An anomaly detection method, device, readable storage medium and electronic equipment

Abstract

The specification discloses an anomaly detection method, device, readable storage medium and electronic equipment. For each large category, historical behavior data corresponding to the large category is input into an anomaly detection model to obtain representation features of each anomaly subclass of the anomaly large category output by the anomaly detection model. After obtaining user behavior data to be detected, the user behavior data is input into the anomaly detection model, and the similarity between user features corresponding to the user behavior data and representation features of each anomaly subclass contained in each anomaly large category is determined to determine an anomaly large category corresponding to the user features, and the anomaly large category is taken as an anomaly detection result of the user behavior data. The method can determine the anomaly detection result based on the similarity between each anomaly subclass corresponding to each anomaly large category and the user features, avoid excessive requirements for computing resources, and ensure the accuracy of anomaly detection.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to an anomaly detection method, apparatus, readable storage medium, and electronic device. Background Technology

[0002] Currently, users are increasingly concerned about their privacy. However, with the development of internet technology, methods of cyberattacks using internet technology are also emerging in endless streams. Security incidents such as website tampering and online fraud occur frequently, posing a significant challenge to user privacy and security. But typically, when using internet technology to launch cyberattacks, the user behavior data corresponding to the attackers often shows anomalies.

[0003] Based on this, this specification provides a method for anomaly detection based on user behavior data. Summary of the Invention

[0004] This specification provides an anomaly detection method, apparatus, readable storage medium, and electronic device to partially solve the aforementioned problems existing in the prior art.

[0005] The following technical solution is adopted in this specification:

[0006] This specification provides an anomaly detection method, including:

[0007] Acquire user behavior data to be detected;

[0008] The user behavior data is input into the first feature extraction layer of a pre-trained anomaly detection model to obtain the user features extracted by the first feature extraction layer.

[0009] Based on the user features and the representational features of each subclass of anomalies contained in each pre-stored major anomaly category, the similarity between the user features and each representational feature is determined. Based on the anomaly subclass corresponding to the representational feature with the highest similarity, the major anomaly category to which the user features belong is determined. The determined major anomaly category is used as the anomaly detection result of the user behavior data.

[0010] The representational features of the abnormal subclasses are determined using the following method:

[0011] For each major category of anomalies, the historical behavior data corresponding to that major category of anomalies are input into a pre-trained anomaly detection model. The first feature extraction layer determines the features of each user, and the user features are input into the second feature extraction layer to determine the representation features of each subclass of anomalies in that major category of anomalies.

[0012] This specification provides an anomaly detection device, including:

[0013] The acquisition module is used to acquire user behavior data to be detected;

[0014] The extraction module is used to input the user behavior data into the first feature extraction layer of a pre-trained anomaly detection model to obtain the user features extracted by the first feature extraction layer.

[0015] The determination module is used to determine the similarity between the user features and each of the pre-stored anomaly subclasses contained in each anomaly category, and to determine the anomaly category to which the user features belong based on the anomaly subclass corresponding to the anomaly feature with the highest similarity, and to use the determined anomaly category as the anomaly detection result of the user behavior data.

[0016] The representational features of the abnormal subclasses are determined using the following method:

[0017] For each major category of anomalies, the historical behavior data corresponding to that major category of anomalies are input into a pre-trained anomaly detection model. The first feature extraction layer determines the features of each user, and the user features are input into the second feature extraction layer to determine the representation features of each subclass of anomalies in that major category of anomalies.

[0018] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described anomaly detection method.

[0019] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the above-described anomaly detection method.

[0020] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0021] In the anomaly detection method provided in this specification, for each major category, the historical behavior data corresponding to that category is input into the anomaly detection model to obtain the representational features of each anomaly subclass of that major category output by the anomaly detection model. After obtaining the user behavior data to be detected, the user behavior data is input into the anomaly detection model to obtain the user features corresponding to the user behavior data. Then, based on the similarity between the user features and the pre-stored representational features of each anomaly subclass contained in each major category, the anomaly category corresponding to the user features is determined, and the anomaly category is taken as the anomaly detection result of the user behavior data.

[0022] As can be seen from the above method, this method can pre-determine the anomaly category by using the representational features of each anomaly subclass contained in the anomaly category. This allows the anomaly detection result to be determined only based on the similarity between each anomaly subclass corresponding to each anomaly category and the user features corresponding to the user behavior data when performing anomaly detection on user behavior data. This avoids excessive requirements on computing resources while ensuring the accuracy of anomaly detection. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and their descriptions, serving to explain this specification and do not constitute an undue limitation thereof.

[0024] In the picture:

[0025] Figure 1 This is a flowchart illustrating the anomaly detection method provided in this manual;

[0026] Figure 2 This is a schematic diagram of the anomaly detection model provided in this specification;

[0027] Figure 3A This is a schematic diagram of the structure of the second feature extraction layer provided in this specification;

[0028] Figure 3B This is a schematic diagram of the structure of the second feature extraction layer provided in this specification;

[0029] Figure 4 This is a flowchart illustrating the training method for the anomaly detection model provided in this manual.

[0030] Figure 5 This is a schematic diagram of the anomaly detection device provided in this manual;

[0031] Figure 6 The corresponding information provided in this specification Figure 1 or Figure 4 A schematic diagram of an electronic device. Detailed Implementation

[0032] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0033] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0034] Currently, with the development of internet technology, methods of attacking users using internet technology are emerging in endlessly, posing risks to users' business operations. Taking the cybercrime industry as an example, with the gradual development of the cybercrime industry, new cybercrime attack methods are showing a trend of diversification, small-scale attacks, and frequent and sudden occurrences. That is to say, for a period of time, one type of cybercrime attack method may appear frequently, while after that period, the frequency of this type of cybercrime attack method will decrease, while another type of cybercrime attack method may appear frequently, and the newly emerging cybercrime attack methods may be significantly different from the previous ones in terms of their form, language, and other characteristics.

[0035] Therefore, anomaly detection models trained on data corresponding to historical cyberattack methods are insufficient to accurately detect new cyberattack methods. This new cyberattack method can be based on user behavior data.

