Spatiotemporal data anomaly detection method, device, electronic device, and storage medium
By performing spatial augmentation and feature extraction of spatiotemporal data, and prototyping estimation combined with the target spatiotemporal data processing model, the problem of low accuracy in spatiotemporal data detection in the prior art is solved, and more efficient abnormal data recognition is achieved.
Patent Information
- Application Number
- CN202311002318.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2023-08-09
- Publication Date
- 2025-08-22
- Estimated Expiration
- 2043-08-09
AI Technical Summary
The existing spatiotemporal data anomaly detection methods ignore the spatiotemporal correlation of data and the differences in data distribution in different scenarios, resulting in low detection accuracy.
By obtaining multiple spatiotemporal data to be detected, spatial augmentation and feature extraction are performed, prototype estimation is performed using the target spatiotemporal data processing model, abnormal score values are calculated to determine whether the data is abnormal, and the spatiotemporal correlation of spatiotemporal data and features in different scenarios are considered.
It improves the accuracy of spatiotemporal data abnormal detection and can more accurately identify abnormal data.
Smart Images

Figure CN116894224B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of data processing technology, and in particular to a method, device, electronic device and storage medium for detecting anomalies in spatiotemporal data. Background Art
[0002] Spatiotemporal data refers to data that contains temporal, spatial, and entity-specific information. Cities contain a vast amount of spatiotemporal data, such as pedestrian and vehicle traffic. Traffic data can be used to predict or analyze abnormal events, making it crucial for smart city applications such as urban planning and public safety. Existing methods for detecting anomalies in spatiotemporal data generally rely on statistical characteristics of the data, such as variance and maximum value, but these methods ignore the spatiotemporal correlations of the data. Alternatively, methods employ data distribution models, but these ignore the variability in data distribution across different scenarios. Consequently, these methods suffer from low detection accuracy. Summary of the Invention
[0003] In view of this, an object of the present invention is to provide a method, device, electronic device and storage medium for detecting anomalies in spatiotemporal data.
[0004] In order to achieve the above object, the technical solution adopted by the present invention is as follows:
[0005] In a first aspect, the present invention provides a method for detecting anomalies in spatiotemporal data, the method comprising:
[0006] Acquire a plurality of spatiotemporal data to be detected, wherein each of the spatiotemporal data to be detected includes a flow sequence of a plurality of detection areas within a detection period and an adjacency matrix of the plurality of detection areas, wherein the adjacency matrix includes a relationship between each detection area and all adjacent detection areas;
[0007] Performing spatial augmentation on the adjacency matrix in each of the spatiotemporal data to be detected to obtain each spatiotemporal data to be processed; one of the spatiotemporal data to be detected corresponds to one of the spatiotemporal data to be processed, one of the spatiotemporal data to be processed includes multiple flow sequences corresponding to one detection period and a global matrix, the global matrix includes the relationship between each of the detection areas and all other detection areas;
[0008] Using the target spatiotemporal data processing model, feature extraction is performed on each of the spatiotemporal data to be detected and each of the spatiotemporal data to be processed to obtain a spatiotemporal feature to be detected of each of the spatiotemporal data to be detected and a spatiotemporal feature to be processed of each of the spatiotemporal data to be processed; one spatiotemporal feature to be detected corresponds to one spatiotemporal feature to be processed;
[0009] Using the target spatiotemporal data processing model, prototype estimation is performed based on each of the spatiotemporal features to be detected and each of the spatiotemporal features to be processed, to obtain a prototype contribution vector of each of the spatiotemporal features to be detected and a prototype contribution vector of each of the spatiotemporal features to be processed;
[0010] Determine the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be detected and the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be processed according to the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculate the anomaly score value of each of the spatiotemporal data to be detected;
[0011] If the anomaly score of the spatiotemporal data to be detected is greater than a preset threshold, the spatiotemporal data to be detected is determined to be abnormal;
[0012] If the abnormality score value of the spatiotemporal data to be detected is less than or equal to a preset threshold, the spatiotemporal data to be detected is determined to be normal.
