A model training method, device, storage medium and electronic device

Abstract

The specification discloses a model training method, device, storage medium and electronic equipment. Local service data is obtained to train a preset anomaly detection model. Model data of the anomaly detection model obtained by performing a model training task based on the service data is sent to a server, so that the server aggregates the model data sent by each client to obtain a global anomaly detection model, and the global anomaly detection model is distributed to each client. Each service data is input into the global anomaly detection model to obtain data features of each service data, and a feature center of the data features of each service data is determined. The feature center is sent to the server, so that the server aggregates the received feature centers to obtain a global feature center, and the global feature center is sent to each client. The global anomaly detection model is trained according to the deviation between the data features of each service data and the global feature center.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and in particular to a method, apparatus, storage medium, and electronic device for model training. Background Technology

[0002] With the rapid development of internet technology, the protection of privacy data and business risk control have received increasing attention. To better protect user information security, it is usually necessary to perform anomaly detection on user business data. In practical applications, this is typically done by anomaly detection models deployed locally to detect anomalies in business data and implement timely risk control.

[0003] In federated learning, clients can use local data to train locally deployed anomaly detection models, and then upload the model data of the locally trained anomaly detection models to the server. The server can aggregate the model data of multiple anomaly detection models received to obtain a global anomaly detection model, and then distribute the global anomaly detection model to each client.

[0004] However, because different clients use different sample data to train anomaly detection models, the global anomaly detection model, which aggregates model data from multiple anomaly detection models, may fail to accurately detect abnormal data after local deployment. For example, a locally trained model may accurately identify abnormal data in local business data, but the aggregated global anomaly detection model may fail to accurately identify local business data, or even misidentify abnormal data as normal data.

[0005] Therefore, how to enable the aggregated global anomaly detection model to accurately detect local anomalies is an urgent problem to be solved. Summary of the Invention

[0006] This specification provides a method, apparatus, storage medium, and electronic device for model training to address the problem that existing aggregated global anomaly detection models cannot accurately detect local anomalies.

[0007] The following technical solution is adopted in this specification:

[0008] This specification provides a method for model training, which is applied to a local client and includes:

[0009] Obtain local business data, including normal business data and abnormal business data;

[0010] The model data of the anomaly detection model obtained by performing model training tasks based on the business data is sent to the server, so that the server can aggregate the model data sent by each client to obtain a global anomaly detection model, and then distribute the global anomaly detection model to each client.

[0011] The business data is input into the global anomaly detection model issued by the server to obtain the data features of each business data and determine the feature center of the data features of each business data.

[0012] The feature center is sent to the server, so that after receiving the feature center sent by each client, the server aggregates the received feature centers to obtain a global feature center, and sends the global feature center to each client.

[0013] The global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center.

[0014] Optionally, the various business data are input into the global anomaly detection model issued by the server to obtain the data features of each business data, and the feature centers of the data features of each business data are determined, specifically including:

[0015] The normal business data from each of the business data is input into the global anomaly detection model to obtain the data features of each of the normal business data;

[0016] Determine the feature centers of the data characteristics of each normal business data.

[0017] Optionally, the global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center, specifically including:

[0018] The global anomaly detection model is trained with the optimization objectives of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center.

[0019] Optionally, the various business data are input into the global anomaly detection model issued by the server to obtain the data features of each business data, and the feature centers of the data features of each business data are determined, specifically including:

[0020] Abnormal business data from each of the business data is input into the global anomaly detection model to obtain the data features of each abnormal business data.

[0021] Determine the feature center of the data characteristics of each abnormal business data.

[0022] Optionally, the global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center, specifically including:

[0023] The global anomaly detection model is trained with the optimization objective of maximizing the deviation between the data features of each normal business data and the global feature center, and minimizing the deviation between the data features of each abnormal business data and the global feature center.

[0024] Optionally, before training the global anomaly detection model based on the deviation between the data features of each business data and the global feature center, the method further includes:

[0025] The various business data are input into the global anomaly detection model to obtain the output results; wherein, the output results represent the probability that each business data belongs to the normal business data or the abnormal business data;

[0026] The global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center, specifically including:

[0027] The global anomaly detection model is trained based on the deviation between the data features of each business data and the global feature center, and with the optimization objective of minimizing the difference between the output results corresponding to each business data and the preset labels corresponding to each business data.

[0028] This specification also provides a method for model training, which is applied to a server and includes:

[0029] Receive model data of the trained anomaly detection model sent by each client. For each client, the trained anomaly detection model is obtained by training the anomaly detection model deployed on the client's local business data. The business data includes normal business data and abnormal business data.

