A data detection method and apparatus, an electronic device, and a medium

Abstract

This application discloses a data detection method, apparatus, electronic device, and medium. The method includes: encoding the data to be detected using a Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected; sampling the Gaussian distribution data to obtain sampled data, and decoding the sampled data using a Transformer decoder to obtain reconstructed data; and determining the detection result of the data to be detected based on the difference between the data to be detected and the reconstructed data. This technical solution, by applying a Transformer encoder, can extract feature information from the data to be detected, obtain the dependencies in the data to be detected at different times, and complete the data reconstruction by applying a Transformer decoder. By comparing the reconstructed data with the data to be detected before reconstruction, abnormal behaviors with long-term trend characteristics can be detected, solving the current problem of inaccurate anomaly detection of data to be detected with long-term trends and improving detection accuracy.

Description

Technical Field

[0001] This application relates to the field of data detection technology, and in particular to a data detection method, apparatus, electronic device and medium. Background Technology

[0002] To ensure the normal operation of a network, Key Performance Indicators (KPIs) are commonly used to monitor its working status. Data that does not conform to the predefined normal pattern of the KPIs is defined as anomalous data. Due to the diversity of anomalous data, the bias between positive and negative samples, and the high cost of labeling anomalous data, machine learning methods are often used to detect KPI anomalies in the data.

[0003] Current data KPI anomaly detection methods are unable to detect whether data with long-term development trend characteristics are abnormal, or cannot accurately and sensitively detect whether data with long-term development trend characteristics are abnormal. They also cannot infer the data factors generated by most of the original data, and therefore cannot detect data anomalies widely, resulting in low detection accuracy. Summary of the Invention

[0004] This application provides a data detection method, apparatus, electronic device, and medium to solve the problem that existing anomaly detection methods cannot accurately detect anomalies in data with long-term trends.

[0005] According to one aspect of this application, a data detection method is provided, the method comprising:

[0006] A Transformer encoder is used to encode the data to be detected, thereby determining the Gaussian distribution data corresponding to the data to be detected.

[0007] The Gaussian distributed data is sampled to obtain sampled data, and the sampled data is decoded using a Transformer decoder to obtain reconstructed data;

[0008] The detection result of the data to be detected is determined based on the difference between the data to be detected and the reconstructed data.

[0009] According to another aspect of this application, a data detection apparatus is provided, comprising:

[0010] The Gaussian distribution data determination module is used to encode the data to be detected using a Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected.

[0011] The reconstructed data acquisition module is used to sample the Gaussian distributed data to obtain sampled data, and to decode the sampled data using a Transformer decoder to obtain reconstructed data;

[0012] The detection result determination module is used to determine the detection result of the data to be detected based on the difference data between the data to be detected and the reconstructed data.

[0013] According to another aspect of this application, a data detection electronic device is provided, the electronic device comprising:

[0014] At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to perform the data detection method according to any embodiment of the present invention.

[0017] According to another aspect of this application, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the data detection method described in any embodiment of this application.

[0018] The technical solution of this application embodiment encodes the data to be detected using a Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected. Sampling techniques are then used to sample the Gaussian distribution data, generating sampled data. A Transformer decoder then generates reconstructed data from the sampled data. The detection result of the data to be detected is determined by calculating the difference between the data to be detected and the reconstructed data. This technical solution, by applying a Transformer encoder, can compress the data to be detected, extract feature information from the data to be detected, obtain the dependencies in the data to be detected at different times, and use a Transformer decoder to restore the data to its original dimensions, completing the data reconstruction. Comparison with the data to be detected before reconstruction allows for the detection of abnormal behaviors with long-term trends. This solves the problem that existing anomaly detection methods cannot accurately detect anomalies in data to be detected with long-term trends, thus improving the accuracy of anomaly detection.

