Abnormal data identification method and device, computer device and storage medium

Abstract

The application relates to an abnormal data identification method and device, a computer device and a storage medium. The application relates to the technical field of information security and artificial intelligence. The method comprises the following steps: acquiring model training parameters of a plurality of clients; in the model training parameters of the clients, identifying local discrete model training parameters, extreme value model training parameters satisfying a preset extreme value range, and global discrete model training parameters, and determining abnormal clients based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters and the clients corresponding to the global discrete model training parameters; and based on Gaussian distribution information of the model training parameters, identifying end value model training data in the model training data of each abnormal client, and taking the end value model training data as target abnormal data. The method can improve the identification accuracy of abnormal data.

Description

Technical Field

[0001] This application relates to the fields of information security and artificial intelligence technology, and in particular to a method, apparatus, computer device, and storage medium for identifying abnormal data. Background Technology

[0002] With the development of the financial industry, various artificial intelligence models are needed to assist in data processing. However, during the training of artificial intelligence models, they are often damaged by abnormal data from abnormal clients, which can lead to attacks on the artificial intelligence models and prevent them from operating normally. Therefore, how to identify abnormal data is a key research focus for improving the defense of artificial intelligence models.

[0003] Traditional methods for identifying outlier data involve manually checking the training data sent by each client participating in the training process for anomalies, and then classifying the anomaly-laden training data as outlier. However, with a large number of clients, relying solely on manual judgment is prone to errors, resulting in low accuracy in identifying outlier data. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer device, computer-readable storage medium, and computer program product for identifying abnormal data in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for identifying anomalous data. The method includes:

[0006] Obtain the training parameters of each model from multiple clients;

[0007] Among the model training parameters of each client, identify the local discrete model training parameters, the extreme value model training parameters that satisfy the preset extreme value range, and the global discrete model training parameters, and determine the abnormal client based on the client corresponding to the local discrete model training parameters, the client corresponding to the extreme value model training parameters, and the client corresponding to the global discrete model training parameters;

[0008] Based on the Gaussian distribution information of the training parameters of each model, the end-value model training data in the training data of each model of each abnormal client is identified, and each end-value model training data is used as the target abnormal data.

[0009] Optionally, obtaining the model training parameters from multiple clients includes:

[0010] The model is sent to each of the aforementioned clients, and the model is trained through each of the aforementioned clients;

[0011] When a preset time point is reached, all model training parameters for each client that trained the model during the historical training time period corresponding to that time point are collected to obtain the model training parameters for each client.

[0012] Optionally, the step of identifying local discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and global discrete model training parameters among the model training parameters of each client, and determining abnormal clients based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the global discrete model training parameters, includes:

[0013] For each client, the discrete parameter algorithm is used to calculate the local discrete model training parameters among all model training parameters of the client, and if the number of discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as the first abnormal client.

[0014] For each time point when the model training parameters of each client are acquired, the extreme value model training parameters that belong to the preset extreme value range in the model training parameters of each client at the time point are calculated by the extreme value range algorithm, and the client corresponding to the extreme value model training parameters is marked as the second abnormal client.

[0015] Using the discrete range algorithm, calculate the global discrete model training parameters that belong to the preset discrete range among the model training parameters of all clients, and mark the clients corresponding to the global discrete model training parameters as third abnormal clients.

[0016] A client that is simultaneously marked as the first abnormal client, the second abnormal client, and the third abnormal client will be considered an abnormal client.

[0017] Optionally, the step of calculating the locally discrete model training parameters among all model training parameters of the client using a discrete parameter algorithm, and marking the client as a first abnormal client when the number of discrete model training parameters is greater than a preset number of discrete parameters, includes:

[0018] The first median model training parameter is calculated by using a discrete parameter algorithm, which corresponds to the median of all model training parameters of the client. Based on the first median model training parameter, the parameter range of the model training parameters of the client is determined.

[0019] Model training parameters that do not fall within the specified parameter range from the client's model training parameters are taken as local discrete model training parameters. If the number of local discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as a first abnormal client.

[0020] Optionally, for each time point when the model training parameters of each client are acquired, the extreme value model training parameters belonging to a preset extreme value range among the model training parameters of each client at the time point are calculated using an extreme value range algorithm, and the client corresponding to the extreme value model training parameters is marked as a second abnormal client, including:

[0021] The model training parameters of each client are divided into multiple model training parameter groups according to the time point at which each model training parameter is collected; the model training parameter group includes the model training parameters of each client for the time period corresponding to the time point.

[0022] For each time point, the second median model training parameter in the model training parameter group corresponding to the time point is calculated by the extreme value range algorithm, and the first numerical sorting sequence of each model training parameter at the time point is determined based on each second median model training parameter.

[0023] Based on the first numerical sorting sequence, extreme value model training parameters in each model training parameter group corresponding to the time point are filtered by a preset sequence filtering method, and the clients corresponding to each extreme value model training parameter are marked as second abnormal clients.

[0024] Optionally, the step of calculating the global discrete model training parameters belonging to a preset discrete range among the model training parameters of all clients using a discrete range algorithm, and marking the clients corresponding to the global discrete model training parameters as third abnormal clients, includes:

[0025] Based on all model training parameters acquired from all clients, the third median model training parameter is calculated in each model training parameter using a discrete range algorithm. Then, all model training parameters are sorted from farthest to closest to the third median model training parameter to obtain a second sorting sequence of all model training parameters.