[0030] The received model data from each trained anomaly detection model are aggregated to obtain a global anomaly detection model.

[0031] The global anomaly detection model is distributed to each client so that each client can input its local business data into the global anomaly detection model to obtain the data features of each business data and determine the feature center of the data features of each business data.

[0032] Receive the feature centers sent by each client, aggregate the received feature centers to obtain the global feature center;

[0033] The global feature center is sent to each client so that each client can train its local global anomaly detection model based on the deviation between the data features of its local business data and the global feature center.

[0034] This specification provides an apparatus for model training, the apparatus comprising:

[0035] The acquisition module is used to acquire various business data locally, wherein the various business data include: normal business data and abnormal business data;

[0036] The first sending module is used to send the model data of the anomaly detection model obtained by performing model training tasks based on the business data to the server, so that the server can aggregate the model data sent by each client to obtain a global anomaly detection model, and then send the global anomaly detection model to each client.

[0037] The first input module is used to input the various business data into the global anomaly detection model issued by the server, obtain the data features of each business data, and determine the feature center of the data features of each business data.

[0038] The second sending module is used to send the feature center to the server, so that after receiving the feature center sent by each client, the server aggregates the received feature centers to obtain a global feature center, and sends the global feature center to each client.

[0039] The training module is used to train the global anomaly detection model based on the deviation between the data features of each business data and the global feature center.

[0040] Optionally, the first input module is specifically used to input normal business data from each business data into the global anomaly detection model to obtain the data features of each normal business data; and to determine the feature center of the data features of each normal business data.

[0041] Optionally, the training module is specifically used to train the global anomaly detection model with the optimization objectives of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center.

[0042] Optionally, the first input module is further configured to input abnormal business data from each business data into the global anomaly detection model to obtain the data features of each abnormal business data; and determine the feature center of the data features of each abnormal business data.

[0043] Optionally, the training module is further configured to train the global anomaly detection model with the optimization objectives of maximizing the deviation between the data features of each normal business data and the global feature center, and minimizing the deviation between the data features of each abnormal business data and the global feature center.

[0044] Optionally, the device further includes:

[0045] The second input module is used to input the various business data into the global anomaly detection model before training the global anomaly detection model based on the deviation between the data characteristics of each business data and the global feature center, and to obtain an output result; wherein, the output result is the probability that each business data belongs to the normal business data or the abnormal business data;

[0046] The training module is used to train the global anomaly detection model based on the deviation between the data features of each business data and the global feature center, and with the optimization objective of minimizing the difference between the output results corresponding to each business data and the preset labels corresponding to each business data.

[0047] This specification also provides a model training apparatus, the apparatus comprising:

[0048] The first receiving module is used to receive the model data of the trained anomaly detection model sent by each client. For each client, the trained anomaly detection model is obtained by training the anomaly detection model deployed on the client's local business data. The business data includes normal business data and abnormal business data.

[0049] The aggregation module is used to aggregate the model data of each trained anomaly detection model to obtain a global anomaly detection model.

[0050] The distribution module is used to distribute the global anomaly detection model to each client, so that each client can input its local business data into the global anomaly detection model, obtain the data features of each business data, and determine the feature center of the data features of each business data.

[0051] The second receiving module is used to receive the feature centers sent by each client, aggregate the received feature centers, and obtain the global feature center.

[0052] The sending module is used to send the global feature center to each client, so that each client can train its local global anomaly detection model based on the deviation between the data features of its local business data and the global feature center.

[0053] This specification provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the above-described method for training the model.

[0054] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method for training the aforementioned model.

[0055] The above-mentioned technical solutions adopted in this specification can achieve the following beneficial effects:

[0056] In the model training method provided in this specification, the client obtains local business data to train a preset anomaly detection model. The trained anomaly detection model data is then sent to the server. Upon receiving model data from each client, the server aggregates the model data to obtain a global anomaly detection model, which is then distributed to each client. Each business data point is input into the global anomaly detection model to obtain the data features of each business data point, and the feature centers of these features are determined. These feature centers are then sent to the server, which aggregates the received feature centers to obtain a global feature center, which is then sent to each client. Based on the deviation between the data features of each business data point and the global feature center, the global anomaly detection model is trained.