[0013] In an optional embodiment, the step of determining the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be detected and the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be processed based on the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculating the anomaly score value of each of the spatiotemporal data to be detected includes:
[0014] According to a first preset formula, based on the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model, determining the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be detected and the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be processed;
[0015] The first preset formula is expressed as follows:
[0016]
[0017]
[0018] in, represents the predicted spatiotemporal feature corresponding to the u-th spatiotemporal feature to be detected; Represents the prototype contribution vector of the u-th spatiotemporal feature to be detected; represents the predicted spatiotemporal feature corresponding to the u-th spatiotemporal feature to be processed; represents the prototype contribution vector of the u-th spatiotemporal feature to be processed; P m represents the target prototype matrix;
[0019] Calculate, according to a second preset formula, an anomaly score value of each of the spatiotemporal data to be detected based on each of the spatiotemporal features to be detected and its corresponding predicted spatiotemporal features and each of the spatiotemporal features to be processed and its corresponding predicted spatiotemporal features;
[0020] The second preset formula is expressed as follows:
[0021]
[0022] Among them, r u Represents the abnormal score value of the u-th spatiotemporal data to be detected; represents the u-th spatiotemporal feature to be detected; Represents the u-th spatiotemporal feature to be processed.
[0023] In an optional embodiment, the target spatiotemporal data processing model is obtained in the following manner:
[0024] Obtaining traffic sequence samples of a plurality of detection areas within a historical time period and an adjacency matrix of the plurality of detection areas, wherein the adjacency matrix includes a relationship between each of the detection areas and all adjacent detection areas;
[0025] Performing a first time augmentation on each of the traffic sequence samples to obtain a first view including each first traffic sequence sample and the adjacency matrix;
[0026] Performing a second temporal augmentation on each of the traffic sequence samples and performing a spatial augmentation on the adjacency matrix to obtain a second view including each second traffic sequence sample and a global matrix; the global matrix including a relationship between each of the detection areas and all other detection areas;
[0027] Performing spatiotemporal sampling on the first view to obtain a plurality of first spatiotemporal data samples and performing spatiotemporal sampling on the second view to obtain a plurality of second spatiotemporal data samples; one first spatiotemporal data sample corresponds to one second spatiotemporal data sample;
[0028] Performing feature extraction on each of the first spatiotemporal data samples and each of the second spatiotemporal data samples using a spatiotemporal data processing model to obtain a first spatiotemporal feature of each of the first spatiotemporal data samples and a second spatiotemporal feature of each of the second spatiotemporal data samples; one first spatiotemporal feature corresponds to one second spatiotemporal feature;
[0029] Performing prototype estimation based on each of the first spatiotemporal features and each of the second spatiotemporal features using a spatiotemporal data processing model to obtain a first prototype contribution vector for each of the first spatiotemporal features and a second prototype contribution vector for each of the second spatiotemporal features; the first prototype contribution vector represents a linear relationship between the first spatiotemporal feature and a prototype matrix, and the second prototype contribution vector represents a linear relationship between the second spatiotemporal feature and the prototype matrix;
[0030] Based on each of the first spatiotemporal features and its first prototype contribution vector and each of the second spatiotemporal features and its second prototype contribution vector, as well as the preset feature contrast loss function, prototype contribution contrast loss function and cross-prediction loss function, the spatiotemporal data processing model is trained to obtain the target spatiotemporal data processing model and its target prototype matrix.