[0019] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this application, nor is it intended to limit the scope of this application. Other features of this application will become readily apparent from the following description. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart of a data detection method provided according to Embodiment 1 of this application;

[0022] Figure 2 This is a schematic diagram of a data anomaly detection based on the Transformer model according to Embodiment 1 of this application;

[0023] Figure 3 This is a flowchart of a data detection method according to Embodiment 2 of this application;

[0024] Figure 4 This is a schematic diagram of a data detection device according to Embodiment 3 of this application;

[0025] Figure 5 This is a schematic diagram of the structure of an electronic device that implements a data detection method according to an embodiment of this application. Detailed Implementation

[0026] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0027] It should be noted that the terms "first," "second," "target," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0028] Example 1

[0029] Figure 1 This is a flowchart of a data detection method provided in Embodiment 1 of this application. This embodiment is applicable to situations where stable detection of data to be detected is required. The method can be executed by a data detection device, which can be implemented in hardware and / or software. This data detection device can be configured in an electronic device with data processing capabilities. Figure 1 As shown, the method includes:

[0030] S110. Use a Transformer encoder to encode the data to be detected, and determine the Gaussian distribution data corresponding to the data to be detected.

[0031] The Transformer encoder, composed of multiple nonlinear blocks consisting of self-attention layers and feedforward neural networks, is used to transform input data into a feature extraction process. The data to be detected can be data that needs to be checked for anomalies, such as key indicators like server CPU usage, memory usage, system load, and temperature. Gaussian distributed data can be a probability density function used to measure error, defined as a random variable X following a mathematical expectation μ and a standard deviation σ. 2 The normal distribution is denoted as X ~ N(μ, σ). 2 Its probability density function is generally expressed as:

[0032] Specifically, the data to be tested is D = {d1, d2, ... d...} N After initial data processing, the Transformer encoder learns features from the data to be detected to form new feature vectors. A feedforward neural network then transforms these feature vectors into Gaussian distributed data. The feature vectors can be matrices describing the main transformation directions of the linear transformation corresponding to the matrix.

[0033] Optionally, the data to be detected is input into the multi-head self-attention model of the Transformer encoder to obtain the multi-scale temporal features of the data to be detected. The multi-scale temporal features of the data to be detected are then input into the feedforward neural network of the Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected.

[0034] Among them, multi-head self-attention models can establish different projection information in multiple different projection spaces. The multi-head self-attention model maps the input matrix in different directions, obtains multiple output matrices, and then concatenates them together. Multi-scale temporal features can be generated by dividing the data to be detected into a predetermined number of groups and inputting them into the multi-head self-attention model, generating feature vectors at different scales at each time step. A feedforward neural network can be a unidirectional, multi-layered neural network structure where neurons in each layer are only connected to neurons in the previous layer, and subsequent neurons do not feed back information to the preceding neurons.

[0035] Specifically, the data to be detected, divided into groups according to time, is input into a multi-head self-attention model to determine the multi-scale temporal features in the data. The specific generation method is shown in the following formula:

[0036]

[0037] head m =Attention(Q) m ,K m V m )

[0038] MutilHead(Q,K,V)=Concat(head1,head2,…,head M )

[0039] In the above formula, Q, K, and V are three matrices obtained by spatial transformation of the data to be detected, and the spatial transformation matrix w is the result of the spatial transformation of the data to be detected. Q Transformation yields Q; the data to be detected is transformed by the spatial transformation matrix w. K Transformation yields K, and the data to be detected is transformed by the spatial transformation matrix w. V Transform to obtain V and K T Let d be the transpose of matrix K. k The dimension of the K matrix is ​​represented by Softmax(), which represents the normalization exponential function. Q m ,K m V m Q is obtained by performing m spatial transformations on the data to be detected, and is the result of the m-th spatial transformation. m ,K m V m The head was obtained after normalized weighted calculation. m . Each head m The data are concatenated to obtain multi-scale temporal features. Among these features, the spatial transformation matrix w... Q w K and w VThe parameters that need to be trained and optimized are obtained by training and optimizing the multi-head self-attention model, resulting in the final spatial transformation matrix w. Q w K and w V .