[0057] As can be seen from the above method, the client can obtain the data characteristics of each business data and determine the feature centers of each business data's data characteristics based on the global anomaly detection model. After the server aggregates the feature centers sent by each client to obtain the global feature center, the local client can use its local business data to train the global anomaly detection model based on the global feature center and the global anomaly detection model. In other words, the client does not directly use the global anomaly detection model aggregated by the server for anomaly detection. After receiving the global anomaly detection model and the global feature center, it also needs to train the global anomaly detection model based on the deviation between the data characteristics of each business data and the global feature center. This helps the trained global anomaly detection model to more accurately identify abnormal business data. Attached Figure Description

[0058] The accompanying drawings, which are included to provide a further understanding of this specification and form part of this specification, illustrate exemplary embodiments and their descriptions, serving to explain this specification and do not constitute an undue limitation thereof.

[0059] In the picture:

[0060] Figure 1 This is a flowchart illustrating a model training method provided in this specification;

[0061] Figure 2 This is a flowchart illustrating another model training method provided in this specification.

[0062] Figure 3 This is a schematic diagram of an apparatus for a model training method provided in this specification;

[0063] Figure 4 A schematic diagram of an apparatus for another model training method provided in this specification;

[0064] Figure 5 The one provided in this specification corresponds to Figure 1 , Figure 2 A schematic diagram of an electronic device. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this specification clearer, the technical solutions of this specification will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of them. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this specification.

[0066] The technical solutions provided in the various embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0067] Figure 1 This is a flowchart illustrating a model training method provided in this specification, including the following steps:

[0068] S100: Obtain local business data, wherein the business data includes normal business data and abnormal business data.

[0069] S102: Send the model data of the anomaly detection model obtained by performing model training tasks based on the business data to the server, so that the server can aggregate the model data sent by each client to obtain a global anomaly detection model, and then distribute the global anomaly detection model to each client.

[0070] In federated learning, clients send model data (such as gradient data) from locally trained anomaly detection models to the server. The server can then aggregate the model data from multiple anomaly detection models to obtain a global anomaly detection model, which is then distributed to each client. However, because different clients use different sample data to train their anomaly detection models, the global anomaly detection model, after being deployed locally, may not accurately identify local anomalies. Therefore, this specification provides a model training method to address the problem that the aggregated global anomaly detection model cannot accurately identify anomalies.

[0071] The execution subject of this manual is the terminal device, such as a mobile device like a mobile phone or tablet, or a client installed on the terminal device. For ease of description, the following uses the client as the execution subject to explain the model training method.

[0072] The client can obtain local business data and train a pre-defined anomaly detection model based on this data. This business data includes both normal and abnormal business data.

[0073] Specifically, the client can obtain local business data and preset labels corresponding to each business data, input each business data into a preset anomaly detection model, and obtain the output result, which is the probability that the business data belongs to normal business data or abnormal data.

[0074] Furthermore, the client can determine the loss between the output result corresponding to each business data and the preset labels corresponding to each business data. The client can use various loss functions to perform model training; for example, it can use cross-entropy loss to perform the training task. The specific cross-entropy loss function is as follows:

[0075] L1 = ―[y log(y 1 )]+(1-y 1 log(1-y) 1 )

[0076] Where y represents the output result corresponding to each business data, y 1 These are the pre-defined labels corresponding to each piece of business data. The client can train the pre-defined anomaly detection model with the optimization goal of minimizing the difference between the output results corresponding to each piece of business data and the pre-defined labels corresponding to each piece of business data.

[0077] It should be noted that the cross-entropy function described above is only used as an example to illustrate the training process of the local anomaly detection model. Of course, other loss functions can also be used in practical applications. This manual does not limit the specific loss function used.

[0078] In addition, the client can input various business data into a preset anomaly detection model to obtain the data features of each business data, determine the feature center of each business data's data features, and then perform preset training on the preset anomaly detection model based on the deviation between the data features of each business data and the feature center of each business data's data features.

[0079] For example, if the number of normal business data in the client's local business data is greater than the number of abnormal business data, the client can train a preset anomaly detection model with the optimization goal of minimizing the deviation between the data features of each normal business data and the feature center of each business data, and maximizing the deviation between the data features of each abnormal business data and the feature center of each business data.

[0080] In addition, the client can input various business data into a preset anomaly detection model to obtain the data features of each business data, determine the feature center of each business data's data features, and then train the preset anomaly detection model based on the deviation between the data features of each business data and the feature center of each business data's data features.

[0081] For example, if the number of normal business data in the client's local business data is greater than the number of abnormal business data, the client can optimize the preset anomaly detection model by minimizing the deviation between the data features of each normal business data and the feature center of each business data, and maximizing the deviation between the data features of each abnormal business data and the feature center of each business data.

[0082] If the number of normal business data in the client's local business data is less than the number of abnormal business data, the client can optimize the preset anomaly detection model by maximizing the deviation between the data features of each normal business data and the feature center of each business data, and minimizing the deviation between the data features of each abnormal business data and the feature center of each business data.