[0031] In an optional embodiment, the first flow sequence sample includes a plurality of first flow data, and the second flow sequence sample includes a plurality of second flow data;
[0032] The step of performing spatiotemporal sampling on the first view to obtain a plurality of first spatiotemporal data samples and the step of performing spatiotemporal sampling on the second view to obtain a plurality of second spatiotemporal data samples comprises:
[0033] Taking any one of the detection areas as a pending area;
[0034] In the adjacency matrix of the first view, a first matrix corresponding to the undetermined region is obtained, where the first matrix includes a relationship between the undetermined region and its G closest associated detection regions, where G is a positive integer;
[0035] Acquire, in the first view, first traffic sequence samples corresponding to the pending area and the G associated detection areas, respectively, to obtain G+1 first pending traffic sequence samples;
[0036] For each of the first undetermined traffic sequence samples, a window of a preset time length is used to sequentially slide through the first undetermined traffic sequence samples, and all first traffic data within the window is used as a first traffic subsequence to obtain a plurality of first traffic subsequences;
[0037] Combining each of the first traffic subsequences with the first matrix to obtain a plurality of first spatiotemporal data samples corresponding to the undetermined area;
[0038] Traversing each of the detection areas based on the first view to obtain a plurality of first spatiotemporal data samples;
[0039] In the global matrix of the second view, a second matrix corresponding to the undetermined area is obtained, where the second matrix includes a relationship between the undetermined area and its G closest associated detection areas;
[0040] Acquire, in the second view, second traffic sequence samples corresponding to the pending area and the G associated detection areas, respectively, to obtain G+1 second pending traffic sequence samples;
[0041] For each of the second undetermined traffic sequence samples, a window of a preset time length is used to sequentially slide in the second undetermined traffic sequence samples, and all second traffic data within the window is used as a second traffic subsequence to obtain multiple second traffic subsequences;
[0042] Combining each of the second traffic subsequences with the second matrix to obtain a plurality of second spatiotemporal data samples corresponding to the undetermined area;
[0043] Each of the detection areas is traversed based on the second view to obtain a plurality of second spatiotemporal data samples.
[0044] In an optional embodiment, the spatiotemporal data processing model includes a spatiotemporal encoder and a feature mapping head;
[0045] The step of performing feature extraction on each of the first spatiotemporal data samples and each of the second spatiotemporal data samples using the spatiotemporal data processing model to obtain a first spatiotemporal feature of each of the first spatiotemporal data samples and a second spatiotemporal feature of each of the second spatiotemporal data samples includes:
[0046] taking each of the first spatiotemporal data samples and each of the second spatiotemporal data samples as pending spatiotemporal data samples;
[0047] Encoding the to-be-timed spatiotemporal data sample using a spatiotemporal encoder in a spatiotemporal data processing model to obtain encoded to-be-timed spatiotemporal data sample;
[0048] Utilizing the feature mapping head in the spatiotemporal data processing model, the encoded spatiotemporal data samples to be timed are mapped to a preset feature space to obtain the spatiotemporal features of the spatiotemporal data samples to be timed, and the first spatiotemporal features of each of the first spatiotemporal data samples and the second spatiotemporal features of each of the second spatiotemporal data samples are obtained.
[0049] In an optional embodiment, the feature contrast loss function is expressed as follows:
[0050]
[0051] in, represents the feature contrast loss function; N represents the total number of the first spatiotemporal features or the total number of the second spatiotemporal features; h i represents the first spatiotemporal feature of the i-th element, h i+N represents the second spatiotemporal feature corresponding to the i-th first spatiotemporal feature; h j represents the jth first spatiotemporal feature or the second spatiotemporal feature; τ ic represents the first preset coefficient; sim represents the similarity function; exp represents the exponential function;
[0052] The prototype matrix includes M prototype vectors, each of the prototype vectors has a first contribution vector and a second contribution vector, the first contribution vector includes the contribution of the prototype vector to all first spatiotemporal features, and the second contribution vector includes the contribution of the prototype vector to all second spatiotemporal features;
[0053] The prototype contribution comparison loss function is expressed as follows:
[0054]
[0055] in, represents the prototype contribution comparison loss function; M represents the total number of prototype vectors; c k represents the first contribution vector of the k-th prototype vector; c k+M represents the second contribution vector of the k-th prototype vector; c l represents the first contribution vector or the second contribution vector of the lth prototype vector; τ Pc represents the second preset coefficient; sim represents the similarity function; exp represents the exponential function.