[0026] Based on the number of all model training parameters and the second sorting sequence, discrete clients corresponding to a preset number of global discrete model training parameters that belong to a preset discrete range are selected from the model training parameters and marked as third abnormal clients.

[0027] Optionally, the step of identifying end-value model training data in the training data of each model based on the Gaussian distribution information of each model training parameter, and using each end-value model training data as target abnormal data, includes:

[0028] Based on the training data of each model for each abnormal client, Gaussian distribution processing is performed on the training data of each model to obtain the Gaussian distribution sequence of the training data of each model.

[0029] Based on the Gaussian distribution sequence, model training data within a preset range of endpoints are selected from each of the model training data as endpoint model training data.

[0030] Optionally, after identifying local discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and global discrete model training parameters among the model training parameters of each client, and determining abnormal clients based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the global discrete model training parameters, the step further includes:

[0031] Obtain the sample feature vector of the sample model training data, and filter out the abnormal clients to be tested from all the clients except the abnormal client; the abnormal client to be tested is the client that is simultaneously marked as any two of the abnormal clients among the first abnormal client, the second abnormal client, and the third abnormal client.

[0032] For each abnormal client to be tested, a feature vector extraction network is used to extract the model feature vectors of each model training data of the abnormal client to be tested.

[0033] The sample feature vector and each of the model feature vectors are input into the discriminant network for comparison processing to obtain the difference value between each of the model feature vectors and the sample feature vectors;

[0034] Model training data whose feature vectors correspond to differences exceeding the difference threshold are used as target anomaly data.

[0035] Secondly, this application also provides a device for identifying anomalous data. The device includes:

[0036] The acquisition module is used to acquire the training parameters of each model from multiple clients;

[0037] The tagging module is used to identify local discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and global discrete model training parameters in each model training parameter of each client, and to determine abnormal clients based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the global discrete model training parameters.

[0038] The identification module is used to identify the end-value model training data in the training data of each model for each abnormal client based on the Gaussian distribution information of the training parameters of each model, and to take each end-value model training data as the target abnormal data.

[0039] Optionally, the acquisition module is specifically used for:

[0040] The model is sent to each of the aforementioned clients, and the model is trained through each of the aforementioned clients;

[0041] When a preset time point is reached, all model training parameters for each client that trained the model during the historical training time period corresponding to that time point are collected to obtain the model training parameters for each client.

[0042] Optionally, the marking module is specifically used for:

[0043] For each client, the discrete parameter algorithm is used to calculate the local discrete model training parameters among all model training parameters of the client, and if the number of discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as the first abnormal client.

[0044] For each time point when the model training parameters of each client are acquired, the extreme value model training parameters that belong to the preset extreme value range in the model training parameters of each client at the time point are calculated by the extreme value range algorithm, and the client corresponding to the extreme value model training parameters is marked as the second abnormal client.

[0045] Using the discrete range algorithm, calculate the global discrete model training parameters that belong to the preset discrete range among the model training parameters of all clients, and mark the clients corresponding to the global discrete model training parameters as third abnormal clients.

[0046] A client that is simultaneously marked as the first abnormal client, the second abnormal client, and the third abnormal client will be considered an abnormal client.

[0047] Optionally, the marking module is specifically used for:

[0048] The first median model training parameter is calculated by using a discrete parameter algorithm, which corresponds to the median of all model training parameters of the client. Based on the first median model training parameter, the parameter range of the model training parameters of the client is determined.

[0049] Model training parameters that do not fall within the specified parameter range from the client's model training parameters are taken as local discrete model training parameters. If the number of local discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as a first abnormal client.

[0050] Optionally, the marking module is specifically used for:

[0051] The model training parameters of each client are divided into multiple model training parameter groups according to the time point at which each model training parameter is collected; the model training parameter group includes the model training parameters of each client for the time period corresponding to the time point.

[0052] For each time point, the second median model training parameter in the model training parameter group corresponding to the time point is calculated by the extreme value range algorithm, and the first numerical sorting sequence of each model training parameter at the time point is determined based on each second median model training parameter.

[0053] Based on the first numerical sorting sequence, extreme value model training parameters in each model training parameter group corresponding to the time point are filtered by a preset sequence filtering method, and the clients corresponding to each extreme value model training parameter are marked as second abnormal clients.

[0054] Optionally, the marking module is specifically used for:

[0055] Based on all model training parameters acquired from all clients, the third median model training parameter is calculated in each model training parameter using a discrete range algorithm. Then, all model training parameters are sorted from farthest to closest to the third median model training parameter to obtain a second sorting sequence of all model training parameters.

[0056] Based on the number of all model training parameters and the second sorting sequence, discrete clients corresponding to a preset number of global discrete model training parameters that belong to a preset discrete range are selected from the model training parameters and marked as third abnormal clients.

[0057] Optionally, the identification module is specifically used for:

[0058] Based on the training data of each model for each abnormal client, Gaussian distribution processing is performed on the training data of each model to obtain the Gaussian distribution sequence of the training data of each model.

[0059] Based on the Gaussian distribution sequence, model training data within a preset range of endpoints are selected from each of the model training data as endpoint model training data.

[0060] Optionally, the device further includes:

[0061] The sample acquisition module is used to acquire the sample feature vector of the sample model training data, and to filter the abnormal clients to be tested from the clients other than the abnormal client; the abnormal client to be tested is a client that is simultaneously marked as any two of the first abnormal client, the second abnormal client, and the third abnormal client.