[0040] Specifically, the multi-scale temporal features generated above are input into a feedforward neural network to obtain Gaussian distributed data.

[0041] S120. The Gaussian distributed data is sampled to obtain sampled data, and the sampled data is decoded using a Transformer decoder to obtain reconstructed data.

[0042] The Transformer decoder can be a method that uses a decoding algorithm to transform feature information vectors into a representation of the original data to be detected. The reconstructed data can be generated based on the data to be detected through steps such as data standardization, sampling from a normal distribution, and nonlinear transformation by a feedforward neural network.

[0043] Optionally, initial sampled data is obtained by sampling from a standard normal distribution. Based on the mean and variance of the Gaussian distribution data and the initial sampled data, the final sampled data is determined. This sampled data is then input into a multi-head self-attention model in the Transformer decoder to obtain multi-scale temporal features of the sampled data. These multi-scale temporal features are then input into a feedforward neural network of the Transformer decoder to obtain reconstructed data.

[0044] Specifically, since the Gaussian distribution of multi-scale temporal features is not differentiable, it is difficult to apply a feedforward neural network model. Therefore, a reparameterization technique is needed to randomly sample data z from a standard normal distribution z ~ N(0, I). Here, I is the identity matrix. After grouping the data to be detected, each group is processed by a Transformer encoder to obtain Gaussian distributed data. Multiple groups of data correspond to multiple Gaussian distributed data, requiring random sampling from multiple standard normal distributions to obtain data z. The matrix form of the variances of multiple standard normal distributions is I. Therefore, the randomly sampled standard normal distribution is represented by z ~ N(0, I).

[0045] The following formula can be used to obtain a continuous data distribution that approximates a Gaussian distribution and to sample the data:

[0046] e=μ+σ*z

[0047] In the above formula, μ represents the mean of the Gaussian distribution data, σ represents the variance of the Gaussian distribution data, and z is the random sampled data obtained from the standard normal distribution data. Inputting the mean, standard deviation of the Gaussian distribution and the sampled data z into the above formula is equivalent to sampling data obtained from continuous e~N(μ,σ) distribution data.

[0048] Specifically, the Transformer encoder presents the data to be detected in the form of a Gaussian-normal distribution, thereby completing the data sampling. Since the detection of the data to be detected needs to be transformed into multi-scale temporal feature vectors and then into reconstructed data, the sampled data needs to be reverse-transformed into the form of multi-scale temporal features according to the multi-head self-attention model in the Transformer decoder.

[0049] Specifically, the reconstructed data should be consistent with the data to be detected in terms of data dimension, data format and data type. The multi-scale temporal features of the sampled data obtained above are input into the feedforward neural network of the Transformer decoder to obtain the reconstructed data.

[0050] For example, Gaussian distributed data is sampled using the reparameter resampling technique to obtain sampled data. This sampled data is then reverse-transformed into data consistent with the original data type. The reconstructed data is then compared with the original data to be detected to detect anomalies in the original data. To achieve this reverse data transformation, the sampled data needs to be input into the decoder in the Transformer—a multi-head self-attention model—to be transformed into multi-scale temporal features. These multi-scale temporal features are then input into a feedforward neural network to form the reconstructed data.

[0051] S130. Determine the detection result of the data to be detected based on the difference between the data to be detected and the reconstructed data.

[0052] Here, difference data can represent the gap between the original data and the actual data, and is commonly used in data detection. Specifically, the difference data between the original data and the reconstructed data is calculated based on the standard deviation between each data vector in the original data and the reconstructed data. The calculation formula is as follows:

[0053]

[0054] in the formula Let be the true value of the i-th dimension of the data to be detected at time t. Let Si be the i-th dimension of the reconstructed data at time t, and m represent the dimension of the data vector to be detected. The larger the value of Score(t), that is, the larger the difference score, the greater the difference between the data to be detected and the reconstructed data.

