ki The number of samples in a leaf node, Z is the scaling parameter, which can be 100, 50, etc.

[0022] Preferably, in S2, the dynamic change is represented by a dynamic change score, specifically in the following manner:

[0023] Based on the number of leaf node samples of each tree as the data density of the leaf node, the data density of the leaf node is smoothed; wherein the leaf node data density constitutes a density matrix;

[0024] Calculate the data density change U between the bth batch of data and the b-1th batch of data at the jth leaf node of the kth tree kj ;

[0025] The data sample x i The mean of the data density changes at each leaf node in the K trees is used as the data sample x i The dynamic change score of , K is the number of trees.

[0026] Further preferably, the dynamic change score is:

[0027]

[0028] Preferably, the smoothing process uses Laplace smoothing of data density:

[0029]

[0030] Among them, A kj Represents the tree T k The number of samples of the jth leaf node can be used to construct the leaf node density matrix {A kj}(1≤k≤K,1≤j≤n).

[0031] Preferably, the data density variation U kj for:

[0032]

[0033] in, They represent the smoothed data density of batch b and batch b-1 respectively. b represents the sequence number.

[0034] Preferably, in S2, the detection difficulty is represented by a detection difficulty score, specifically in the following manner:

[0035] Get the data sample x i In the tree T k The data drop rate of the sample nodes on the path:

[0036]

[0037] in, Represents the tree T k R ki The number of samples of leaf nodes, Avg(sum[root:R ki ]) indicates that from x i The mean number of node samples on the path to the root node, k represents the kth tree;

[0038] The data sample x i The average of the path sample node data drop rate in the K trees is used as the data sample x i The detection difficulty score of ; K is the number of trees.

[0039] Preferably, in S3, the density matrix is ​​updated by updating each data sample x i Corresponding accomplish:

[0040] That is

[0041] in, Represents the tree T k R ki The number of samples of leaf nodes; the density matrix is

[0042]

[0043] The weight matrix is ​​updated by returning labeled samples determined by experts, specifically:

[0044] Based on the returned labeled samples determined by the experts, calculate the new in Represents the tree T k The number of abnormal samples and normal samples returned by the expert on the j-th leaf node, n is the number of random binary tree leaf nodes;

[0045] Update weights: Get the new weight matrix {W kj}(1≤k≤K, 1≤j≤n), where A kj Represents the tree T k The number of samples of the j-th leaf node.

[0046] On the other hand, the present invention also provides an active anomaly detection system that combines density perception and detection difficulty, the system comprising:

[0047] The anomaly detection model module builds and stores an anomaly detection model based on the data S accumulated in the initial stage of the data flow, and calculates the anomaly score of the data sample based on the anomaly detection model updated by the update module;

[0048] The query probability calculation module calculates the query probability score of the data sample based on the dynamic changes of the data sample and the detection difficulty; in each batch of data samples, the data samples with the highest query probability score in a preset percentage are selected and sent to the expert judgment module;

[0049] An expert judgment module is used to make expert judgments based on the data samples sent by the query probability calculation module, and send the judgment results to the model update module;

[0050] The model update module updates the anomaly detection model after the current batch of data samples arrives. The update includes updating the density matrix and the weight matrix. The weight matrix update is at least partially based on the returned labeled samples determined by the expert.

[0051] Compared with existing technologies, this solution selects valuable data samples based on the distribution changes and detection difficulty of the data and provides them to experts for judgment. It also uses the samples marked by experts to update the model incrementally and accurately in a timely manner. It can combine expert domain knowledge with the anomaly detection model while minimizing the cost of manual auxiliary data detection and judgment, thereby improving the actual application performance of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 A schematic diagram of the working process of active anomaly detection in the prior art;

[0054] Figure 2 is a flow chart of a method according to an embodiment of the present invention;

[0055] Figure 3Schematic diagram of the system structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0057] In the description of the present invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicating orientations or positional relationships, are based on the orientations or positional relationships shown in the accompanying drawings and are intended solely to facilitate and simplify the description of the present invention. They are not intended to indicate or imply that the devices or components referred to must have, be constructed, or operate in a specific orientation, and therefore should not be construed as limitations on the present invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0058] In the description of the present invention, it should be noted that, unless otherwise expressly specified or limited, the terms "mounted," "connected," and "connected" should be understood broadly. For example, they may refer to mechanical or electrical connections; direct or indirect connections through an intermediary; and internal communication between two components. Those skilled in the art will understand the specific meanings of these terms in the present invention.