[0062] The extraction module is used to extract the model feature vectors of each model training data of the abnormal client under test through a feature vector extraction network.

[0063] The discrimination module is used to input the sample feature vector and each of the model feature vectors into the discrimination network for comparison processing, and obtain the difference value between each of the model feature vectors and the sample feature vectors;

[0064] The filtering module is used to identify model training data with feature vectors corresponding to difference values ​​greater than the difference threshold as target outlier data.

[0065] Thirdly, this application provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the method described in any one of the first aspects.

[0066] Fourthly, this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0067] Fifthly, this application provides a computer program product. The computer program product includes a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0068] The aforementioned method, apparatus, computer equipment, and storage medium for identifying abnormal data acquire model training parameters from multiple clients. Among these parameters, they identify locally discrete model training parameters, extreme value model training parameters satisfying a preset extreme value range, and globally discrete model training parameters. Based on the clients corresponding to the locally discrete model training parameters, the extreme value model training parameters, and the globally discrete model training parameters, they determine abnormal clients. Based on the Gaussian distribution information of each model training parameter, they identify end-value model training data within the model training data of each abnormal client and use these end-value model training data as target abnormal data. By identifying locally discrete model training parameters, extreme value model training parameters satisfying a preset extreme value range, and globally discrete model training parameters, abnormal clients are marked. Furthermore, by using the Gaussian distribution information of each model training parameter to identify target abnormal data within each abnormal client, the process of manually detecting abnormal data is avoided, thus improving the accuracy of abnormal data identification. Attached Figure Description

[0069] Figure 1 This is a flowchart illustrating a method for identifying anomalous data in one embodiment;

[0070] Figure 2 This is a flowchart illustrating the step of marking abnormal clients in one embodiment;

[0071] Figure 3 This is a flowchart illustrating an example of identifying anomalous data in one embodiment;

[0072] Figure 4 This is a structural block diagram of a device for identifying abnormal data in one embodiment;

[0073] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0074] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0075] The abnormal data identification method provided in this application can be applied to terminals, servers, and systems including both terminals and servers, and is implemented through interaction between the terminal and the server. The terminal can include, but is not limited to, various personal computers, laptops, tablets, etc. This terminal uses discrete parameter algorithms, extreme value range algorithms, and discrete range algorithms to mark abnormal clients among each client, and identifies target abnormal data in each abnormal client by using the Gaussian distribution information of the training parameters of each model. This avoids the process of manually detecting abnormal data and improves the accuracy of abnormal data identification.

[0076] In one embodiment, such as Figure 1 As shown, a method for identifying abnormal data is provided. Taking the application of this method to a terminal as an example, the method includes the following steps:

[0077] Step S101: Obtain the training parameters of each model from multiple clients.

[0078] In this embodiment, in response to the user's model training operation, the terminal selects the user-selected client from the initial clients and sends the model to each client. At a preset time point, the terminal simultaneously collects the parameter information of the training model for each client, obtaining the model training parameters for each client. The terminal also collects the model training parameters of each client at each preset time point throughout a historical time period, obtaining the model training parameters for each client. The specific acquisition process will be described in detail later. The model training parameters are used to characterize the current training status and progress information of the model. For example, model training parameters may include, but are not limited to, model training progress of 50%, model fitness of 30%, parameter acquisition capability of 30%, etc. These model training parameters also include the specific content information of the model corresponding to the above proportions. The model may be, but is not limited to, a federated learning model, or an artificial intelligence model related to federated learning.

[0079] Step S102: In each model training parameter of each client, identify the local discrete model training parameters, the extreme value model training parameters that satisfy the preset extreme value range, and the global discrete model training parameters, and determine the abnormal client based on the client corresponding to the local discrete model training parameters, the client corresponding to the extreme value model training parameters, and the client corresponding to the global discrete model training parameters.

[0080] In this embodiment, the terminal performs feature processing on the model training parameters of each client, ensuring that each model training parameter remains within the [0,1] interval. For the feature-processed model training parameters, the terminal uses a discrete parameter algorithm to identify the local discrete model training parameters in each client and marks a first abnormal client based on all local discrete model training parameters of each client. Using an extreme value range algorithm, the terminal identifies extreme model training parameters collected at the same time point and marks clients with extreme model training parameters that satisfy a preset extreme value range as second abnormal clients. Using a discrete range algorithm, the terminal identifies global discrete model training parameters among all model training parameters of all clients and marks clients containing global discrete model training parameters as third abnormal clients. The terminal then filters among all clients that are simultaneously marked as first, second, and third abnormal clients and designates these clients as abnormal clients. The algorithm comprises three sub-algorithms: the discrete parameter algorithm (using the median order principle), the extreme value range algorithm (using the median fusion principle), and the discrete range algorithm (using the median interaction fusion principle). Specifically, the discrete parameter algorithm applies the median order principle, the extreme value range algorithm applies the median fusion principle, and the discrete range algorithm applies the median interaction fusion principle.

[0081] Step S103: Based on the Gaussian distribution information of the training parameters of each model, identify the end-value model training data in the training data of each model of each abnormal client, and use each end-value model training data as the target abnormal data.

[0082] In this embodiment, the terminal establishes a Gaussian distribution sequence for each model training data based on the model training data of each abnormal client obtained in step S102, using a Gaussian distribution strategy. The terminal presets a distribution filtering method and, based on the Gaussian distribution sequence and this preset filtering method, filters out end-value model training data from the model training data. The terminal uses these end-value model training data as target abnormal data. Specifically, the preset distribution filtering method can be to use the model training data located at the two extremes of the Gaussian distribution sequence as end-value model training data.