[0036] Based on this, this specification provides a novel anomaly detection method. This method trains an anomaly detection model that can take into account both novel and historical attack methods by using data corresponding to emerging cyberattack techniques and historical behavioral data corresponding to various major anomaly categories. Upon receiving user behavior data to be detected, the trained anomaly detection model accurately detects the user behavior data, ensuring the accuracy of anomaly detection.

[0037] Figure 1 This is a flowchart illustrating the anomaly detection method provided in this manual, which specifically includes the following steps:

[0038] S100: Obtain user behavior data to be detected.

[0039] In one or more embodiments provided in this specification, the anomaly detection method may be executed by a server.

[0040] Generally, in the field of anomaly detection, the purpose of this anomaly detection method is to detect abnormal user behavior data and process it accordingly based on the major categories of anomalies in the abnormal user behavior data. In other words, it processes the user behavior data based on the anomaly detection results. To obtain the anomaly detection results, the user behavior data to be detected must first be acquired.

[0041] Based on this, the server can obtain user behavior data to be detected. This user behavior data can be pre-stored on the server, in which case the server can randomly select any user behavior data that has not yet undergone anomaly detection from its pre-stored user behavior data as the user behavior data to be detected.

[0042] Of course, the server can also receive anomaly detection requests carrying user behavior data to be detected, and parse these requests. The user behavior data carried in the anomaly detection request is then identified as the user behavior data to be detected. The specific method for determining this user behavior data can be configured as needed; this manual does not impose any restrictions on it.

[0043] S102: Input the user behavior data into the first feature extraction layer of the pre-trained anomaly detection model to obtain the user features extracted by the first feature extraction layer.

[0044] In one or more embodiments provided in this specification, typically one feature can be used to characterize a class of data, but a single data point is generally characterized by only one feature. Therefore, in this specification, the characterization features of the subclasses corresponding to each major anomaly category can be used to characterize each major anomaly category. This allows the anomaly detection results of user behavior data to be determined based on the similarity between user features and the characterization features of each subclass of anomaly category.

[0045] Based on this, the user characteristics corresponding to the user behavior data can be determined.

[0046] Specifically, the anomaly detection model includes at least a first feature extraction layer. This first feature extraction layer is used to extract features from user behavior data and determine the user features corresponding to the user behavior data.

[0047] Therefore, the server can use the user behavior data as input to the first feature extraction layer of the pre-trained anomaly detection model to obtain the user features output by the first feature extraction layer.

[0048] S104: Based on the user features and the representational features of each subclass of anomalies included in each pre-stored anomaly category, determine the similarity between the user features and each representational feature, and determine the anomaly category to which the user features belong based on the anomaly subclass corresponding to the representational feature with the highest similarity, and use the determined anomaly category as the anomaly detection result of the user behavior data.

[0049] In one or more embodiments provided in this specification, after determining user characteristics, the server can determine the anomaly detection result of the user behavior data based on the user characteristics and the representational characteristics of each anomaly subclass contained in each pre-stored anomaly category.

[0050] Specifically, the server can retrieve the pre-stored representational features corresponding to each subclass of anomaly within each major anomaly category. The major anomaly category can be of various types, such as fraud or gambling. For each major anomaly category, the corresponding subclasses do not necessarily have explicit meanings; the representational features corresponding to each subclass within the major anomaly category can be used to represent the major anomaly category itself.

[0051] Secondly, the server can determine the similarity between the user's features and each representation feature. This similarity can be determined using various algorithms such as vector dot product, Euclidean distance, and cosine distance.

[0052] Then, based on the principle that the more similar two features are, the greater the probability that the two features belong to the same category, the server can determine the anomaly subclass corresponding to the feature with the highest similarity from each anomaly subclass, and take the anomaly class to which the anomaly subclass belongs as the anomaly class to which the user feature belongs.

[0053] Finally, the server can use the major category of the user's characteristics as the anomaly detection result for the user's behavior data.

[0054] Therefore, after determining the anomaly detection result, the server can return the anomaly detection result, and when it receives a query request corresponding to the user behavior data, it can return the anomaly detection result according to the query request. Alternatively, the server can directly return the anomaly detection result according to the anomaly detection request received in step S100. Of course, the server can also process the user behavior data based on the determined anomaly detection result. How the anomaly detection result is used can be set as needed, and this specification does not limit it.

[0055] Furthermore, for each major anomaly category, the characteristic features of each anomaly subcategory within that category can characterize the major anomaly category itself, and the corresponding historical behavioral data can also characterize it. However, since the amount of historical behavioral data corresponding to each major anomaly category is large, directly using the historical behavioral data to characterize the major anomaly category would require determining the similarity between the user behavior data and each historical behavioral data point when determining the historical category to which the user behavior data belongs based on user characteristics, placing significant demands on computing resources. Therefore, it is preferable to determine each major anomaly category by identifying the historical data.

[0056] Specifically, the characteristic features of each subclass of anomaly contained in each major anomaly category can be determined in the following ways:

[0057] First, the server can obtain several labeled historical behavior data and classify each historical behavior data according to the labels.

[0058] Then, for each major category of anomalies in the classification results, the historical behavior data corresponding to that major category of anomalies is used as input and fed into the first feature extraction layer of the anomaly detection model to obtain the user features output by the first feature extraction layer.

[0059] Finally, the user features are input to the second feature extraction layer of the anomaly detection model to obtain the representation features of each anomaly subclass of the anomaly class output by the second feature extraction layer.

[0060] In other words, in this specification, the anomaly detection model can be composed of a first feature extraction layer and a second feature extraction layer. The first feature extraction layer is used to extract features from user behavior data to determine user characteristics. The second feature extraction layer is used to determine the representational features of each anomaly subclass corresponding to each anomaly category. Therefore, this specification can accurately determine and store the representational features of each anomaly subclass corresponding to each anomaly category based on the trained anomaly detection model. This achieves the technical effect of quickly and accurately determining the anomaly detection result of user behavior data upon receiving it, directly based on the user characteristics corresponding to the user behavior data and the pre-stored representational features of each anomaly subclass contained in each anomaly category.

[0061] The server that determines each characteristic feature and the server that executes the anomaly detection method can be the same server or different servers.