[0059] The present invention will be further explained below with reference to specific embodiments.

[0060] In a specific embodiment, to address the problems existing in the prior art, the present invention adopts an active anomaly detection method and system that combines density perception and detection difficulty. The solution of the present invention specifically includes the following three aspects:

[0061] (1) In the anomaly detection model construction phase, an anomaly detection model based on a random binary tree is adopted to support fast incremental updates;

[0062] (2) In query strategy formulation, the query probability score is calculated based on the density change and detection difficulty of the leaf node area, and the most valuable data samples for the current model are selected;

[0063] (3) In the model updating stage, expert-labeled samples are used to update the regional density and weight of leaf nodes, effectively utilizing the domain knowledge provided by experts.

[0064] The following is an elaboration of this embodiment.

[0065] In this embodiment, given an infinite data stream {..., x b-1，m , x b，1 ,…,x b，i , x b，i+1 ,…,x b，m , x b+1，1 ,…}, where x b,i ∈R d represents the i-th sample in the b-th batch of data in the data stream, and each batch of data contains m samples. b,i Abbreviated as x i , indicating the latest sample in the window to be analyzed.

[0066] In this embodiment, combined with Figure 2 ,This scheme can be divided into the following three main parts: (1) anomaly detection model construction, which constructs a binary forest consisting of binary random trees and formulates anomaly scoring ,strategy; (2) query strategy formulation, which determines whether to provide it to experts for ,judgment based on the characteristics of the sample; (3) model ,update, which updates the anomaly detection model based on the ,results of expert judgment.

[0067] (1) Anomaly detection model construction

[0068] Based on the data S accumulated in the initial stage of the data stream, the model binary forest is K random binary trees The node attributes in each tree are four-tuples (feature, upper limit, lower limit, number of samples), which are constructed according to the following steps:

[0069] 1) Initialize the root node root(None,None,None,|S|), assign S to node node, and set the current level to 1;

[0070] 2) Traverse each node in the current layer, randomly select a feature f without replacement, and divide the node binding sample set V into two subsets V = V1UV2 (V1 = {x|x∈V,x f <mean(f)},V2={x|x∈V,x f ≥mean(f)}), where x f Represents the value of x on feature f, generating two child nodes node1(f,min(f),mean(f),|V1|) and node2(f,min(f),max(f),|V2|), where min(f) and max(f) represent the minimum and maximum values ​​of feature f respectively;

[0071] 3) The current layer number is incremented by 1. If the maximum height H is reached, the construction is completed; otherwise, the process returns to step 2. The maximum height H can be set as needed, for example, to 8, 10, etc.

[0072] It should be noted that, in this preferred embodiment, the data samples are not actually saved during the construction process, but are only used in the intermediate process. kj}(1≤k≤K,1≤j≤n), where A kj Represents the tree T k The number of samples of the jth leaf node, n = 2 H is the number of random binary tree leaf nodes. Initialize its labeled sample matrix in Represents the tree T k The number of abnormal samples and normal samples returned after expert judgment on the j-th leaf node. In the initialization stage, no expert judgment returns marked samples.

[0073] Initialize the leaf node weight matrix {W kj}=1(1≤k≤K,1≤j≤n), where W kj Represents the tree T k The weight of the j-th leaf node in the anomaly score calculation.

[0074] For the sample x in the bth batch of data i , according to the division rules in the tree, it is divided into leaf nodes in the forest. Then its anomaly score is:

[0075]

[0076] Among them, K is the number of trees, T k represents the kth tree, R ki Represents x i In the tree T k The leaf node number in Represents the tree T k R ki The weight of a leaf node in the calculation of the anomaly score, Represents the tree T k R ki The number of samples in a leaf node, Z is the scaling parameter, which can be 100, 50, etc.