[0083] Based on the above scheme, the abnormal clients in each client are marked by discrete parameter algorithm, extreme value range algorithm and discrete range algorithm, and the target abnormal data in each abnormal client is identified by Gaussian distribution information of the training parameters of each model, avoiding the process of manually detecting abnormal data and improving the accuracy of abnormal data identification.

[0084] Optionally, the model training parameters of multiple clients can be obtained, including: sending the model to each client and training the model through each client; and, when a preset time point is reached, collecting all model training parameters of each client during the historical training time period corresponding to the time point, to obtain the model training parameters of each client.

[0085] In this embodiment, before acquiring model training data from each client, the terminal first selects the client from multiple clients that needs to train the model and sends the model to each client respectively. The terminal trains the model through each client separately, with preset time points. When the preset time points are met, the terminal collects the model training parameters obtained by the client during the time period corresponding to that preset time point for each client. Similarly, through the above method, the terminal obtains the model training parameters for each preset time point in the historical time period.

[0086] Based on the above scheme, the model training parameters of each client are collected at preset time points to ensure that the model training parameters of each client are collected at the same time, thus providing a data foundation for subsequent identification of abnormal clients.

[0087] Optional, such as Figure 2 As shown, among the model training parameters of each client, local discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and global discrete model training parameters are identified. Based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the global discrete model training parameters, abnormal clients are determined, including:

[0088] Step S201: For each client, the discrete parameter algorithm is used to calculate the local discrete model training parameters in all model training parameters of the client, and if the number of discrete model training parameters is greater than the preset number of discrete parameters, the client is marked as the first abnormal client.

[0089] In this embodiment, for each client, the terminal calculates the median of all training parameters for that client using a median algorithm (i.e., a discrete parameter algorithm) corresponding to the median order principle. The terminal presets a parameter range for this median and uses model training parameters larger than this parameter range as discrete model training parameters. The terminal counts the number of training parameters for each discrete model and presets a discrete number. The terminal compares the number of training parameters for each discrete model with the preset discrete number, and if the number of training parameters for each discrete model is greater than the preset discrete number, the terminal marks that client as a first abnormal client. Similarly, through the above scheme, the terminal obtains each first abnormal client. The parameter range is a preset range centered on the median, ordered from farthest to closest to the median.

[0090] Step S202: For each time point when the model training parameters of each client are obtained, the extreme value model training parameters that belong to the preset extreme value range in the model training parameters of each client at the time point are calculated by the extreme value range algorithm, and the client corresponding to the extreme value model training parameters is marked as the second abnormal client.

[0091] In this embodiment, the terminal divides all model training data into multiple model training data groups corresponding to each collection time point in the historical time period. For each model training data group, the terminal calculates the median using a median algorithm (i.e., an extreme value range algorithm) corresponding to the median fusion principle. The terminal presets an extreme value range and, using this median as the center, filters model training data belonging to the preset extreme value range in order of distance from the median from farthest to near. Clients corresponding to each model training data belonging to the preset extreme value range are marked as second abnormal clients. The preset extreme value range can be defined as 10% of the total number of model training data points centered on the median and ordered from farthest to nearest from the median. The preset extreme value range is the set corresponding to the preset maximum and minimum value ranges within the model training data group. Based on the above scheme, the terminal obtains each second abnormal client corresponding to each model training data group.

[0092] Step S203: Using the discrete range algorithm, calculate the global discrete model training parameters that belong to the preset discrete range among the model training parameters of all clients, and mark the clients corresponding to the global discrete model training parameters as the third abnormal clients.

[0093] In this embodiment, the terminal calculates the median of all model training parameters for all clients using the median algorithm (i.e., the discrete range algorithm) corresponding to the median interaction fusion principle. The terminal presets a discrete range centered on this median and filters model training parameters belonging to this discrete range from all model training parameters. The terminal marks the discrete clients corresponding to the model training parameters belonging to this discrete range as third abnormal clients. The discrete range is the range centered on the median, outside the target range but within the range encompassed by all model training parameters; the target range is the range preset by the terminal. The specific marking process will be explained in detail later.

[0094] Step S204: The client that is simultaneously marked as the first abnormal client, the second abnormal client, and the third abnormal client is designated as an abnormal client.

[0095] In this embodiment, the terminal filters out clients that are simultaneously marked as a first abnormal client, a second abnormal client, and a third abnormal client from among the clients. The filtered clients are then designated as abnormal clients.

[0096] Based on the above scheme, the accuracy of identifying abnormal clients is improved by simultaneously screening abnormal clients using discrete parameter algorithms, extreme value range algorithms, and discrete range algorithms.

[0097] Optionally, using a discrete parameter algorithm, calculate the locally discrete model training parameters among all model training parameters of the client, and mark the client as a first abnormal client if the number of discrete model training parameters is greater than a preset number of discrete parameters. This includes: using a discrete parameter algorithm, calculating the first median model training parameter corresponding to the median among all model training parameters of the client, and determining the parameter range of the client's model training parameters based on the first median model training parameter; taking the model training parameters of the client that do not belong to the parameter range as locally discrete model training parameters, and marking the client as a first abnormal client if the number of locally discrete model training parameters is greater than a preset number of discrete parameters.