[0083] It is worth noting that the anomaly detection model is trained on the client using local business data, and can accurately identify normal and abnormal business data in the local business data.

[0084] The client can send the model data of the trained anomaly detection model to the server. After receiving the model data sent by each client, the server will aggregate the received model data to obtain a global anomaly detection model, and then distribute the global anomaly detection model to each client.

[0085] S104: Input the business data into the global anomaly detection model issued by the server to obtain the data features of each business data and determine the feature center of the data features of each business data.

[0086] After receiving the global anomaly detection model from the server, the client can obtain the data characteristics of each business data based on the local business data and the global anomaly detection model, and determine the feature center of the data characteristics of each business data.

[0087] In this specification, the feature centers of the data characteristics of each business data can be divided into three cases.

[0088] Under normal circumstances, the amount of normal business data is greater than the amount of abnormal business data. The client can determine the feature center of each business data point's data characteristics based on the overall data characteristics of all business data. Specifically, the client can input all business data into a global anomaly detection model to obtain the data characteristics of all business data, and then determine the feature center of each business data point's data characteristics. For example, based on the data characteristics of all business data, the client can use the average value of the data characteristics of all business data as the feature center of each business data point's data characteristics.

[0089] Since there is a larger amount of normal business data, the feature center of the data characteristics of each business data determined by the client will be closer to the data characteristics of each normal business data, and relatively far away from the data characteristics of each abnormal business data.

[0090] Therefore, after determining the feature center of each business data in this way, the client sends the feature center to the server so that when the server aggregates and determines the global feature center, the resulting global feature center is closer to the feature center of each normal business data, and relatively far away from the feature center of each abnormal business data.

[0091] Of course, the feature center of each business data feature can also be simply the feature center of the data features of each normal business data feature. The client can input the normal business data from each business data into the global anomaly detection model to obtain the data features of each normal business data. Furthermore, the client can determine the feature center of the data features of each normal business data. For example, based on the data features of each normal business data, the client can use the average value of the data features of each normal business data as the feature center of the data features of each normal business data.

[0092] In addition, the feature center of each business data feature can also be the feature center of the data features of each abnormal business data. The client can input abnormal business data from each business data into the global anomaly detection model to obtain the data features of each abnormal business data. Furthermore, the client can determine the feature center of the data features of each abnormal business data. For example, based on the data features of each different business data, the client can use the average value of the data features of each different business data as the feature center of the data features of each abnormal business data.

[0093] It is worth noting that after the feature center of each business data is determined in this way, the client sends the feature center to the server so that when the server aggregates and determines the global feature center, the resulting global feature center is closer to the feature center of each abnormal business data, and relatively farther away from the feature center of each normal business data.

[0094] S106: Send the feature center to the server, so that after receiving the feature center sent by each client, the server aggregates the received feature centers to obtain a global feature center, and sends the global feature center to each client.

[0095] S108: The global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center.

[0096] The client can send the feature center, which identifies the data characteristics of each business data, to the server. After receiving the feature center sent by each client, the server will aggregate the received feature centers to obtain a global feature center, and then send the global feature center to each client.

[0097] The global feature center refers to the center of each business data feature in the feature space where the data features of each business data reside.

[0098] After receiving the global feature center, the client can continue to train the global anomaly detection model based on the global anomaly detection model and the global feature center, according to the deviation between the data characteristics of each business data and the global feature center.

[0099] Specifically, if the feature centers of the data features of each business data sent by the client to the server are determined based on the feature centers of the data features of all business data, then the global feature center after aggregation by the server is determined based on the feature centers of the data features of all business data of each client.

[0100] Therefore, after receiving the global feature center, the client can determine the deviation between the data characteristics of each normal business data and the global feature center, as well as the deviation between the data characteristics of each abnormal business data and the global feature center, and determine the loss value based on the determined deviation, as shown in the following formula:

[0101] L2 = max(D(F) pos ,C)―D(F neg ,C)+margin,0)

[0102] Where C is the global feature center, D is the distance function, and F is the distance function. pos These are the data characteristics of each normal business data, F neg These are the data characteristics of each abnormal business data. Margin is used to control the distance between the data characteristics of each normal business data and the data characteristics of each abnormal business data and the global feature center.

[0103] As can be seen from the above formula, when the data characteristics of each normal business data are close to the global feature center, and the data characteristics of each abnormal business data are far from the global feature center, the distance between the data characteristics of each normal business data and the global feature center is smaller than the distance between the data characteristics of each abnormal business data and the global feature center. In other words, D(F) pos ,C)―D(F neg When the value of C is less than 0, L2 = 0. Conversely, when the distance between the data features of each normal business data and the global feature center is greater than the distance between the data features of each heterogeneous business data and the global feature center, the value of L2 is positive.