[0062] based on Figure 1 The anomaly detection method described above involves inputting historical behavior data corresponding to each major category into an anomaly detection model to obtain the representational features of each anomaly subclass within that major category, as output by the model. After acquiring the user behavior data to be detected, this data is input into the anomaly detection model to obtain the corresponding user features. Then, based on the similarity between these user features and the pre-stored representational features of each anomaly subclass within each major category, the anomaly category corresponding to the user feature is determined, and this anomaly category is used as the anomaly detection result for the user behavior data.

[0063] As can be seen from the above method, this method can pre-determine the anomaly category by using the representational features of each anomaly subclass contained in the anomaly category. This allows the anomaly detection result to be determined only based on the similarity between each anomaly subclass corresponding to each anomaly category and the user features corresponding to the user behavior data when performing anomaly detection on user behavior data. This avoids excessive requirements on computing resources while ensuring the accuracy of anomaly detection.

[0064] Furthermore, in this specification, the step of determining the anomaly detection result in step S104 above can also be performed by the anomaly detection model. That is, the server can directly input the user behavior data to be detected into the anomaly detection model, and the anomaly detection model can determine the user characteristics corresponding to the user behavior data and determine the anomaly category to which the user characteristics belong, and output it as the anomaly detection result.

[0065] Specifically, the anomaly detection model can also include a detection layer, which is used to determine the anomaly category to which a user feature belongs based on the similarity between user features and various representational features.

[0066] The server can then input the user features determined in step S102, as well as the pre-stored representation features of each subclass of anomaly corresponding to each major anomaly category, into the detection layer of the anomaly detection model. In this detection layer, the server can determine the similarity between the user features and each representation feature, and identify the anomaly subclass corresponding to the highest similarity from each subclass of anomalies.

[0067] Therefore, the server can output the major anomaly category to which the anomaly subclass corresponding to the highest similarity belongs as the anomaly detection result of the user behavior data. For example... Figure 2 As shown.

[0068] Figure 2 This is a schematic diagram of an anomaly detection model provided in this specification. The server can input historical behavior data into the first feature extraction layer of the anomaly detection model to obtain user features corresponding to each anomaly historical behavior data. Then, for each major anomaly category, the server can input the user features of the historical behavior data corresponding to that major anomaly category into the second feature extraction layer of the anomaly detection model to obtain the representation features of each anomaly subclass corresponding to that major anomaly category, output by the second feature extraction layer.

[0069] Upon receiving user behavior data to be detected, the server can input this user behavior data into the first feature extraction layer to obtain the user features output by the first feature extraction layer. Then, the server can input the user features and the representational features of each anomaly subclass within each anomaly category into the monitoring layer to obtain the anomaly category to which the user feature belongs, and output this anomaly category as the anomaly detection result.

[0070] Furthermore, for each user behavior data point, if the highest similarity among the various representational features is still low, then the user behavior data can be determined to be normal data. Therefore, a first threshold can also be set. In step S104, when the highest similarity is determined not to exceed the first threshold, the server can determine that the anomaly detection result corresponding to the user behavior data is normal. Of course, the aforementioned anomaly categories may include not only fraud and gambling, but also a "normal" category used to represent normal behavior data. The server can then output "normal" as the anomaly detection result. The specific classification corresponding to this anomaly category can be set as needed; this specification does not impose any restrictions on this.

[0071] Furthermore, for each major category of anomalies, the historical behavior data corresponding to that category carries, to varying degrees, the characteristic components of each sub-category of anomalies contained within that category. Therefore, in order to accurately characterize each sub-category of anomalies, in step S104, the server can determine the characterization features of each sub-category of anomalies based on the characteristic components of each sub-category corresponding to the historical behavior data of that major category of anomalies.

[0072] Specifically, the server can input the historical behavior data corresponding to each major category of anomalies into the first feature extraction layer to obtain the user features output by the first feature extraction layer.

[0073] Then, the server can use the determined user features as inputs to the second feature extraction layer of the anomaly detection model to determine the reference features corresponding to each user feature. These reference features include feature components corresponding to the feature components of each anomaly subclass within the anomaly category.

[0074] Finally, the server can determine the feature components corresponding to each subclass of the overall anomaly category from the reference features. Based on the determined feature components corresponding to each subclass, the server can then determine the representational features of that subclass. For example... Figure 3A As shown.

[0075] Figure 3A This diagram illustrates the structure of a second feature extraction layer for determining a reference feature containing multiple feature components, as provided in this specification. In the diagram, the input to the second feature extraction layer is the user feature, and the output is the reference feature, which contains four feature components. A, B, C, and D are the four feature components of the reference feature, each corresponding to one of the four anomaly subclasses within the anomaly class corresponding to the user feature. These four anomaly subclasses are concatenated to form the reference feature. Clearly, the anomaly class corresponding to the user feature contains four anomaly subclasses, and the second feature extraction layer is a fully connected layer.

[0076] Following the same approach, this specification also provides a schematic diagram of the structure of a second feature extraction layer for determining reference features containing multiple feature components, such as... Figure 3B As shown. With Figure 3A Similarly, the input to the second feature extraction layer is the user feature, and the output of the second feature extraction layer is the reference feature, which contains four feature components. Among them, 1, 2, 3, and 4 are the four channels corresponding to the reference feature, and each reference component corresponding to the reference channel is located in its respective channel.

[0077] It should be noted that the above illustrations are merely examples of the second feature extraction layer and the reference feature in this specification. The specific structure of the second feature extraction layer and the reference feature can be set as needed, and this specification does not impose any restrictions on them.

[0078] Furthermore, the more similar two features are, the higher the probability that they belong to the same category. Similarly, the higher the probability that a feature component belongs to a certain anomaly subclass, the closer that feature component is to the subclass center of that anomaly subclass, and therefore the better it can represent that anomaly subclass. Based on this, after determining the reference features, the server can determine the representational features of each anomaly subclass for the anomaly category, based on the feature components of that anomaly subclass in each reference feature.

[0079] Specifically, after determining the reference features for each user feature corresponding to the major anomaly category, the server, for each anomaly subclass within the major anomaly category, determines the feature components in each reference feature corresponding to that subclass. Then, based on the determined feature components, the server determines the probability that each feature component corresponds to that subclass. Finally, based on the determined feature components and the probability that each feature component corresponds to that subclass, the server determines the representational features of that subclass.