[0056] In an optional embodiment, the cross-prediction loss function is expressed as follows:
[0057]
[0058] in, represents the cross-prediction loss function; N represents the total number of the first spatiotemporal features or the total number of the second spatiotemporal features; represents the i-th first spatiotemporal feature, represents the i-th second spatiotemporal feature; represents the i-th first prototype contribution vector; represents the i-th second prototype contribution vector; P represents the prototype matrix.
[0059] In a second aspect, the present invention provides a device for detecting anomalies in spatiotemporal data, the device comprising:
[0060] An acquisition module is configured to acquire a plurality of spatiotemporal data to be detected, wherein the spatiotemporal data to be detected includes a flow sequence of a plurality of detection areas within a detection period and an adjacency matrix of the plurality of detection areas, wherein the adjacency matrix includes a relationship between each detection area and all adjacent detection areas;
[0061] Performing spatial augmentation on the adjacency matrix in each of the spatiotemporal data to be detected to obtain each spatiotemporal data to be processed; one of the spatiotemporal data to be detected corresponds to one of the spatiotemporal data to be processed, one of the spatiotemporal data to be processed includes multiple flow sequences corresponding to one detection period and a global matrix, the global matrix includes the relationship between each of the detection areas and all other detection areas;
[0062] a processing module, configured to perform feature extraction on each of the spatiotemporal data to be detected and each of the spatiotemporal data to be processed using a target spatiotemporal data processing model, to obtain a spatiotemporal feature to be detected for each of the spatiotemporal data to be detected and a spatiotemporal feature to be processed for each of the spatiotemporal data to be processed; one spatiotemporal feature to be detected corresponds to one spatiotemporal feature to be processed;
[0063] Using the target spatiotemporal data processing model, prototype estimation is performed based on each of the spatiotemporal features to be detected and each of the spatiotemporal features to be processed, to obtain a prototype contribution vector of each of the spatiotemporal features to be detected and a prototype contribution vector of each of the spatiotemporal features to be processed;
[0064] A detection module is used to determine the predicted spatiotemporal features corresponding to each spatiotemporal feature to be detected and the predicted spatiotemporal features corresponding to each spatiotemporal feature to be processed based on the prototype contribution vector of each spatiotemporal feature to be detected, the prototype contribution vector of each spatiotemporal feature to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculate the anomaly score value of each spatiotemporal data to be detected;
[0065] If the anomaly score of the spatiotemporal data to be detected is greater than a preset threshold, the spatiotemporal data to be detected is determined to be abnormal;
[0066] If the abnormality score value of the spatiotemporal data to be detected is less than or equal to a preset threshold, the spatiotemporal data to be detected is determined to be normal.
[0067] In a third aspect, the present invention provides an electronic device, comprising a processor and a memory, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in any one of the aforementioned embodiments is implemented.
[0068] In a fourth aspect, the present invention provides a storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in any one of the aforementioned embodiments.
[0069] The spatiotemporal data anomaly detection method, device, electronic device and storage medium provided by the present invention obtain multiple spatiotemporal data to be detected and perform spatial augmentation on them to obtain multiple spatiotemporal data to be processed, then use the target spatiotemporal data processing model to perform feature extraction on each spatiotemporal data to be detected and each spatiotemporal data to be processed, obtain the spatiotemporal features to be detected of each spatiotemporal data to be detected and the spatiotemporal features to be processed of each spatiotemporal data to be processed and perform prototype estimation, obtain the prototype contribution vector of each spatiotemporal feature to be detected and the prototype contribution vector of each spatiotemporal feature to be processed, and then combine the target prototype matrix of the target spatiotemporal data processing model to obtain the predicted spatiotemporal features corresponding to each spatiotemporal feature to be detected and each spatiotemporal feature to be processed, and calculate the anomaly score value of each spatiotemporal data to be detected to determine whether the spatiotemporal data to be detected is abnormal. By comparing the spatiotemporal features output by the model with the spatiotemporal features predicted based on the prototype matrix to detect whether the spatiotemporal data is abnormal, not only the spatiotemporal correlation of the spatiotemporal data is taken into account, but also the spatiotemporal features of the spatiotemporal data in different scenarios can be reflected through the prototype matrix, thereby improving the accuracy of spatiotemporal data anomaly detection.