[0098] In this embodiment, for each client, the terminal calculates the first median model training parameter corresponding to the median of all model training parameters for that client using a discrete parameter algorithm. Based on this first median model training parameter, the terminal determines the parameter range of the client's model training parameters according to a preset discrete number ratio. The parameter range is a preset range centered on the first median model training parameter, ordered from farthest to nearest from the first median model training parameter. The terminal considers model training parameters of the client that do not belong to the parameter range as locally discrete model training parameters. The terminal counts the number of discrete model training parameters and presets a discrete number. If the number of locally discrete model training parameters exceeds the preset discrete number, the terminal marks the client as a first abnormal client. Similarly, through the above steps, the terminal marks the first abnormal client among all clients.

[0099] Based on the above scheme, the first abnormal client is marked by calculating the median of each client, thereby improving the accuracy of identifying abnormal clients.

[0100] Optionally, for each time point when the model training parameters of each client are acquired, the extreme value model training parameters belonging to the preset extreme value range are calculated using the extreme value range algorithm, and the clients corresponding to the extreme value model training parameters are marked as second abnormal clients. This includes: dividing each client's model training parameters into multiple model training parameter groups according to the time point when each model training parameter is acquired; the model training parameter group includes the model training parameters of each client in the time period corresponding to the time point; for each time point, the second median model training parameter in the model training parameter group corresponding to the time point is calculated using the extreme value range algorithm, and based on each second median model training parameter, a first numerical sorting sequence of each model training parameter at the time point is determined; based on the first numerical sorting sequence, the extreme value model training parameters in each model training parameter group corresponding to the time point are filtered using a preset sequence filtering method, and the clients corresponding to each extreme value model training parameter are marked as second abnormal clients.

[0101] In this embodiment, the terminal divides the model training parameters of each client into model training parameter groups corresponding to different time periods according to the collection time points in the historical time period. Each model training parameter group corresponds to a different client, and the collection time point for each model training parameter is the same. That is, the model training parameter group includes the model training parameters of each client for the corresponding time period at that time point. For each time point, the terminal calculates the second median model training parameter among the model training parameters of each client at that time point using an extreme value range algorithm. Based on the second median model training parameter, the terminal arranges the parameters in ascending order of distance from the second median model training parameter to obtain a first numerical sorting sequence of the model training parameters at that time point. The terminal uses a preset sequence filtering method and, based on the first numerical sorting sequence and the preset sequence filtering method, filters the extreme model training parameters among the model training parameters at that time point. The terminal marks the extreme client corresponding to each extreme model training parameter as a second abnormal client. The preset sequence filtering method can be to select model training data that represents 10% of the total number of model training data at a given time point, arranged from farthest to closest to the second median model training parameters. Similarly, using the above scheme, the terminal marks the corresponding second-labeled anomalous client at each time point. If a client has already been marked as a second-labeled anomalous client in the model training data group at one time point, and is subsequently marked as such at other time points, the terminal will not repeat the marking of that second-labeled anomalous client.

[0102] Based on the above scheme, by dividing the model training data into groups corresponding to different time points and using the extreme value range algorithm to mark the second labeled abnormal client of the model training data group, the accuracy of identifying abnormal clients is improved.

[0103] Optionally, using a discrete range algorithm, calculate the global discrete model training parameters belonging to a preset discrete range among the model training parameters of all clients, and mark the clients corresponding to the global discrete model training parameters as third abnormal clients. This includes: based on all model training parameters of all clients obtained, using the discrete range algorithm, calculating the third median model training parameter among the model training parameters, and sorting all model training parameters in order of distance from the third median model training parameter to obtain a second sorting sequence of all model training parameters; based on the number of all model training parameters and the second sorting sequence, using a preset sequence filtering method, selecting a preset number of discrete clients corresponding to the global discrete model training parameters belonging to the preset discrete range among the model training parameters, and marking them as third abnormal clients.

[0104] In this embodiment, the terminal calculates the third median model training parameter among all model training parameters based on all model training parameters acquired from all clients, using a discrete range algorithm. The terminal sorts all model training parameters from farthest to nearest, using the third median model training parameter as the center, resulting in a second sorted sequence. The terminal presets a sequence filtering method, a number of discrete model training parameters, and a discrete range. Within the second sorted sequence, the terminal uses the preset sequence filtering method to filter a preset number of global discrete model training parameters belonging to the preset discrete range, based on the number of all model training parameters and the second sorted sequence. The terminal marks the discrete clients corresponding to each global discrete model training parameter as third abnormal clients. The preset filtering method may include, but is not limited to, selecting model training data that represents 10% of all model training data in order of distance from the third median model training parameter from farthest to nearest.

[0105] Based on the above scheme, by using a preset sequence filtering method, a preset number of discrete clients corresponding to the discrete model training parameters that fall within a preset discrete range are selected from the training parameters of each model and marked as third abnormal clients, thereby improving the accuracy of identifying abnormal clients.

[0106] Optionally, based on the Gaussian distribution information of the training parameters of each model, the endpoint model training data in the training data of each model of each abnormal client is identified, and each endpoint model training data is used as the target abnormal data. This includes: based on the training data of each model of each abnormal client, the training data of each model is processed by Gaussian distribution strategy to obtain the Gaussian distribution sequence of each model training data; based on the Gaussian distribution sequence, the training data of each model training data with a preset endpoint range is selected as the endpoint model training data.