[0080] Furthermore, the more similar two features are, the higher the probability that they belong to the same category. Similarly, the higher the probability that a feature component of a reference feature belongs to a certain anomaly subclass, the closer the user feature corresponding to that reference feature is to the subclass center of that anomaly subclass, and thus the better it can represent that anomaly subclass. Based on this, after determining the reference features, the server can determine the representational features of the anomaly subclass according to each reference feature.

[0081] Specifically, for each subclass of anomaly included in the major anomaly category, the server can determine the probability that the user feature corresponding to each reference feature belongs to that subclass of anomaly based on the feature components in each reference feature that correspond to that subclass of anomaly.

[0082] The server can then use the determined probabilities as weights, and perform a weighted summation based on the determined weights and the user features corresponding to each reference feature to determine the representational features of the anomaly subclass.

[0083] Of course, the server can also directly determine the user feature corresponding to the reference feature with the highest probability based on the determined probabilities, and use it as the representation feature of this anomaly subclass. The specific technical means for determining the representation feature based on the user features corresponding to each probability and each reference feature can be set as needed, and this specification does not limit it.

[0084] Furthermore, in step S104, the server can also determine each representation feature through clustering.

[0085] Specifically, for each major anomaly category, after determining the user characteristics of the historical behavioral data corresponding to that category, the server can input these user characteristics into the second feature extraction layer of the anomaly detection model. In this second feature extraction layer, the server can cluster the historical behavioral data based on the user characteristics to determine the respective clusters. These determined clusters can then be used to represent the major anomaly category.

[0086] Therefore, the server can determine the representational features of the corresponding anomalous subclasses for each cluster based on the representational features of the historical behavioral data contained in that cluster. There is a one-to-one correspondence between the clusters and anomalous subclasses contained in the main anomalous class. The clustering algorithm used in this second feature extraction layer can be configured as needed, and this specification does not impose any restrictions on it.

[0087] In addition, the above anomaly detection model can be trained in the following way:

[0088] Specifically, firstly, the server can acquire several user behavior data sets that have been labeled with major anomaly categories. Then, from the acquired user behavior data sets, it randomly selects any user behavior data set as a target sample, and uses the label of that user behavior data set as the label of the target sample. Additionally, it randomly selects a specified number of user behavior data sets as specified samples, and for each specified sample, uses the label of the corresponding user behavior data set as the label of that specified sample.

[0089] Secondly, the server can input the target sample and each specified sample into the first feature extraction layer of the anomaly detection model to be trained, and obtain the user features of the target sample and the user features corresponding to each specified sample output by the first feature extraction layer.

[0090] Then, for each major anomaly category, the server determines the specified samples of that category based on the labels corresponding to each specified sample, and inputs each specified sample of that category into the second feature extraction layer of the anomaly detection model to obtain the reference features of each specified sample of that major anomaly category output by the second feature extraction layer. Furthermore, for each anomaly subclass contained within that major anomaly category, the server determines the representational features of that subclass based on the feature components corresponding to the reference features of each specified sample of that major anomaly category.

[0091] Then, the server can determine the abnormal subclass corresponding to the target sample based on the similarity between the user characteristics of the target sample and the representational characteristics of each abnormal subclass contained in each abnormal category, and take the abnormal category to which the abnormal subclass of the target sample belongs as the abnormal detection result of the target sample.

[0092] Finally, the server can train the anomaly detection model with the optimization objective of minimizing the difference between the anomaly detection result and the annotation of the target sample.

[0093] Following the same approach, this specification also provides a training method for an anomaly detection model, such as... Figure 4 As shown.

[0094] Figure 4 This is a flowchart illustrating the training method for the anomaly detection model provided in this specification. Wherein:

[0095] S200: Obtain labeled target samples and several labeled specified samples, input the target samples and each specified sample into the first feature extraction layer of the anomaly detection model to be trained, and obtain the user features of each specified sample and the user features of the target sample output by the first feature extraction layer.

[0096] To ensure that the anomaly detection model can accurately identify new user behavior data corresponding to major anomaly categories while also accurately identifying user behavior data corresponding to historical major anomaly categories, the anomaly detection model in this specification can be trained using metric learning.

[0097] In other words, in this specification, user behavior data corresponding to new black market attack methods can be obtained as target samples, user behavior data corresponding to historical black market attack methods can be obtained as designated samples, and the anomaly detection model can be trained based on the similarity between the target samples and the designated samples.

[0098] Based on this, the server can obtain labeled target samples as well as several labeled specified samples.

[0099] Specifically, the server can pre-store user behavior data corresponding to new types of cyberattacks, as well as the major categories of anomalies associated with these new cyberattacks. Therefore, the server can determine target samples from the pre-stored user behavior data corresponding to these new cyberattacks and use the major category of anomalies corresponding to the target sample as its label.

[0100] Similarly, the server can pre-store user behavior data corresponding to historical cyberattack methods, as well as the major anomaly categories corresponding to these methods. The server can then determine several specified samples from the pre-stored user behavior data related to these historical cyberattack methods, and for each specified sample, use its major anomaly category as its label.

[0101] Furthermore, as mentioned above, the anomaly detection model in this specification includes a first feature extraction layer, which is used to extract features from user behavior data.

[0102] Therefore, the server can input the acquired target sample and each specified sample into the first feature extraction layer of the anomaly detection model to be trained, and obtain the user features of the target sample and the user features of each specified sample output by the first feature extraction layer.

[0103] The first feature extraction layer can be a fully connected layer network, a convolutional neural network, a linear neural network, or other neural network structures. The specific structure of the first feature extraction layer can be set as needed, and this specification does not impose any restrictions on it.

[0104] S202: Based on the labels corresponding to each specified sample, classify each specified sample, and for each abnormal category obtained by classification, input the user features of each specified sample corresponding to the abnormal category into the second feature extraction layer of the abnormal detection model to obtain the undetermined features of each abnormal subclass contained in the abnormal category output by the second feature extraction layer.