[0055] For example, the standard deviation of the data vectors in the data to be detected and the reconstructed data is calculated according to the above formula to obtain the difference data score. The detection result of the data to be detected is then calculated by comparing the magnitude of the abnormal score with the pre-set abnormal score threshold.

[0056] The technical solution of this application embodiment encodes the data to be detected using a Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected. Sampling techniques are then used to sample the Gaussian distribution data, generating sampled data. A Transformer decoder then generates reconstructed data from the sampled data. The difference between the data to be detected and the reconstructed data is calculated to determine the detection result of the data to be detected. This technical solution, by applying a Transformer encoder, can compress the data to be detected, extract multi-scale temporal features from the data to be detected, obtain the dependencies in the data to be detected at different times, and use a Transformer decoder to restore the data to its original dimensions, completing the data reconstruction. Comparison with the data to be detected before reconstruction allows for the detection of abnormal behaviors with long-term trends. This solves the problem that existing detection methods cannot accurately detect anomalies in data to be detected with long-term trends, thus improving the detection effect of abnormal data.

[0057] Figure 2 This diagram illustrates a structural schematic of a VAE-Transformer model-based anomaly detection method provided in the application embodiment. The KPI sequence represents a matrix of key performance indicators at different times, i.e., the data to be detected. {W1, W2, ..., Wk} represents the time-based grouping of the data to be detected. The grouped data to be detected is input to the multi-head self-attention model of the Transformer encoder to generate multi-scale temporal features. These multi-scale temporal features are then input to a feedforward neural network to generate Gaussian distributed data of multi-scale temporal features. After sampling the Gaussian distributed data, it is decoded using a Transformer decoder to obtain the decoded temporal features. The decoded temporal features are then used as input to the feedforward neural network of the Transformer decoder to obtain the reconstructed KPI sequence. Based on the difference data between the original KPI sequence and the reconstructed KPI sequence, identify the outlier sequences in the original KPI sequence.

[0058] Example 2

[0059] Figure 3 This is a flowchart of a data detection method provided in Embodiment 2 of this application. This embodiment is an optimization based on the above embodiment. Figure 3 As shown, the method in this embodiment specifically includes the following steps:

[0060] S210. Standardize the data to be detected.

[0061] Standardization can be achieved by transforming the original data according to a certain ratio through a certain mathematical transformation, so that it falls into a small specific interval, such as the interval between 0 and 1 or between -1 and 1. This eliminates the differences in the characteristics, dimensions, orders of magnitude, etc. of different variables, and transforms them into a dimensionless relative value, which is a standardized value.

[0062] Before inputting the data to be detected into the Transformer encoder, the data can be standardized to obtain standardized data. The specific method of standardization is not limited. One possible approach is to standardize the data using the Z-Score standardization method. This method can convert data of different magnitudes into a unified Z-Score for comparison, improving data comparability. The specific implementation method of Z-Score standardization is as follows:

[0063]

[0064]

[0065]

[0066] In the above formula, μ all σ represents the mean of the data to be tested. all d represents the standard deviation of all the data to be tested. t Let D represent the m-dimensional data to be detected at time t, denoted as D = {d1, d2, ..., dt}. N}. x t This is the standardized data after the data to be tested has been processed, represented as X={x1,x2,…x N}

[0067] S220. For the data to be tested at different times, group the data to be tested according to the time of the data to be tested, so as to test each group of data to be tested.

[0068] Specifically, for example, the grouping method is to divide the data to be tested into k arrays according to their chronological order, with each group containing p standardized data points. The specific values ​​of k and p can be adaptively selected according to the actual situation.

[0069] S230. Use a Transformer encoder to encode the data to be detected, and determine the Gaussian distribution data corresponding to the data to be detected.

[0070] Specifically, the data to be detected is standardized and grouped, and then input into the multi-head self-attention model of the Transformer encoder to generate multi-scale temporal feature vectors. The multi-scale temporal feature vectors are then input into the feedforward neural network of the Transformer encoder to generate Gaussian distributed data.