[0070] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, preferred embodiments are given below and described in detail with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0071] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.
[0072] Figure 1 A block diagram of an electronic device provided by an embodiment of the present invention is shown;
[0073] Figure 2 A schematic diagram of a process for detecting anomalies in spatiotemporal data according to an embodiment of the present invention is shown;
[0074] Figure 3 Another schematic diagram of a process for detecting anomalies in spatiotemporal data according to an embodiment of the present invention is shown;
[0075] Figure 4 An example diagram of a method for detecting anomalies in spatiotemporal data provided by an embodiment of the present invention is shown;
[0076] Figure 5 Another example diagram of the spatiotemporal data anomaly detection method provided by an embodiment of the present invention is shown;
[0077] Figure 6 A functional module diagram of a spatiotemporal data anomaly detection device provided by an embodiment of the present invention is shown.
[0078] Icon: 100 - electronic device; 110 - bus; 120 - processor; 130 - memory; 170 - communication module; 300 - spatiotemporal data anomaly detection device; 310 - acquisition module; 330 - processing module; 350 - detection module; 370 - training module. DETAILED DESCRIPTION
[0079] The following will be combined with the accompanying drawings to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.
[0080] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but is merely intended to represent selected embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative work are within the scope of protection of the present invention.
[0081] It should be noted that relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus comprising the element.
[0082] Please refer to Figure 1 , is a block diagram of an electronic device 100 provided by an embodiment of the present invention. The electronic device 100 includes a bus 110, a processor 120, a memory 130, and a communication module 170.
[0083] The bus 110 may be a circuit that connects the above elements to each other and transfers communications (eg, control messages) between the above elements.
[0084] The processor 120 can receive commands from the other components mentioned above (such as the memory 130, the communication module 170, etc.) through the bus 110, can interpret the received commands, and can perform calculations or data processing according to the interpreted commands. The processor 120 can be an integrated circuit chip with signal processing capabilities. The processor 120 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component.
[0085] The memory 130 can store commands or data received from the processor 120 or other components (such as the communication module 170), or commands or data generated by the processor 120 or other components. The memory 130 can be, but is not limited to, random access memory (RAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), and electrically erasable programmable read-only memory (EEPROM).
[0086] The communication module 170 may be used to communicate signaling or data with other node devices.
[0087] It is understandable that Figure 1 The structure shown is only a schematic diagram of the structure of the electronic device 100. The electronic device 100 may also include Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.
[0088] The electronic device provided in the embodiment of the present invention may be a smart phone, a personal computer, a tablet computer, a wearable device, an ultra-mobile personal computer (UMPC), a netbook, a personal digital assistant (PDA), etc. The embodiment of the present invention does not impose any limitation on this.
[0089] The electronic device 100 described above will be used as an execution subject to execute the steps of the methods provided in the embodiments of the present invention and achieve corresponding technical effects.
[0090] See also Figure 2 , Figure 2 This is a flow chart of a method for detecting anomalies in spatiotemporal data provided by an embodiment of the present invention.
[0091] Step S202: Acquire multiple spatiotemporal data to be detected. One spatiotemporal data to be detected includes a flow sequence of multiple detection areas within a detection period and an adjacency matrix of the multiple detection areas. The adjacency matrix includes the relationship between each detection area and all adjacent detection areas.
[0092] The detection area refers to the sub-areas obtained by dividing the target area into the detection area. These multiple detection areas constitute the target area. The detection period can be understood as a time period. Different detection periods for the multiple spatiotemporal data to be detected represent different time periods, but each time period has the same duration.
[0093] In this embodiment, after determining multiple detection areas according to the target area, the relationship between each detection area and all adjacent detection areas can be determined according to the position of each detection area, that is, the adjacency matrix of the multiple detection areas is obtained, such as A and A∈R V×V , R represents the dimension, V represents the total number of detection areas, and the adjacency matrix can be understood as spatial data.