[0105] In one or more embodiments provided in this specification, as described above, the anomaly detection method in this specification requires the use of a trained anomaly detection model to accurately determine the representational features of each anomaly subclass corresponding to each major anomaly category, serving as the risk representation for each major anomaly category. That is, for each major anomaly category, this specification can use the representational features of each anomaly subclass contained within that major anomaly category to characterize that major anomaly category. This facilitates the subsequent anomaly detection based on user behavior data in the anomaly detection request, using the representational features corresponding to each major anomaly category and the features of the user behavior data to determine the anomaly detection result of the user behavior data.

[0106] Based on this, the server can determine the undetermined features of each subclass of anomalies within each major anomaly category. Specifically, based on an incompletely trained anomaly detection model, the undetermined features of each subclass can be determined. Based on a fully trained anomaly detection model, the representational features of each subclass can be determined.

[0107] Specifically, the specified sample contains user behavior data across multiple major categories of anomalies. The server can then first classify each specified sample based on its corresponding annotations.

[0108] Then, for each major anomaly category in the classification results, the server can input the specified sample corresponding to that major anomaly category into the second feature extraction layer of the anomaly detection model. In this second feature extraction layer, the server clusters the specified samples according to the features corresponding to each specified sample, thus determining each cluster. The clusters in the clustering results correspond one-to-one with the anomaly subclasses contained in the major anomaly category.

[0109] Finally, for each cluster, the server can determine the cluster center features based on the user features of each specified sample contained in the cluster, and use these features as the features of the abnormal subclasses corresponding to the cluster.

[0110] When clustering specified samples, the server can use various clustering algorithms, such as k-means clustering and density-based spatial clustering of applications with noise (DBSCAN), to perform clustering.

[0111] Furthermore, in order to ensure that there is a one-to-one correspondence between the cluster and the corresponding subclass of the anomaly category, the number of anomaly subclasses can be preset in this specification.

[0112] Specifically, the server can also determine the corresponding subcategories of anomalies for each major category of anomalies obtained through classification. Taking fraud as an example, the subcategories of anomalies corresponding to this major category could be account theft, fraudulent transactions, credit card fraud, and fake transactions. Thus, the server can determine that there are four subcategories of anomalies within the major category of fraud.

[0113] Therefore, the server can cluster the specified samples corresponding to the abnormal subclass based on the number of the abnormal subclass and the user characteristics of each specified sample corresponding to the abnormal subclass, and determine the clusters that correspond one-to-one with the abnormal subclass.

[0114] After identifying the clusters, the server can further determine the representational features of the cluster centers for each cluster, which will serve as the representational features of the corresponding anomalous subclasses, i.e., undetermined features. These undetermined features are determined based on the model parameters of the anomaly detection model before the model has been fully trained.

[0115] S204: Input the user features of the target sample and the undetermined features of each subclass of anomaly included in each major anomaly category into the detection layer of the anomaly detection model to obtain the anomaly detection result of the target sample output by the detection layer.

[0116] In one or more embodiments provided in this specification, as described above, the anomaly detection model requires the similarity between the characterization features of the target sample and the characterization features of each anomaly category to predict the anomaly category of the target sample.

[0117] Based on this, the server can determine the abnormal category of the target sample output by the detection layer by combining the user characteristics of the target sample and the undetermined characteristics of each abnormal subclass contained in each abnormal category determined in step S102.

[0118] Specifically, the server can use the user characteristics of the target sample and the undetermined characteristics of each subclass of anomaly contained in each major anomaly category as input to the detection layer of the anomaly detection model.

[0119] In this detection layer, the server can determine the similarity between the user features of the target sample and the undetermined features of the anomaly subclass for each anomaly subclass, based on the user features of the target sample and the undetermined features of the anomaly subclass. This similarity can be a vector dot product, Euclidean distance, cosine distance, etc., and the specific method for determining this similarity can be set as needed; this specification does not impose any restrictions on it.

[0120] After determining the similarity between the user characteristics of the target sample and the undetermined characteristics of the abnormal subclass, the server can determine the probability that the target sample belongs to the abnormal subclass based on the similarity.

[0121] Therefore, the server can sum the probabilities of the target sample belonging to each of the anomaly subclasses within each anomaly category to determine the probability that the target sample belongs to that anomaly category. Alternatively, the server can also, for each anomaly category, select the probability of the anomaly subclass with the highest probability from among all the anomaly subclasses within that category, and use that probability as the overall probability that the target sample belongs to that anomaly category.

[0122] Finally, the server can determine the anomaly category to which the target sample belongs based on the probability of the target sample belonging to each anomaly category, and output the anomaly category as the anomaly detection result.

[0123] In determining the anomalous category of a target sample, the server can select the anomalous category with the highest probability of belonging to each category. Alternatively, the server can preset a probability threshold, and then select the anomalous category whose probability exceeds the threshold. In other words, the target sample can have multiple anomalous categories.

[0124] The specific methods for determining the probability of a target sample belonging to each anomaly category, and for determining the anomaly category of the target sample based on the probability of each anomaly category, can be set as needed; this manual does not impose any restrictions on this.

[0125] S206: Train the anomaly detection model to minimize the difference between the anomaly detection result of the target sample and the label of the target sample, and determine the representation features of each anomaly subclass included in each anomaly category based on the trained anomaly detection model.

[0126] In one or more embodiments provided in this specification, during the model training phase, after processing the samples, the model can typically be trained based on the processing results and annotations of the samples. Therefore, the server can train the anomaly detection model based on the anomaly detection results and annotations of the target sample.

[0127] Specifically, the server can adjust the model parameters of the anomaly detection model based on minimizing the difference between the anomaly detection result and the annotation of the target sample, in order to complete the training of the anomaly detection model.

[0128] Furthermore, as mentioned above, this specification requires the use of the trained anomaly detection model to accurately determine the representational features of each anomaly subclass corresponding to each major anomaly category, thereby achieving the technical effect of accurately determining the anomaly category of user behavior data.

[0129] Based on this, the server can determine the representational features of each subclass of anomaly contained in each major anomaly category after the anomaly detection model has been trained.

[0130] Specifically, for each major category of anomalies, the server can use the specified samples corresponding to that major category of anomalies as input to the feature extraction layer of the anomaly detection model, and obtain the user features of each specified sample output by the feature extraction layer.