[0071] S240. The Gaussian distributed data is sampled to obtain sampled data, and the sampled data is decoded using a Transformer decoder to obtain reconstructed data.

[0072] Specifically, Gaussian distributed data is transformed into continuous e~N(μ,σ) distributed data for sampling using reparameterization techniques, forming sampled data. The multi-head self-attention model of the Transformer decoder is used to reverse the transformation of the sampled data into multi-scale temporal features. Finally, the feedforward neural network of the Transformer decoder restores the multi-scale temporal features into reconstructed data.

[0073] S250. Determine the difference data based on the difference between the data to be detected and the reconstructed data.

[0074] Specifically, the standard deviation between each data vector in the data to be detected and the reconstructed data is used as the difference data between the data to be detected and the reconstructed data.

[0075] S260. If the difference data is greater than a preset difference threshold, then the data to be detected is determined to be abnormal data.

[0076] Specifically, the difference data obtained in the above steps is compared with a preset difference threshold. When the difference data is greater than the preset threshold, the data to be detected is determined to be abnormal data.

[0077] As an optional but not limited implementation method, the method for determining the preset difference threshold may include, but is not limited to, the following implementation steps A1-A4:

[0078] Step A1: Determine the sample difference data between the sample data and the reconstructed data of the sample data.

[0079] The sample data can be data that distinguishes it from the data to be detected. The reconstructed data of the sample data can be reconstructed data generated by the Transformer encoder and decoder. The reconstructed data of the sample data is generated in the same way as the reconstructed data of the data to be detected. The standard deviation of the sample data and the reconstructed data is calculated to generate outlier data.

[0080] Step A2: For each initial difference threshold in at least one initial difference threshold, determine the sample detection result of the sample data based on the comparison result between the sample difference data and the initial difference threshold.

[0081] Specifically, at least one initial difference threshold needs to be initialized. The sample difference data is compared with the initial difference threshold. When the difference data is greater than the initial difference threshold, the sample data is determined to be abnormal data.

[0082] Step A3: Based on the sample detection results and the actual results of the sample data, determine the precision and recall corresponding to each initial difference threshold.

[0083] Specifically, the sample data's detection results can be either positive or negative, and the true results of the sample data can also be either positive or negative. When both the true result and the detection result of the sample data are positive, the sample data is a true positive (TP). When both the true result and the detection result are negative, the sample data is a false negative (FN). When both the true result and the detection result are positive, the sample data is a false positive (FP). When both the true result and the detection result are negative, the sample data is a true negative (TN). Count the number of true positives (S1), false negatives (S2), and false positives (S3) in all sample data. Substitute these values ​​into the following formulas to calculate precision and recall.

[0084]

[0085]

[0086] Where P represents the precision of the initial difference threshold and R represents the recall of the initial difference threshold.

[0087] Step A4: Based on the precision and recall, determine the F-measure value corresponding to each initial difference threshold, and determine the preset difference threshold from at least one initial difference threshold based on the F-measure value.

[0088] Specifically, sequentially determine the recall and precision corresponding to all initial difference thresholds, and calculate the F-measure value according to the following formula.

[0089]

[0090] Select the initial difference threshold corresponding to the maximum value of the F metric from each initial difference threshold as the preset difference threshold.

[0091] In this embodiment, the data to be detected, processed by Z-Score normalization, is encoded into Gaussian distributed data by a Transformer encoder. Sampling techniques are used to sample the Gaussian distributed data, which is then decoded by a Transformer decoder to generate reconstructed data. The difference between the data to be detected and the reconstructed data is calculated using a standard deviation method. A preset difference threshold is determined using a predefined difference threshold method. The difference threshold and the difference data are compared to obtain the detection result for the data to be detected. Data normalization techniques make the model more universally applicable when judging the detection results of the data to be detected. The method for determining the preset difference threshold makes the detection results of the anomaly detection model more convincing, thereby optimizing the detection effect of the anomaly detection model.