[0104] Therefore, if the global feature center is determined by the feature center of the data features of all business data sent by each client aggregated by the server, the client can train the global anomaly detection model with the optimization objective of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center (i.e., minimizing the above loss value as the optimization objective).

[0105] Under normal circumstances, the number of normal business data is greater than the number of abnormal business data. This training method can make the data features of each normal business data determined by the trained global anomaly detection model closer to the global feature center, while making the data features of each abnormal business data further away from the global feature center.

[0106] Of course, the global feature center can also be determined by the server aggregating the feature centers of the data features of each normal business data sent by each client. After receiving the global feature center, the client can similarly determine the deviation between the data features of each normal business data and the global feature center, as well as the deviation between the data features of each abnormal business data and the global feature center.

[0107] The client can train the global anomaly detection model with the optimization objective of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center, as shown in the formula L2 above. Through this training method, the client can bring the data features of each normal business data closer to the global feature center, while simultaneously pushing the data features of each abnormal business data further away from the global feature center.

[0108] Similarly, if the global feature center is determined by the server aggregating the feature centers of the data features of each abnormal business data sent by each client, then the client can determine the deviation between the data features of each normal business data and the feature centers of the data features of each business data, as well as the deviation between the data features of each abnormal business data and the feature centers of the data features of each business data. Based on the determined deviations, the loss value is determined, as shown in the following formula:

[0109] L3 = max(D(F) neg ,C)-D(F pos ,C)+margin,0)

[0110] As can be seen from the above formula, when the data characteristics of each abnormal business data are close to the global feature center, and the data characteristics of each normal business data are far from the global feature center, L3 = 0. Conversely, when the data characteristics of each abnormal business data are far from the global feature center, and the data characteristics of each normal business data are close to the global feature center, the value of L3 is positive.

[0111] Therefore, the client can train the global anomaly detection model with the optimization goal of maximizing the deviation between the data features of each normal business data and the global feature center, and minimizing the deviation between the data features of each abnormal business data and the global feature center. Through this training method, the client can make the data features of each abnormal business data closer to the global feature center, while making the data features of each normal business data further away from the global feature center.

[0112] Of course, in addition to using the above-mentioned method to train the global anomaly detection model, the client can also add the loss function used during the pre-training of the anomaly detection model to the training process.

[0113] In other words, the client can input various business data into the global anomaly detection model and obtain the output results. The output results represent the probability that each business data point belongs to normal or abnormal business data. The client can optimize by minimizing the difference between the output results corresponding to each business data point and the preset labels corresponding to each business data point, while simultaneously training the global anomaly detection model based on the deviation between the data characteristics of each business data point and the global feature center.

[0114] Following the example above of using the cross-entropy function to train the local anomaly detection model, when training the global anomaly detection model, if the global feature center is determined by the feature center of the data features of each normal business data sent by each client aggregated by the server, the client can determine the loss function in the global anomaly detection model training process as: L4 = L1 + L2 = -[y log(y 1 )]+(1-y 1 log(1-y) 1 )+max(D(F pos ,C)―D(F neg The global anomaly detection model is trained by setting C)+margin,0) and minimizing L4 as the optimization objective.

[0115] If the global feature center is determined by the feature center of the data features of each abnormal business data sent by each client aggregated by the server, the client can determine the loss function in the training process of the global anomaly detection model as: L5 = L1 + L3 = -[y log(y 1 )]+(1-y 1 log(1-y) 1 )+max(D(F neg ,C)―D(F pos The global anomaly detection model is trained by setting C)+margin,0) and minimizing L5 as the optimization objective.

[0116] It is worth noting that after the client completes the training of the global anomaly detection model and obtains the trained global anomaly detection model, it can upload the model data of the trained global anomaly detection model back to the server. This allows the server to aggregate the trained global anomaly detection models sent by each client and then distribute the aggregated global anomaly detection model to each client.

[0117] At this point, the client receives the global anomaly detection model after the second aggregation from the server. It can then retrain the global anomaly detection model using the same method described above, inputting each business data point into the second aggregation to obtain the data features of each business data point and determine the feature centers of those features. The client can then send the feature centers of each business data point to the server, allowing the server to aggregate the feature centers again, re-obtain the global feature centers, and distribute them to each client.

[0118] Based on the global feature centers and global anomaly detection model obtained from the second aggregation, the client can continue training the global anomaly detection model locally using various business data, following the same training method described above. After training, the client can upload the model to the server for aggregation, resulting in the global anomaly detection model obtained from the server's third aggregation. Through this iterative process, the client can continuously train the global anomaly detection model issued by the server until the training of the global anomaly detection model is complete.