[0131] Then, the server can input the user features of each specified sample into the second feature extraction layer of the anomaly detection model to obtain the undetermined features of each anomaly subclass contained in the anomaly class output by the second feature extraction layer, which are used as the representation features of each anomaly subclass contained in the anomaly class.

[0132] Of course, when determining the representation features, the server can directly use the specified samples used when training the anomaly detection model as input to determine the representation features, or it can use only a portion of the specified samples used when training the anomaly detection model as input to determine the representation features, or it can use user behavior data that was not used when training the anomaly detection model to determine the representation features.

[0133] Specifically, the server can obtain several labeled specified samples. These specified samples are not entirely identical to the specified samples. That is, a specified sample may contain the same user behavior data as the specified samples, or it may contain user behavior data different from the specified samples.

[0134] Then, the server can use each specified sample as input to the feature extraction layer of the trained anomaly detection model to obtain the user features of each specified sample output by the feature extraction layer.

[0135] Finally, the server can classify each specified sample according to the label of each specified sample, and for each abnormal category obtained by classification, input the user features of each specified sample corresponding to the abnormal category into the second feature extraction layer of the abnormal detection model to obtain the representation features of each abnormal subclass contained in the abnormal category output by the second feature extraction layer.

[0136] based on Figure 2 The anomaly detection method described employs metric learning to train the anomaly detection model. It categorizes specified samples using their labels and, for each resulting major anomaly category, determines the representational features of its subcategories. Based on the user characteristics of the target sample and the representational features of its subcategories, the major anomaly category of the target sample is determined. The anomaly detection model is then trained using the labels and the major anomaly category of the target sample. The anomaly detection model trained using this method can accurately represent each major anomaly category using the representational features of its corresponding subcategories. This approach avoids excessive computational demands while maintaining accuracy when detecting anomalies in user behavior data.

[0137] In addition, in step S102, besides clustering each specified sample, each abnormal subclass can be determined based on the probability that each specified sample belongs to each abnormal subclass.

[0138] Specifically, the server can first determine the preset subclass of the exception corresponding to each major exception category obtained from the classification.

[0139] Secondly, for each specified sample corresponding to the major anomaly category, the server can input the user features of the specified sample into the second feature extraction layer of the anomaly detection model to obtain the reference features corresponding to the specified sample output by the second feature extraction layer. These reference features include feature components corresponding to each anomaly subclass within the major anomaly category for the specified sample.

[0140] Then, for each anomaly subclass, the server can determine the feature components corresponding to the anomaly subclass in each reference feature based on the reference features of each specified sample corresponding to the anomaly subclass, and determine the probability that each specified sample belongs to the anomaly subclass based on each feature component.

[0141] Finally, the server can determine the undetermined features of the anomaly subclass based on the determined probabilities and user characteristics of each specified sample.

[0142] Furthermore, in this specification, the training objective of the anomaly detection model may not only be that the anomaly detection result of the target sample is the same as its label, but may also include that the probability of the target sample belonging to its corresponding label is greater than a preset probability threshold. Therefore, in this specification, during the training of any of the above anomaly detection models, the server can determine the anomaly subclass with the highest probability from among the anomaly subclasses included in each major anomaly class, based on the probability that the target sample belongs to each anomaly subclass, and use this subclass as the designated subclass.

[0143] Secondly, the server can use the probability of the target sample belonging to a specified subclass minus a preset probability threshold as the first loss.

[0144] Then, the server can determine the second loss based on the difference between the anomaly detection results of the target sample and the labeling of the target sample.

[0145] Finally, the server subtracts the first loss from the second loss to determine the total loss, and trains the anomaly detection model with the goal of minimizing the total loss. During the training of the anomaly detection model based on the total loss, the objective is not only to determine relatively accurate anomaly detection results, but also to ensure that the probability of a user feature corresponding to a specified subclass is greater than a preset threshold; in other words, the objective is that the probability of the user feature corresponding to the specified subclass is significantly greater than the probability of the user feature corresponding to any other subclass. Therefore, the trained anomaly detection model can not only determine relatively accurate anomaly detection results, but also ensure that the probability of a user feature corresponding to a specified subclass is greater than the preset threshold.

[0146] Following the same approach, this specification also provides an anomaly detection device, such as... Figure 5 As shown.

[0147] Figure 5 This is a schematic diagram of the anomaly detection device provided in this specification. The anomaly detection device includes:

[0148] The acquisition module 300 is used to acquire user behavior data to be detected.

[0149] The extraction module 302 is used to input the user behavior data into the first feature extraction layer of the pre-trained anomaly detection model to obtain the user features extracted by the first feature extraction layer.

[0150] The determination module 304 is used to determine the similarity between the user features and each of the pre-stored anomaly subclasses contained in each anomaly category, and to determine the anomaly category to which the user features belong based on the anomaly subclass corresponding to the anomaly feature with the highest similarity, and to use the determined anomaly category as the anomaly detection result of the user behavior data.

[0151] The representational features of the abnormal subclasses are determined using the following method:

[0152] For each major category of anomalies, the historical behavior data corresponding to that major category of anomalies are input into a pre-trained anomaly detection model. The first feature extraction layer determines the features of each user, and the user features are input into the second feature extraction layer to determine the representation features of each subclass of anomalies in that major category of anomalies.

[0153] Optionally, the anomaly detection model further includes a detection layer and a determination module 304, which is used to input the user features and the representation features of each anomaly subclass corresponding to the pre-stored anomaly major class into the detection layer of the anomaly detection model, determine the similarity between the user features and each representation feature through the detection layer, and determine the anomaly subclass corresponding to the highest similarity among the similarities; determine the anomaly major class to which the anomaly subclass corresponding to the highest similarity belongs, and output it as the anomaly detection result of the user behavior data.