[0077] (2) Query strategy formulation

[0078] For the sample x in the bth batch of data iWhether it is provided to experts for judgment is mainly determined by two aspects: 1) Data distribution change. The query strategy aims to give priority to samples with large distribution changes. Such samples can improve the model's adaptability to data changes; 2) Data detection difficulty. The query strategy aims to select abnormal samples with large uncertainty. Such samples are difficult for the current model to judge. Providing them to the model for incremental learning helps improve the model's detection ability.

[0079] Taking the above two aspects into consideration, in a preferred embodiment, the query probability score calculation formula is:

[0080] q(x i )=d(x i )+h(x i )

[0081] where d(x i )、h(x i ) represent the dynamic change score and the detection difficulty score respectively. The calculation process is as follows:

[0082] 1) Dynamically changing scores

[0083] The change in sample distribution is determined by the change in data density information of the leaf nodes in each random binary tree. First, the data density of each leaf node is Laplace smoothed:

[0084]

[0085] Among them, A kj Represents the tree T k The number of samples of the jth leaf node can be used to construct the leaf node density matrix {A kj}(1≤k≤K,1≤j≤n).

[0086] Then calculate the density change between the b-th batch of data and the b-1-th batch of data at the j-th leaf node of the k-th tree:

[0087]

[0088] Based on this, we can calculate x i Dynamic change score:

[0089]

[0090] R ki Represents x i In the tree T k The leaf node number in .

[0091] 2) Detection difficulty score

[0092] In this preferred embodiment, the difficulty of sample detection is distinguished by the difficulty of dividing the path from the leaf node to the root node. The faster the rate of decrease of the number of node samples in the path, the easier it is to divide the path. At the same time, the fewer the number of node samples, the higher the probability that it is an anomaly. k Previous x i The calculation formula for the detection difficulty score is as follows:

[0093]

[0094] Represents the tree T k R ki The number of samples of leaf nodes, Avg(sum[root:R ki ]) indicates that from x i The mean number of node samples on the path to the root node. Based on this, we can calculate x i Detection difficulty score:

[0095]

[0096] In each batch of data, data samples with high query probability scores are selected and provided to experts for judgment. In a preferred embodiment, this score can be set to the top 5% or 10%, etc. Expert judgment can determine whether a sample is abnormal based on domain knowledge and experience, and can use existing databases or manual judgment methods.

[0097] (3) Model update

[0098] After the data samples of batch b arrive, the model is updated mainly in two aspects:

[0099] 1) Update of density matrix, for each x i , R ki Represents x i In the tree T k The leaf node number in the density matrix is ​​updated, that is, for each x i The number of samples of the corresponding leaf nodes is updated, that is, the density matrix is ​​updated, and The density matrix consists of the number of samples in each leaf node.

[0100] 2) Update of weight matrix: after the expert returns the labeled sample, the new L is calculated. + ,L - , based on which the weight matrix is ​​updated in Represents the tree T k The number of abnormal samples and normal samples returned by the expert on the j-th leaf node.

[0101] After the model is updated, the b+1 batch of data will be tested. This way, the effective information provided by the expert judgment can be fully utilized to continuously update the anomaly detection model, thereby ensuring the accuracy and dynamic update of anomaly detection.

[0102] In another specific embodiment, Figure 3 As shown, the solution of the present invention can also be implemented by an active anomaly detection system that combines density perception and detection difficulty. Preferably, the system can be provided with the following modules:

[0103] The anomaly detection model module builds and stores an anomaly detection model based on the data S accumulated in the initial stage of the data flow, and calculates the anomaly score of the data sample based on the anomaly detection model updated by the update module;

[0104] The query probability calculation module calculates the query probability score of the data sample based on the dynamic changes of the data sample and the detection difficulty; in each batch of data samples, the data samples with the highest query probability score in a preset percentage are selected and sent to the expert judgment module;

[0105] An expert judgment module is used to make expert judgments based on the data samples sent by the query probability calculation module, and send the judgment results to the model update module;

[0106] The model update module updates the anomaly detection model after the current batch of data samples arrives. The update includes updating the density matrix and the weight matrix. The weight matrix update is at least partially based on the returned labeled samples determined by the expert.