[0107] In this embodiment, the terminal processes the model training parameters of each abnormal client obtained in step S103 using a Gaussian distribution sequence to obtain Gaussian distribution values ​​for each model training parameter. The terminal then sorts the Gaussian distribution values ​​of each model training parameter in descending order to obtain a Gaussian distribution sequence for all model training parameters. The terminal presets an end-value range and filters model training data belonging to this preset range from all model training data, designating these as end-value model training data. The preset end-value range can be defined as the 10% of model training data located at either end of the distribution sequence.

[0108] Based on the above scheme, abnormal data is filtered out from each abnormal client by using a Gaussian distribution sequence, which improves the accuracy of abnormal data filtering.

[0109] Optionally, among the model training parameters of each client, locally discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and globally discrete model training parameters are identified. After determining the abnormal clients based on the clients corresponding to the locally discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the globally discrete model training parameters, the process further includes: obtaining the sample feature vectors of the sample model training data, and filtering out potential abnormal clients from among the clients other than the abnormal clients; the potential abnormal clients are clients corresponding to any two of the clients simultaneously marked as the first, second, and third abnormal clients; for each potential abnormal client, the model feature vectors of each model training data of the potential abnormal client are extracted through a feature vector extraction network; the sample feature vectors and each model feature vector are input into the discriminator of the attention network for comparison processing to obtain the difference value between each model feature vector and the sample feature vector; the model training data with model feature vectors corresponding to difference values ​​greater than the difference threshold are taken as target abnormal data.

[0110] In this embodiment, the terminal acquires sample feature vectors from the sample model training data. This sample model training data is normal training data, distinct from anomalous data. Among all clients (excluding anomalous clients), the terminal filters clients simultaneously marked as a first anomalous client and a second anomalous client, a first anomalous client and a third anomalous client, and a second anomalous client and a third anomalous client, and designates these clients as anomalous clients to be tested. Specifically, a client to be tested is a client marked as anomalous twice, excluding those marked three times. For each client to be tested, the terminal extracts model feature vectors from its model training data using a feature vector extraction network. The terminal inputs the sample feature vectors and each model feature vector into the discriminator of the self-attention network for comparison, obtaining the difference value between each model feature vector and the sample feature vector. The terminal designates the model training data with model feature vectors whose difference values ​​exceed a threshold as target anomalous data. The discriminator of the self-attention network can be trained using multiple normal model training data and multiple anomalous model training data to obtain the discriminator used for comparison processing. The discriminator of this self-attention network can be any discriminator of a self-attention network capable of implementing the above steps.

[0111] Based on the above scheme, by filtering the clients marked twice, abnormal clients are avoided and the accuracy of identifying abnormal clients is improved.

[0112] This application also provides an example of identifying anomalous data, such as Figure 3 As shown, the specific processing procedure includes the following steps:

[0113] Step S301: Send the model to each client and train the model through each client.

[0114] Step S302: When the preset time point is reached, collect all model training parameters of each client during the historical training time period corresponding to the time point to obtain the model training parameters of each client.

[0115] Step S303: Calculate the first median model training parameter corresponding to the median of all model training parameters of the client using the discrete parameter algorithm, and determine the parameter range of the client's model training parameters based on the first median model training parameter.

[0116] Step S304: The model training parameters that are not within the parameter range in the model training parameters of the client are taken as local discrete model training parameters, and if the number of local discrete model training parameters is greater than the preset number of discrete parameters, the client is marked as the first abnormal client.

[0117] Step S305: Divide the model training parameters of each client into multiple model training parameter groups according to the time point at which each model training parameter is collected.

[0118] Step S306: For each time point, the second median model training parameters in the model training parameter group corresponding to the time point are calculated using the extreme value range algorithm, and the first numerical sorting sequence of each model training parameter at each time point is determined based on each second median model training parameter.

[0119] Step S307: Based on the first numerical sorting sequence, the extreme value model training parameters in each model training parameter group corresponding to the time point are filtered by a preset sequence filtering method, and the clients corresponding to each extreme value model training parameter are marked as second abnormal clients.

[0120] Step S308: Based on all model training parameters obtained from all clients, the third median model training parameter is calculated in each model training parameter using the discrete range algorithm. All model training parameters are then sorted in order of distance from the third median model training parameter from farthest to nearest, resulting in a second sorted sequence of all model training parameters.

[0121] Step S309: Based on the number of all model training parameters and the second sorting sequence, filter out the discrete clients corresponding to a preset number of global discrete model training parameters that belong to a preset discrete range among the model training parameters, and mark them as third abnormal clients.

[0122] Step S310: Based on each first abnormal client, each second abnormal client, and each third abnormal client, determine the abnormal client among the clients.

[0123] Step S311: Based on the training data of each model for each abnormal client, perform Gaussian distribution processing on the training data of each model to obtain the Gaussian distribution sequence of the training data of each model.

[0124] Step S312: Based on the Gaussian distribution sequence, select model training data with a preset range of endpoints from the training data of each model as endpoint model training data.

[0125] Step S313: Use the training data of each endpoint model as the target anomaly data.

[0126] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0127] Based on the same inventive concept, this application also provides an anomalous data identification device for implementing the aforementioned method for identifying anomalous data. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more embodiments of the anomalous data identification device provided below can be found in the limitations of the anomalous data identification method described above, and will not be repeated here.