[0154] The anomaly detection device also includes:

[0155] Training module 306 is used to determine target samples and their annotations, and to determine several specified samples and their annotations, based on several user behavior data of labeled anomaly categories; inputting the target samples and each specified sample into the first feature extraction layer of the anomaly detection model to be trained, to obtain the user features of the target samples and the user features corresponding to each specified sample output by the first feature extraction layer; for each anomaly category, determining each specified sample of the anomaly category based on the annotations corresponding to each specified sample; and inputting each specified sample of the anomaly category into the second feature extraction layer of the anomaly detection model, to obtain the second feature extraction. The layer outputs reference features for each specified sample of the anomaly category; for each anomaly subclass contained in the anomaly category, the representational features of the anomaly subclass are determined based on the feature components corresponding to the reference features of each specified sample of the anomaly category; based on the similarity between the user features of the target sample and the representational features of each anomaly subclass contained in each anomaly category, the anomaly subclass corresponding to the target sample is determined, and the anomaly category to which the anomaly subclass to which the target sample belongs is taken as the anomaly detection result of the target sample; the anomaly detection model is trained with the optimization objective of minimizing the difference between the anomaly detection result of the target sample and the annotation of the target sample.

[0156] Optionally, the extraction module 302 is used to input the historical behavior data corresponding to the anomaly category into the first feature extraction layer to obtain the user features output by the first feature extraction layer; input the user features into the second feature extraction layer of the anomaly detection model to determine the reference features corresponding to each user feature, wherein the reference features contain the feature components of each anomaly subclass contained in the anomaly category corresponding to the user features; and for each anomaly subclass of the anomaly category, determine the representation features of the anomaly subclass based on the feature components of the anomaly subclass in the reference features corresponding to each user feature.

[0157] Optionally, the extraction module 302 is used to determine the probability that the user feature corresponding to each of the reference features belongs to the abnormal subclass, and to determine the representation feature of the abnormal subclass based on each user feature and the probability that each user feature belongs to the abnormal subclass.

[0158] Optionally, the determining module 304 is configured to, for each major anomaly category, input the historical behavior data corresponding to that major anomaly category into the first feature extraction layer of a pre-trained anomaly detection model to obtain user features corresponding to each historical behavior data; input each user feature into the second feature extraction layer of the anomaly detection model, and cluster the historical behavior data according to the user features to determine each cluster; for each cluster, determine the representation features of the anomaly subclass corresponding to that cluster according to the representation features of the historical behavior data contained in that cluster; wherein, the clusters contained in the major anomaly category and the anomaly subclasses contained in the major anomaly category correspond one-to-one.

[0159] Optionally, the training module 306 is configured to: determine the anomaly subclass with the highest probability from each anomaly subclass included in each anomaly category based on the probability that the target sample belongs to each anomaly subclass, and designate it as a specified subclass; use the probability that the target sample belongs to the specified subclass minus a preset probability threshold as a first loss; determine a second loss based on the difference between the anomaly detection result of the target sample and the label of the target sample; subtract the first loss from the second loss to determine the total loss; and train the anomaly detection model with the minimum total loss as the optimization objective.

[0160] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 The provided anomaly detection method.

[0161] This instruction manual also provides Figure 6 The diagram shows the schematic structure of the electronic device. As described in section 6, at the hardware level, this electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile memory, and may also include other hardware required for the business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to achieve the above-mentioned functions. Figure 1 The aforementioned anomaly detection method or Figure 4 The training method for the anomaly detection model is described. Of course, besides software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution entity of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0162] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0163] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, ASICs, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0164] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0165] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0166] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0167] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0168] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0169] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0170] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0171] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0172] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0173] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0174] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0175] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0176] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0177] The above description is merely an embodiment of this specification and is not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. An anomaly detection method, the method comprising: Acquire user behavior data to be detected; The user behavior data is input into the first feature extraction layer of a pre-trained anomaly detection model to obtain the user features extracted by the first feature extraction layer. Based on the user features and the representational features of each subclass of anomalies contained in each pre-stored major anomaly category, the similarity between the user features and each representational feature is determined. Based on the anomaly subclass corresponding to the representational feature with the highest similarity, the major anomaly category to which the user features belong is determined. The determined major anomaly category is used as the anomaly detection result of the user behavior data. The representational features of the abnormal subclasses are determined using the following method: For each major anomaly category, the historical behavior data corresponding to that major anomaly category are input into a pre-trained anomaly detection model. The first feature extraction layer determines each user feature, and the user features are input into a second feature extraction layer to determine the reference features corresponding to each user feature. The reference features contain the feature components of each anomaly subclass contained in the major anomaly category. For each anomaly subclass of the major anomaly category, the representation features of the anomaly subclass are determined based on the feature components of the anomaly subclass in the reference features corresponding to each user feature.

2. The method as described in claim 1, wherein the anomaly detection model further includes a detection layer; Based on the user characteristics and the pre-stored representational features of each subclass of anomaly included in each major anomaly category, the similarity between the user characteristics and each representational feature is determined. Then, based on the anomaly subclass corresponding to the representational feature with the highest similarity, the major anomaly category to which the user characteristics belong is determined. The determined major anomaly category is used as the anomaly detection result of the user behavior data, specifically including: The user features and the pre-stored representation features of each subclass of anomaly corresponding to each major anomaly category are input into the detection layer of the anomaly detection model. The detection layer determines the similarity between the user features and each representation feature, and determines the anomaly subclass corresponding to the highest similarity among all similarities. The anomaly category to which the anomaly subclass corresponding to the highest similarity belongs is determined and output as the anomaly detection result of the user behavior data.

3. The method as described in claim 1, wherein the anomaly detection model is trained in the following manner: Based on several user behavior data that have been labeled with abnormal categories, determine the target samples and their labels, as well as determine several specified samples and their labels. The target sample and each specified sample are respectively input into the first feature extraction layer of the anomaly detection model to be trained, so as to obtain the user features of the target sample output by the first feature extraction layer, and the user features corresponding to each specified sample respectively. For each major category of anomalies, the designated samples for that major category are determined based on the labels corresponding to each designated sample. Each specified sample of the anomaly category is used as input and fed into the second feature extraction layer of the anomaly detection model to obtain the reference features of each specified sample of the anomaly category output by the second feature extraction layer. For each subclass of anomaly contained in the major anomaly category, the characterization features of the subclass of anomaly are determined based on the feature components of the subclass of anomaly corresponding to the reference features of each specified sample in the major anomaly category. Based on the similarity between the user features of the target sample and the representation features of each abnormal subclass contained in each abnormal category, the abnormal subclass corresponding to the target sample is determined, and the abnormal category to which the abnormal subclass to which the target sample belongs is taken as the abnormal detection result of the target sample. The anomaly detection model is trained with the goal of minimizing the difference between the anomaly detection result and the annotation of the target sample.