[0107] Preferably, the anomaly detection model uses a binary random tree to construct a binary forest model, specifically in the following manner:

[0108] S101. Initialize the root node root(None,None,None,|S|), assign S to the node root, and set the current layer number to 1;

[0109] S102, traverse each node in the current layer, select a feature f by random selection without replacement, and divide the node-bound sample set V into two subsets V = V1 UV2 based on the median value mean(f) of the feature f, thereby generating two child nodes node1 and node2;

[0110] S103. Increase the current number of layers by 1 and determine whether it has reached the preset height. If so, the construction ends; otherwise, return to S102.

[0111] Preferably, the node attributes in each tree are set as a four-tuple: feature, upper limit of value, lower limit of value, and number of samples.

[0112] In the anomaly detection model module, the data sample x i The anomaly score is calculated as:

[0113]

[0114] Among them, K is the number of trees, T k represents the kth tree, R ki Represents x i In the tree T k The leaf node number in Represents the tree T k R ki The weight of a leaf node in the calculation of the anomaly score, Represents the tree T k R ki The number of samples in a leaf node, Z is the scaling parameter, which can be 100, 50, etc.

[0115] In another embodiment, the solution can be implemented in the form of a device, which may include corresponding modules for performing each or several steps in the above-mentioned various embodiments. Therefore, each step or several steps of the above-mentioned various embodiments can be performed by the corresponding modules, and the electronic device may include one or more of these modules. The modules can be one or more hardware modules specifically configured to perform the corresponding steps, or implemented by a processor configured to perform the corresponding steps, or stored in a computer-readable medium for implementation by the processor, or implemented by some combination.

[0116] The device can be implemented using a bus architecture. The bus architecture can include any number of interconnecting buses and bridges, depending on the specific application and overall design constraints of the hardware. The bus connects various circuits including one or more processors, memories, and / or hardware modules. The bus can also connect various other circuits such as peripherals, voltage regulators, power management circuits, external antennas, etc.

[0117] Any process or method description in the flowchart or otherwise described herein can be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiment of the present invention includes alternative implementations in which the functions may be performed not in the order shown or discussed, including performing the functions in a substantially simultaneous manner or in a reverse order according to the functions involved, as will be understood by those skilled in the art to which the embodiments of the present invention pertain. The processor performs the various methods and processes described above. For example, the method embodiments in the present invention can be implemented as a software program that is tangibly contained in a machine-readable medium, such as a memory. In some embodiments, part or all of the software program can be loaded and / or installed via a memory and / or a communication interface. When the software program is loaded into the memory and executed by the processor, one or more steps in the method described above can be performed. Alternatively, in other embodiments, the processor can be configured to perform one of the above methods in any other appropriate manner (e.g., by means of firmware).

[0118] The logic and / or steps represented in the flowchart or otherwise described herein may be embodied in any readable storage medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device).

[0119] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present invention should be included in the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection of the claims.

Claims

1. An active anomaly detection method combining density perception and detection difficulty, characterized by: The method comprises: S1, build an anomaly detection model based on the data S accumulated in the initial stage of the data flow; S2. Calculate the query probability score of the data sample based on the dynamic changes and detection difficulty of the data sample; select a preset percentage of data samples with the highest query probability score from each batch of data samples for expert judgment; S3. After the current batch of data samples arrives, the anomaly detection model is updated, wherein the updating includes updating the density matrix and the weight matrix, wherein the weight matrix updating is based at least in part on the returned labeled samples determined by the expert; S4. After the anomaly detection model is updated, the anomaly detection model is used to calculate anomaly scores for the data samples based at least in part on the updated density matrix and weight matrix; and the process returns to S2 to proceed to detection of the next batch of data samples. In S4, the data sample x i The anomaly score is: Among them, K is the number of trees, T k represents the kth tree, express In the tree T k The leaf node number in Represents the tree T k No. The weight of a leaf node in the calculation of the anomaly score, Represents the tree T k No. The number of samples of leaf nodes, Z is the scaling parameter; In S2, the dynamic change is represented by a dynamic change score, specifically: The leaf node density matrix is ​​constructed based on the number of leaf node samples of each tree, and the data density of the leaf nodes is smoothed; Calculate the data density change between the bth batch of data and the b-1th batch of data at the jth leaf node of the kth tree ; The data sample x i The mean of the data density changes at each leaf node in the K trees is used as the data sample x i The dynamic change score of , K is the number of trees.