[0119] As can be seen from the above method, the client can obtain the data features of each business data and determine the feature center of each business data based on the global anomaly detection model. After the server aggregates the feature centers sent by each client to obtain the global feature center, the local client can use local business data to train the global anomaly detection model based on the global feature center and the global anomaly detection model.

[0120] In this way, the client can accurately determine the feature centers used to distinguish between normal and abnormal business data. Then, by controlling the distance between the data features of normal and abnormal business data and the global features, the global anomaly detection model is trained, which helps the global anomaly detection model to more accurately identify abnormal business data. Furthermore, this specification only classifies each business data into normal and abnormal categories. For abnormal business data, as long as the global anomaly detection model detects that the distance between the abnormal business data and the global feature centers is large, it can quickly identify it, further improving the efficiency of anomaly detection.

[0121] This manual also provides a method for model training, such as Figure 2 As shown.

[0122] Figure 2 This is a flowchart illustrating another model training method described in this specification, which includes the following steps:

[0123] S200: Receive the model data of the trained anomaly detection model sent by each client. For each client, the trained anomaly detection model is obtained by training the anomaly detection model deployed locally on the client using various business data locally on the client. The various business data include: normal business data and abnormal business data.

[0124] After each client sends its trained anomaly detection model data to the server, the server can receive the model data from each client in response to their sending operation. Specifically, for each client, the trained anomaly detection model is obtained by training the model deployed locally on that client using local business data, including both normal and abnormal business data.

[0125] S202: Aggregate the model data of each trained anomaly detection model to obtain a global anomaly detection model.

[0126] After receiving the model data of the anomaly detection model sent by each client, the server can aggregate the model data of each trained anomaly detection model to obtain a global anomaly detection model.

[0127] Specifically, the server can use the model aggregation method used in federated learning to aggregate the model data of each trained anomaly detection model. This specification does not restrict the method of model data aggregation.

[0128] S204: The global anomaly detection model is distributed to each client so that each client inputs its local business data into the global anomaly detection model to obtain the data features of each business data and determine the feature center of the data features of each business data.

[0129] S206: Receive the feature centers sent by each client, aggregate the received feature centers to obtain the global feature center.

[0130] After each client sends the feature center of the data characteristics of each business data to the server, in response to each client's sending operation, the server can receive the feature center sent by each client, aggregate the received feature centers, and obtain the global feature center.

[0131] Specifically, the server can use the average value of the received feature centers as the global feature center. Of course, the server can also use other aggregation methods to determine the global feature center. This specification does not restrict the method of feature center aggregation.

[0132] S208: Send the global feature center to each client so that each client can train its local global anomaly detection model based on the deviation between the data features of its local business data and the global feature center.

[0133] As can be seen from the above method, the server aggregates the model data of each trained anomaly detection model sent by each client, as well as the feature centers of the data features of each business data, to determine the global anomaly detection model and the global feature center, and then distributes the global anomaly detection model and the global feature center to each client.

[0134] After the client trains the global anomaly detection model based on the global anomaly detection model and global feature center issued by the server, using local business data, the server can continuously aggregate and issue the trained global anomaly detection model uploaded by each client and the feature center of each business data feature redefined by each client. This allows the client to iteratively train the global anomaly detection model re-aggregated by the server until the training of the aggregated global anomaly detection model is completed.

[0135] The above describes one or more embodiments of the model training method provided in this specification. Based on the same idea, this specification also provides corresponding model training devices, such as... Figure 3 As shown.

[0136] Figure 3 This is a schematic diagram of a model training apparatus provided in this specification, the apparatus comprising:

[0137] The acquisition module 300 is used to acquire various local business data, wherein the various business data include: normal business data and abnormal business data;

[0138] The first sending module 302 is used to send the model data of the anomaly detection model obtained by performing model training tasks based on the business data to the server, so that the server aggregates the model data sent by each client to obtain a global anomaly detection model, and sends the global anomaly detection model to each client.

[0139] The first input module 304 is used to input the various business data into the global anomaly detection model issued by the server, obtain the data features of each business data, and determine the feature center of the data features of each business data.

[0140] The second sending module 306 is used to send the feature center to the server, so that after receiving the feature center sent by each client, the server aggregates the received feature centers to obtain a global feature center, and sends the global feature center to each client.

[0141] The training module 308 is used to train the global anomaly detection model based on the deviation between the data features of each business data and the global feature center.