4. The method as described in claim 1, wherein the representational features of the anomaly subclass are determined based on the feature components of the anomaly subclass in each reference feature corresponding to each user feature, specifically including: Based on the feature components in each reference feature that correspond to the anomaly subclass, determine the probability that the user feature corresponding to each reference feature belongs to the anomaly subclass; Based on each user characteristic and the probability that each user characteristic belongs to the abnormal subclass, the representational features of the abnormal subclass are determined.

5. The method of claim 1, further comprising: For each major category of anomalies, the historical behavior data corresponding to that major category of anomalies are input into the first feature extraction layer of the pre-trained anomaly detection model to obtain the user features corresponding to each historical behavior data. Each user feature is input into the second feature extraction layer of the anomaly detection model. Based on each user feature, the historical behavior data are clustered to determine each cluster. For each cluster, the representation features of the abnormal subclasses corresponding to the cluster are determined based on the representation features of the historical behavioral data contained in the cluster. The clusters and subclasses of the anomaly category are in one-to-one correspondence.

6. The method as described in claim 3, wherein the anomaly detection model is trained with the minimum difference between the anomaly detection result of the target sample and the annotation of the target sample as the optimization objective, specifically including: Based on the probability that the target sample belongs to each abnormal subclass, the abnormal subclass with the highest probability is determined from the abnormal subclasses contained in each abnormal major class and designated as the specified subclass. The first loss is the value obtained by subtracting a preset probability threshold from the probability that the target sample belongs to the specified subclass. The second loss is determined based on the difference between the anomaly detection results of the target sample and the labeling of the target sample; Subtract the first loss from the second loss to determine the total loss, and train the anomaly detection model with the goal of minimizing the total loss.

7. An anomaly detection device, the device comprising: The acquisition module is used to acquire user behavior data to be detected; The extraction module is used to input the user behavior data into the first feature extraction layer of a pre-trained anomaly detection model to obtain the user features extracted by the first feature extraction layer. The determination module is used to determine the similarity between the user features and each of the pre-stored anomaly subclasses contained in each anomaly category, and to determine the anomaly category to which the user features belong based on the anomaly subclass corresponding to the anomaly feature with the highest similarity, and to use the determined anomaly category as the anomaly detection result of the user behavior data. The representational features of the abnormal subclasses are determined using the following method: For each major anomaly category, the historical behavior data corresponding to that major anomaly category are input into a pre-trained anomaly detection model. The first feature extraction layer determines each user feature, and the user features are input into a second feature extraction layer to determine the reference features corresponding to each user feature. The reference features contain the feature components of each anomaly subclass contained in the major anomaly category. For each anomaly subclass of the major anomaly category, the representation features of the anomaly subclass are determined based on the feature components of the anomaly subclass in the reference features corresponding to each user feature.

8. The apparatus of claim 7, wherein the anomaly detection model further comprises a detection layer; The determining module is specifically used to input the user features and the representation features of each subclass of anomaly corresponding to the pre-stored major anomaly category into the detection layer of the anomaly detection model, determine the similarity between the user features and each representation feature through the detection layer, and determine the anomaly subclass corresponding to the highest similarity among the similarities; determine the major anomaly category to which the anomaly subclass corresponding to the highest similarity belongs, and output it as the anomaly detection result of the user behavior data.

9. The apparatus of claim 7, further comprising: The training module is used to determine target samples and their labels, as well as several specified samples and their labels, based on several user behavior data that have been labeled with major anomaly categories. The target sample and each designated sample are respectively input into the first feature extraction layer of the anomaly detection model to be trained, to obtain the user features of the target sample output by the first feature extraction layer, and the user features corresponding to each designated sample respectively; for each anomaly category, each designated sample of the anomaly category is determined according to the annotations corresponding to each designated sample; each designated sample of the anomaly category is input into the second feature extraction layer of the anomaly detection model, to obtain the reference features of each designated sample of the anomaly category output by the second feature extraction layer; for each anomaly subclass contained in the anomaly category, the representation features of the anomaly subclass are determined according to the feature components corresponding to the reference features of each designated sample of the anomaly category; based on the similarity between the user features of the target sample and the representation features of each anomaly subclass contained in each anomaly category, the anomaly subclass corresponding to the target sample is determined, and the anomaly category to which the anomaly subclass to which the target sample belongs is taken as the anomaly detection result of the target sample; The anomaly detection model is trained with the goal of minimizing the difference between the anomaly detection result and the annotation of the target sample.

10. The apparatus of claim 7, wherein the extraction module is specifically configured to determine, based on the feature components in each reference feature corresponding to the abnormal subclass, the probability that the user feature corresponding to each reference feature belongs to the abnormal subclass; and to determine the representational features of the abnormal subclass based on each user feature and the probability that each user feature belongs to the abnormal subclass.

11. The apparatus of claim 7, wherein the determining module is specifically configured to, for each major anomaly category, input the historical behavior data corresponding to that major anomaly category into the first feature extraction layer of a pre-trained anomaly detection model to obtain user features corresponding to each historical behavior data; input the user features into the second feature extraction layer of the anomaly detection model, and cluster the historical behavior data according to the user features to determine each cluster; for each cluster, determine the representation features of the anomaly subclass corresponding to that cluster according to the representation features of the historical behavior data contained in that cluster; wherein, The clusters contained in the major anomaly category and the subclasses of the major anomaly category correspond one-to-one.

12. The apparatus of claim 9, wherein the training module is specifically configured to: determine the anomaly subclass with the highest probability from each anomaly subclass included in each anomaly category based on the probability that the target sample belongs to each anomaly subclass, and designate it as a specified subclass; use the probability that the target sample belongs to the specified subclass minus a preset probability threshold as a first loss; determine a second loss based on the difference between the anomaly detection result of the target sample and the labeling of the target sample; subtract the first loss from the second loss to determine the total loss; and train the anomaly detection model with the minimum total loss as the optimization objective.

13. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 6.

14. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 6.

Images