[0128] In one embodiment, such as Figure 4 As shown, an apparatus for identifying abnormal data is provided, comprising: an acquisition module 410, a marking module 420, and an identification module 440, wherein:

[0129] The acquisition module 410 is used to acquire the training parameters of each model from multiple clients;

[0130] The tagging module 420 is used to identify local discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and global discrete model training parameters in each model training parameter of each client, and to determine abnormal clients based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the global discrete model training parameters.

[0131] The identification module 430 is used to identify the end-value model training data in the model training data of each abnormal client based on the Gaussian distribution information of the training parameters of each model, and to use each end-value model training data as the target abnormal data.

[0132] Optionally, the acquisition module 410 is specifically used for:

[0133] The model is sent to each of the aforementioned clients, and the model is trained through each of the aforementioned clients;

[0134] When a preset time point is reached, all model training parameters for each client that trained the model during the historical training time period corresponding to that time point are collected to obtain the model training parameters for each client.

[0135] Optionally, the marking module 420 is specifically used for:

[0136] For each client, the discrete parameter algorithm is used to calculate the local discrete model training parameters among all model training parameters of the client, and if the number of discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as the first abnormal client.

[0137] For each time point when the model training parameters of each client are acquired, the extreme value model training parameters that belong to the preset extreme value range in the model training parameters of each client at the time point are calculated by the extreme value range algorithm, and the client corresponding to the extreme value model training parameters is marked as the second abnormal client.

[0138] Using the discrete range algorithm, calculate the global discrete model training parameters that belong to the preset discrete range among the model training parameters of all clients, and mark the clients corresponding to the global discrete model training parameters as third abnormal clients.

[0139] A client that is simultaneously marked as the first abnormal client, the second abnormal client, and the third abnormal client will be considered an abnormal client.

[0140] Optionally, the marking module 420 is specifically used for:

[0141] The first median model training parameter is calculated by using a discrete parameter algorithm, which corresponds to the median of all model training parameters of the client. Based on the first median model training parameter, the parameter range of the model training parameters of the client is determined.

[0142] Model training parameters that do not fall within the specified parameter range from the client's model training parameters are taken as local discrete model training parameters. If the number of local discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as a first abnormal client.

[0143] Optionally, the marking module 420 is specifically used for:

[0144] The model training parameters of each client are divided into multiple model training parameter groups according to the time point at which each model training parameter is collected; the model training parameter group includes the model training parameters of each client for the time period corresponding to the time point.

[0145] For each time point, the second median model training parameter in the model training parameter group corresponding to the time point is calculated by the extreme value range algorithm, and the first numerical sorting sequence of each model training parameter at the time point is determined based on each second median model training parameter.

[0146] Based on the first numerical sorting sequence, extreme value model training parameters in each model training parameter group corresponding to the time point are filtered by a preset sequence filtering method, and the clients corresponding to each extreme value model training parameter are marked as second abnormal clients.

[0147] Optionally, the marking module 420 is specifically used for:

[0148] Based on all model training parameters acquired from all clients, the third median model training parameter is calculated in each model training parameter using a discrete range algorithm. Then, all model training parameters are sorted from farthest to closest to the third median model training parameter to obtain a second sorting sequence of all model training parameters.

[0149] Based on the number of all model training parameters and the second sorting sequence, discrete clients corresponding to a preset number of global discrete model training parameters that belong to a preset discrete range are selected from the model training parameters and marked as third abnormal clients.

[0150] Optionally, the identification module 430 is specifically used for:

[0151] Based on the training data of each model for each abnormal client, Gaussian distribution processing is performed on the training data of each model to obtain the Gaussian distribution sequence of the training data of each model.

[0152] Based on the Gaussian distribution sequence, model training data within a preset range of endpoints are selected from each of the model training data as endpoint model training data.

[0153] Optionally, the device further includes:

[0154] The sample acquisition module is used to acquire the sample feature vector of the sample model training data, and to filter the abnormal clients to be tested from the clients other than the abnormal client; the abnormal client to be tested is a client that is simultaneously marked as any two of the first abnormal client, the second abnormal client, and the third abnormal client.

[0155] The extraction module is used to extract the model feature vectors of each model training data of the abnormal client under test through a feature vector extraction network.

[0156] The discrimination module is used to input the sample feature vector and each of the model feature vectors into the discrimination network for comparison processing, and obtain the difference value between each of the model feature vectors and the sample feature vectors;

[0157] The filtering module is used to identify model training data with feature vectors corresponding to difference values ​​greater than the difference threshold as target outlier data.

[0158] Each module in the aforementioned abnormal data identification device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0159] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 5As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements a method for identifying abnormal data. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0160] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0161] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described in any one of the first aspects.

[0162] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0163] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described in any one of the first aspects.

[0164] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0165] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0166] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0167] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for identifying anomalous data, characterized in that, The method includes: Obtain training parameters for each model from multiple clients in the financial industry; the model training parameters are used to characterize the current training status and training progress information of the model, including at least one of the following: model training progress ratio, model fitness ratio, and parameter acquisition capability ratio. For each client, the discrete parameter algorithm is used to calculate the local discrete model training parameters among all model training parameters of the client, and if the number of discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as the first abnormal client. For each time point when the model training parameters of each client are acquired, the extreme value model training parameters that belong to the preset extreme value range in the model training parameters of each client at the time point are calculated by the extreme value range algorithm, and the client corresponding to the extreme value model training parameters is marked as the second abnormal client. Using the discrete range algorithm, calculate the global discrete model training parameters that belong to the preset discrete range among the model training parameters of all clients, and mark the clients corresponding to the global discrete model training parameters as third abnormal clients. A client that is simultaneously marked as the first abnormal client, the second abnormal client, and the third abnormal client will be considered an abnormal client. Based on the training data of each model for each abnormal client, Gaussian distribution processing is performed on the training data of each model to obtain the Gaussian distribution sequence of the training data of each model. Based on the Gaussian distribution sequence, model training data within a preset range of endpoints are selected from each of the model training data as endpoint model training data.