[0142] Optionally, the first input module 304 is specifically used to input normal business data from each business data into the global anomaly detection model to obtain the data features of each normal business data; and to determine the feature center of the data features of each normal business data.

[0143] Optionally, the training module 308 is specifically used to train the global anomaly detection model with the optimization objectives of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center.

[0144] Optionally, the first input module 304 is further configured to input abnormal business data from each business data into the global anomaly detection model to obtain the data features of each abnormal business data; and determine the feature center of the data features of each abnormal business data.

[0145] Optionally, the training module 308 is further configured to train the global anomaly detection model with the optimization objectives of maximizing the deviation between the data features of each normal business data and the global feature center, and minimizing the deviation between the data features of each abnormal business data and the global feature center.

[0146] Optionally, the device further includes:

[0147] The second input module 310 is used to input the various business data into the global anomaly detection model before training the global anomaly detection model based on the deviation between the data features of each business data and the global feature center, and to obtain an output result; wherein, the output result is the probability that each business data belongs to the normal business data or the abnormal business data;

[0148] The training module 308 is used to train the global anomaly detection model based on the deviation between the data features of each business data and the global feature center, and with the optimization objective of minimizing the difference between the output results corresponding to each business data and the preset labels corresponding to each business data.

[0149] This manual also provides another apparatus for model training, such as Figure 4 As shown.

[0150] Figure 4 This is a schematic diagram of another model training apparatus provided in this specification, the apparatus comprising:

[0151] The first receiving module 400 is used to receive model data of the trained anomaly detection model sent by each client. For each client, the trained anomaly detection model is obtained by training the anomaly detection model deployed on the client's local business data. The business data includes normal business data and abnormal business data.

[0152] The aggregation module 402 is used to aggregate the model data of each trained anomaly detection model received to obtain a global anomaly detection model.

[0153] The distribution module 404 is used to distribute the global anomaly detection model to each client, so that each client can input its local business data into the global anomaly detection model, obtain the data features of each business data, and determine the feature center of the data features of each business data.

[0154] The second receiving module 406 is used to receive the feature centers sent by each client, aggregate the received feature centers, and obtain the global feature center.

[0155] The sending module 408 is used to send the global feature center to each client, so that each client can train its local global anomaly detection model based on the deviation between the data features of its local business data and the global feature center.

[0156] This specification also provides a computer-readable storage medium storing a computer program that can be used to execute the above-described... Figure 1 This provides a method for model training.

[0157] This instruction manual also provides Figure 5 The one shown corresponds to Figure 1 , Figure 2 A schematic diagram of the structure of an electronic device. (e.g.) Figure 5At the hardware level, this electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then executes it to achieve the above. Figure 1 , Figure 2 The method for training the model. Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. In other words, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0158] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0159] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0160] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0161] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware.

[0162] Those skilled in the art will understand that embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0163] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0164] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0165] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0166] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0167] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0168] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0169] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0170] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this specification may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0171] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0172] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0173] The above are merely embodiments of this specification and are not intended to limit this specification. Various modifications and variations can be made to this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims of this specification.

Claims

1. A method for training a model, said method being applied to a local client, comprising: Obtain local business data, including normal business data and abnormal business data; The model data of the anomaly detection model obtained by performing model training tasks based on the business data is sent to the server, so that the server can aggregate the model data sent by each client to obtain a global anomaly detection model, and then distribute the global anomaly detection model to each client. The business data is input into the global anomaly detection model issued by the server to obtain the data features of each business data and determine the feature center of the data features of each business data. The feature center is sent to the server, so that after receiving the feature center sent by each client, the server aggregates the received feature centers to obtain a global feature center, and sends the global feature center to each client. The global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center.

2. The method as described in claim 1, wherein the business data is input into the global anomaly detection model issued by the server to obtain the data features of each business data, and the feature center of the data features of each business data is determined, specifically including: The normal business data from each of the business data is input into the global anomaly detection model to obtain the data features of each of the normal business data; Determine the feature centers of the data characteristics of each normal business data.

3. The method as described in claim 2, wherein the global anomaly detection model is trained based on the deviation between the data features of each business data and the global feature center, specifically including: The global anomaly detection model is trained with the optimization objectives of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center.

4. The method as described in claim 1, wherein the business data is input into the global anomaly detection model issued by the server to obtain the data features of each business data, and the feature center of the data features of each business data is determined, specifically including: Abnormal business data from each of the business data is input into the global anomaly detection model to obtain the data features of each abnormal business data. Determine the feature center of the data characteristics of each abnormal business data.