2. The method according to claim 1, characterized in that In S1, the anomaly detection model uses a binary random tree to construct a binary forest model, specifically: S101. Initialize the root node root(None, None, None,|S|), assign S to the node node, and set the current layer number to 1. S102, traverse each node in the current layer, select a feature f by random without replacement, and divide the node binding sample set V into two subsets based on the median value mean(f) of feature f , thus generating two child nodes node1 and node2; S103. Increase the current number of layers by 1 and determine whether it has reached the preset height. If so, the construction ends; otherwise, return to S102.

3. The method according to claim 2, characterized in that The node attributes in each tree are set as a four-tuple: feature, upper limit of value, lower limit of value, and number of samples.

4. The method according to claim 2, characterized in that The two subsets are set as: , ; in, Indicates the value of sample x in feature f.

5. The method according to claim 1, wherein In S2, the detection difficulty is represented by a detection difficulty score, specifically: Get the data sample x i In the tree T k The data drop rate of the sample nodes on the path: in, Represents the tree T k No. The number of samples of leaf nodes, Indicates that from x i The mean number of node samples on the path to the root node, T k represents the kth tree; The data sample x i The average of the path sample node data drop rate in the K trees is used as the data sample x i The detection difficulty score of ; K is the number of trees.

6. The method according to claim 1, characterized in that In S3, the density matrix is ​​updated by updating each data sample Corresponding accomplish: That is = +1; in, Represents the tree T k No. The number of samples of leaf nodes; the density matrix is ; The weight matrix is ​​updated by returning labeled samples determined by experts, specifically: Based on the returned labeled samples determined by the experts, calculate the new ,in 、 Represents the tree T k The number of abnormal samples and normal samples returned by the expert on the j-th leaf node, n is the number of random binary tree leaf nodes; Update weights: , and get the new weight matrix ,in Represents the tree T k The number of samples of the j-th leaf node.

7. Active anomaly detection system combining density perception and detection difficulty, characterized by: The system is used to perform the active anomaly detection method combining density perception and detection difficulty as claimed in claim 1, and the system includes: The anomaly detection model module builds and stores an anomaly detection model based on the data S accumulated in the initial stage of the data flow, and calculates the anomaly score of the data sample based on the anomaly detection model updated by the update module; The query probability calculation module calculates the query probability score of the data sample based on the dynamic changes of the data sample and the detection difficulty; in each batch of data samples, the data samples with the highest query probability score in a preset percentage are selected and sent to the expert judgment module; An expert judgment module is used to make expert judgments based on the data samples sent by the query probability calculation module, and send the judgment results to the model update module; The model update module updates the anomaly detection model after the current batch of data samples arrives. The update includes updating the density matrix and the weight matrix. The weight matrix update is at least partially based on the returned labeled samples determined by the expert.

8. The system according to claim 7, characterized in that The anomaly detection model uses a binary random tree to construct a binary forest model, specifically: S101. Initialize the root node root(None, None, None,|S|), assign S to the node root, and set the current layer number to 1; S102, traverse each node in the current layer, select a feature f by random without replacement, and divide the node binding sample set V into two subsets based on the median value mean(f) of feature f , thus generating two child nodes node1 and node2; S103. Increase the current number of layers by 1 and determine whether it has reached the preset height. If so, the construction ends; otherwise, return to S102.

Images