[0092] Example 3

[0093] Figure 4 This is a schematic diagram of a data detection device provided in Embodiment 4 of this application. This device can execute the data detection method provided in any embodiment of this application. Figure 4 As shown, the device includes:

[0094] The Gaussian distribution data determination module 310 is used to encode the data to be detected using a Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected.

[0095] The reconstructed data acquisition module 320 is used to sample the Gaussian distributed data to obtain sampled data, and to decode the sampled data using a Transformer decoder to obtain reconstructed data.

[0096] The detection result determination module 330 is used to determine the detection result of the data to be detected based on the difference data between the data to be detected and the reconstructed data.

[0097] In this embodiment of the application, the Gaussian distribution data determination module 310 includes:

[0098] The multi-scale temporal feature acquisition unit is used to input the data to be detected into the multi-head self-attention model of the Transformer encoder to obtain the multi-scale temporal features of the data to be detected.

[0099] The Gaussian distribution data generation unit is used to input the multi-scale temporal features of the data to be detected into the feedforward neural network of the Transformer encoder to determine the Gaussian distribution data corresponding to the data to be detected.

[0100] In this embodiment of the application, the reconstructed data acquisition module 320 includes:

[0101] The initial sampling data acquisition unit is used to sample the standard normal distribution to obtain initial sampling data.

[0102] The sampling data determination unit is used to determine the sampling data based on the mean and variance of the Gaussian distribution data and the initial sampling data.

[0103] The feature acquisition unit is used to input the sampled data into the multi-head self-attention model in the Transformer decoder to obtain the multi-scale temporal features of the sampled data.

[0104] The reconstructed data determination unit is used to input the multi-scale temporal features of the sampled data into the feedforward neural network of the Transformer encoder to obtain reconstructed data.

[0105] In this embodiment of the application, the device further includes:

[0106] The data processing module is used to standardize the data to be detected;

[0107] The data grouping module is used to group the data to be detected at different times according to the time of the data, so as to detect each group of data.

[0108] A difference data determination module is used to determine the difference data based on the difference between the data to be detected and the reconstructed data;

[0109] An abnormal data determination module is used to determine that the data to be detected is abnormal data if the difference data is greater than a preset difference threshold.

[0110] In this embodiment of the application, the abnormal data determination module further includes:

[0111] A difference data determination unit is used to determine sample difference data between sample data and reconstructed data of the sample data;

[0112] A sample detection unit is used to determine the sample detection result of the sample data based on the comparison result between the sample difference data and the initial difference threshold for each of at least one initial difference threshold.

[0113] The difference threshold determination unit is used to determine the precision and recall corresponding to each initial difference threshold based on the sample detection results and the actual results of the sample data.

[0114] The preset difference threshold determination unit is used to determine the F-measure value corresponding to each initial difference threshold based on the precision and recall, and to determine the preset difference threshold from at least one initial difference threshold based on the F-measure value.

[0115] The data detection device provided in this application embodiment can execute a data detection method provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects of executing the method.

[0116] Example 4

[0117] Figure 5 A schematic diagram of an electronic device 10, which can be used to implement embodiments of this application, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0118] like Figure 5 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0119] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0120] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as data inspection methods.

[0121] In some embodiments, the data detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the data detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the data detection method by any other suitable means (e.g., by means of firmware).