2. The method according to claim 1, characterized in that, The process of obtaining the training parameters of each model from multiple clients includes: The model is sent to each of the aforementioned clients, and the model is trained through each of the aforementioned clients; When a preset time point is reached, all model training parameters for each client that trained the model during the historical training time period corresponding to that time point are collected to obtain the model training parameters for each client.

3. The method according to claim 1, characterized in that, The step of calculating the local discrete model training parameters among all model training parameters of the client using a discrete parameter algorithm, and marking the client as a first abnormal client when the number of discrete model training parameters is greater than a preset number of discrete parameters, includes: The first median model training parameter is calculated by using a discrete parameter algorithm, which corresponds to the median of all model training parameters of the client. Based on the first median model training parameter, the parameter range of the model training parameters of the client is determined. Model training parameters that do not fall within the specified parameter range from the client's model training parameters are taken as local discrete model training parameters. If the number of local discrete model training parameters is greater than a preset number of discrete parameters, the client is marked as a first abnormal client.

4. The method according to claim 1, characterized in that, For each time point when the model training parameters of each client are acquired, the extreme value model training parameters belonging to a preset extreme value range are calculated using an extreme value range algorithm. The client corresponding to the extreme value model training parameters is then marked as a second abnormal client. This includes: The model training parameters of each client are divided into multiple model training parameter groups according to the time point at which each model training parameter is collected; the model training parameter group includes the model training parameters of each client for the time period corresponding to the time point. For each time point, the second median model training parameter in the model training parameter group corresponding to the time point is calculated by the extreme value range algorithm, and the first numerical sorting sequence of each model training parameter at the time point is determined based on each second median model training parameter. Based on the first numerical sorting sequence, extreme value model training parameters in each model training parameter group corresponding to the time point are filtered by a preset sequence filtering method, and the clients corresponding to each extreme value model training parameter are marked as second abnormal clients.

5. The method according to claim 1, characterized in that, The step of calculating the global discrete model training parameters belonging to a preset discrete range among the model training parameters of all clients using a discrete range algorithm, and marking the clients corresponding to the global discrete model training parameters as third abnormal clients, includes: Based on all model training parameters acquired from all clients, the third median model training parameter is calculated in each model training parameter using a discrete range algorithm. Then, all model training parameters are sorted from farthest to closest to the third median model training parameter to obtain a second sorting sequence of all model training parameters. Based on the number of all model training parameters and the second sorting sequence, discrete clients corresponding to a preset number of global discrete model training parameters that belong to a preset discrete range are selected from the model training parameters and marked as third abnormal clients.

6. The method according to claim 1, characterized in that, After identifying local discrete model training parameters, extreme value model training parameters that satisfy a preset extreme value range, and global discrete model training parameters among the model training parameters of each client, and determining abnormal clients based on the clients corresponding to the local discrete model training parameters, the clients corresponding to the extreme value model training parameters, and the clients corresponding to the global discrete model training parameters, the process further includes: Obtain the sample feature vector of the sample model training data, and filter out the abnormal clients to be tested from all the clients except the abnormal client; the abnormal client to be tested is the client that is simultaneously marked as any two of the abnormal clients among the first abnormal client, the second abnormal client, and the third abnormal client. For each abnormal client to be tested, a feature vector extraction network is used to extract the model feature vectors of each model training data of the abnormal client to be tested. The sample feature vector and each of the model feature vectors are input into the discriminant network for comparison processing to obtain the difference value between each of the model feature vectors and the sample feature vectors; Model training data whose feature vectors correspond to differences exceeding the difference threshold are used as target anomaly data.

7. A device for identifying abnormal data, characterized in that, The device includes: The acquisition module is used to acquire the training parameters of each model from multiple clients in the financial industry; the model training parameters are used to characterize the current training status and training progress information of the model, including at least one of the following: model training progress ratio, model fitness ratio, and parameter acquisition capability ratio. The marking module is used to, for each client, calculate the local discrete model training parameters among all model training parameters of the client using a discrete parameter algorithm, and mark the client as a first abnormal client if the number of discrete model training parameters is greater than a preset number of discrete parameters; for each time point when the model training parameters of each client are acquired, calculate the extreme model training parameters that belong to a preset extreme value range among the model training parameters of each client at the time point using an extreme value range algorithm, and mark the client corresponding to the extreme value model training parameters as a second abnormal client; calculate the global discrete model training parameters that belong to a preset discrete value range among all model training parameters of all clients using a discrete range algorithm, and mark the client corresponding to the global discrete model training parameters as a third abnormal client; and treat a client that is simultaneously marked as a first abnormal client, a second abnormal client, and a third abnormal client as an abnormal client. The identification module is used to perform Gaussian distribution processing on the training data of each model based on the training data of each abnormal client, to obtain a Gaussian distribution sequence of the training data of each model; based on the Gaussian distribution sequence, the training data of each model training data with a preset range of endpoints are selected as endpoint model training data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images