5. The method as described in claim 4, wherein the global anomaly detection model is trained based on the deviation between the data features of each business data and the global feature center, specifically including: The global anomaly detection model is trained with the optimization objective of maximizing the deviation between the data features of each normal business data and the global feature center, and minimizing the deviation between the data features of each abnormal business data and the global feature center.

6. The method as described in claim 3 or 5, further comprising, before training the global anomaly detection model based on the deviation between the data features of each business data and the global feature center: The various business data are input into the global anomaly detection model to obtain the output results; wherein, the output results represent the probability that each business data belongs to the normal business data or the abnormal business data; The global anomaly detection model is trained based on the deviation between the data characteristics of each business data and the global feature center, specifically including: The global anomaly detection model is trained based on the deviation between the data features of each business data and the global feature center, and with the optimization objective of minimizing the difference between the output results corresponding to each business data and the preset labels corresponding to each business data.

7. A method for training a model, said method being applied to a server, comprising: Receive model data of the trained anomaly detection model sent by each client. For each client, the trained anomaly detection model is obtained by training the anomaly detection model deployed on the client's local business data. The business data includes normal business data and abnormal business data. The received model data from each trained anomaly detection model are aggregated to obtain a global anomaly detection model. The global anomaly detection model is distributed to each client so that each client can input its local business data into the global anomaly detection model to obtain the data features of each business data and determine the feature center of the data features of each business data. Receive the feature centers sent by each client, aggregate the received feature centers to obtain the global feature center; The global feature center is sent to each client so that each client can train its local global anomaly detection model based on the deviation between the data features of its local business data and the global feature center.

8. An apparatus for model training, the apparatus comprising: The acquisition module is used to acquire various business data locally, wherein the various business data include: normal business data and abnormal business data; The first sending module is used to send the model data of the anomaly detection model obtained by performing model training tasks based on the business data to the server, so that the server can aggregate the model data sent by each client to obtain a global anomaly detection model, and then send the global anomaly detection model to each client. The first input module is used to input the various business data into the global anomaly detection model issued by the server, obtain the data features of each business data, and determine the feature center of the data features of each business data. The second sending module is used to send the feature center to the server, so that after receiving the feature center sent by each client, the server aggregates the received feature centers to obtain a global feature center, and sends the global feature center to each client. The training module is used to train the global anomaly detection model based on the deviation between the data features of each business data and the global feature center.

9. The apparatus of claim 8, wherein the first input module is specifically configured to input normal business data from each of the business data into the global anomaly detection model to obtain data features of each of the normal business data; and determine the feature center of the data features of each of the normal business data.

10. The apparatus of claim 9, wherein the training module is specifically configured to train the global anomaly detection model with the optimization objectives of minimizing the deviation between the data features of each normal business data and the global feature center, and maximizing the deviation between the data features of each abnormal business data and the global feature center.

11. The apparatus of claim 8, wherein the first input module is further configured to input abnormal business data from each of the business data into the global anomaly detection model to obtain data features of each of the abnormal business data; and determine the feature center of the data features of each of the abnormal business data.

12. The apparatus of claim 9, wherein the training module is further configured to train the global anomaly detection model with the optimization objectives of maximizing the deviation between the data features of each normal business data and the global feature center, and minimizing the deviation between the data features of each abnormal business data and the global feature center.

13. The apparatus of claim 10 or 12, further comprising: The second input module is used to input the various business data into the global anomaly detection model before training the global anomaly detection model based on the deviation between the data characteristics of each business data and the global feature center, and to obtain an output result; wherein, the output result is the probability that each business data belongs to the normal business data or the abnormal business data; The training module is used to train the global anomaly detection model based on the deviation between the data features of each business data and the global feature center, and with the optimization objective of minimizing the difference between the output results corresponding to each business data and the preset labels corresponding to each business data.

14. An apparatus for model training, the apparatus comprising: The first receiving module is used to receive the model data of the trained anomaly detection model sent by each client. For each client, the trained anomaly detection model is obtained by training the anomaly detection model deployed on the client's local business data. The business data includes normal business data and abnormal business data. The aggregation module is used to aggregate the model data of each trained anomaly detection model to obtain a global anomaly detection model. The distribution module is used to distribute the global anomaly detection model to each client, so that each client can input its local business data into the global anomaly detection model, obtain the data features of each business data, and determine the feature center of the data features of each business data. The second receiving module is used to receive the feature centers sent by each client, aggregate the received feature centers, and obtain the global feature center. The sending module is used to send the global feature center to each client, so that each client can train its local global anomaly detection model based on the deviation between the data features of its local business data and the global feature center.

15. A computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described in any one of claims 1 to 7.

16. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in any one of claims 1 to 7.

Images