[0122] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0123] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0124] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0125] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0126] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0127] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0128] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0129] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A data detection method characterized by, The method is applied to a network performance monitoring scenario, and the method comprises: encoding the to-be-detected data by using a Transformer encoder to determine Gaussian distribution data corresponding to the to-be-detected data; wherein the to-be-detected data is a key performance indicator with a long-term trend for monitoring a network working state, and the key performance indicator comprises any one or a combination of the following: CPU usage, memory usage, system load, and temperature of a server; sampling the Gaussian distribution data to obtain sampling data, and decoding the sampling data by using a Transformer decoder to obtain reconstructed data; determining a detection result of the to-be-detected data according to difference data between the to-be-detected data and the reconstructed data; wherein the encoding of the to-be-detected data by using the Transformer encoder to determine the Gaussian distribution data corresponding to the to-be-detected data comprises: inputting the to-be-detected data into a multi-head self-attention model of the Transformer encoder to obtain multi-scale time sequence features of the to-be-detected data; inputting the multi-scale time sequence features of the to-be-detected data into a feedforward neural network of the Transformer encoder to determine the Gaussian distribution data corresponding to the to-be-detected data; wherein the decoding of the sampling data by using the Transformer decoder to obtain the reconstructed data comprises: inputting the sampling data into a multi-head self-attention model in the Transformer decoder to obtain multi-scale time sequence features of the sampling data; inputting the multi-scale time sequence features of the sampling data into a feedforward neural network of the Transformer decoder to obtain the reconstructed data.

2. The method of claim 1, wherein, The sampling of the Gaussian distribution data to obtain the sampling data comprises: sampling a standard normal distribution to obtain initial sampling data; determining the sampling data according to a mean value, a variance in the Gaussian distribution data, and the initial sampling data.

3. The method according to any one of claims 1-2, characterized in that, Before the encoding of the to-be-detected data by using the Transformer encoder, the method further comprises: performing standardization processing on the to-be-detected data; grouping the to-be-detected data according to time of the to-be-detected data for detecting each group of to-be-detected data.

4. The method of claim 1, wherein, The determination of the detection result of the to-be-detected data according to the difference data between the to-be-detected data and the reconstructed data comprises: determining the difference data according to a difference value between the to-be-detected data and the reconstructed data; if the difference data is greater than a preset difference threshold, determining that the to-be-detected data is abnormal data.

5. The method of claim 4, wherein, The determination of the preset difference threshold comprises: determining sample difference data between sample data and reconstructed data of the sample data; for each initial difference threshold in at least one initial difference threshold, determining a sample detection result of the sample data according to a comparison result of the sample difference data and the initial difference threshold; determining a precision rate and a recall rate corresponding to each initial difference threshold according to the sample detection result of the sample data and a true result of the sample data. According to the precision and recall, an F-measure value corresponding to each initial difference threshold is determined, and a preset difference threshold is determined from at least one initial difference threshold according to the F-measure value.

6. A data detection device characterized by comprising: The device is applied to a network performance monitoring scenario, and the device comprises: The Gaussian distribution data determination module is configured to encode the to-be-detected data by using a Transformer encoder to determine Gaussian distribution data corresponding to the to-be-detected data; wherein the to-be-detected data is a key performance indicator (KPI) with a long-term trend for monitoring a network working state, and the KPI includes any one or a combination of the following: a CPU usage rate, a memory usage rate, a system load, and a temperature of a server. The reconstructed data acquisition module is configured to sample the Gaussian distribution data to obtain sampling data, and decode the sampling data by using a Transformer decoder to obtain reconstructed data. The detection result determination module is configured to determine a detection result of the to-be-detected data according to difference data between the to-be-detected data and the reconstructed data. The Gaussian distribution data determination module comprises: The multi-scale time sequence feature acquisition unit is configured to input the to-be-detected data into a multi-head self-attention model of the Transformer encoder to obtain multi-scale time sequence features of the to-be-detected data. The Gaussian distribution data generation unit is configured to input the multi-scale time sequence features of the to-be-detected data into a feedforward neural network of the Transformer encoder to determine the Gaussian distribution data corresponding to the to-be-detected data. The reconstructed data acquisition module comprises: The feature acquisition unit is configured to input the sampling data into a multi-head self-attention model in the Transformer decoder to obtain multi-scale time sequence features of the sampling data. The reconstructed data determination unit is configured to input the multi-scale time sequence features of the sampling data into a feedforward neural network of the Transformer decoder to obtain the reconstructed data.

7. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected to the at least one processor in communication; wherein The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the data detection method in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to execute the data detection method in any one of claims 1-5 when executed.

Images