[0094] By collecting the traffic sequence of multiple detection areas in a detection cycle, a time data such as X and X∈R T×V×F , T represents the time length of a detection cycle, and F represents the length of the traffic sequence. Combining a time data with a spatial data, we obtain a spatiotemporal data to be detected, such as (X, A). Based on multiple different detection cycles, we can obtain multiple spatiotemporal data to be detected. It can be understood that these multiple spatiotemporal data to be detected represent different time information, i.e., different time periods, but the same spatial information, i.e., they are all target areas.
[0095] Step S204: spatially augment the adjacency matrix in each spatiotemporal data to be detected to obtain each spatiotemporal data to be processed. Each spatiotemporal data to be detected corresponds to one spatiotemporal data to be processed. Each spatiotemporal data to be processed includes multiple flow sequences corresponding to a detection cycle and a global matrix. The global matrix includes the relationship between each detection area and all other detection areas.
[0096] It can be understood that after the embodiment of the present invention obtains the spatiotemporal data to be detected, it will perform spatial augmentation on the spatial data so that the augmented spatial data can express the global information of the space, and use the spatiotemporal data before and after spatial augmentation as a comparison example to improve the accuracy of spatiotemporal data anomaly detection.
[0097] In this embodiment, the graph diffusion technique can be used to perform spatial augmentation on a spatiotemporal data to be detected, that is, to calculate the transfer matrix of the neighboring matrix A in the spatiotemporal data to be detected, such as B and B∈R V×V , and then calculate the global matrix according to the preset formula, which is expressed as: Among them, S represents the global matrix, θ d ∈[0,1] represents the weight coefficient, which is used to control the ratio of local to overall structural information in the result.
[0098] In a similar manner, each spatiotemporal data to be detected is processed to obtain the corresponding spatiotemporal data to be processed. This means that the spatial data for each spatiotemporal data to be processed is a global matrix containing the relationship between each detection area and all other detection areas. A spatiotemporal data to be detected and its corresponding spatiotemporal data to be processed constitute a comparison case group.
[0099] Step S206: Using the target spatiotemporal data processing model, feature extraction is performed on each spatiotemporal data to be detected and each spatiotemporal data to be processed, obtaining a spatiotemporal feature to be detected of each spatiotemporal data to be detected and a spatiotemporal feature to be processed of each spatiotemporal data to be processed; one spatiotemporal feature to be detected corresponds to one spatiotemporal feature to be processed;
[0100] The target spatiotemporal data processing model is a model obtained by training the basic spatiotemporal data processing model using the spatiotemporal data samples of the target area.
[0101] In this embodiment, each spatiotemporal data to be detected can be input into the target spatiotemporal data processing model, and the target spatiotemporal data processing model can be used to perform feature extraction on each spatiotemporal data to be detected to obtain the spatiotemporal features of each spatiotemporal data to be detected, namely, the spatiotemporal features to be detected; and each spatiotemporal data to be processed can be input into the target spatiotemporal data processing model, and the target spatiotemporal data processing model can be used to perform feature extraction on each spatiotemporal data to be processed to obtain the spatiotemporal features of each spatiotemporal data to be processed, namely, the spatiotemporal features to be processed.
[0102] It can be understood that since each spatiotemporal data to be detected has corresponding spatiotemporal data to be processed, each spatiotemporal feature to be detected also has corresponding spatiotemporal features to be processed, and a spatiotemporal feature to be detected and its corresponding spatiotemporal feature to be processed is a comparison instance group.
[0103] Step S208, using the target spatiotemporal data processing model to perform prototype estimation based on each spatiotemporal feature to be detected and each spatiotemporal feature to be processed, to obtain a prototype contribution vector of each spatiotemporal feature to be detected and a prototype contribution vector of each spatiotemporal feature to be processed;
[0104] In this embodiment, a prototype is estimated for each spatiotemporal feature to be detected and each spatiotemporal feature to be processed using the target spatiotemporal data processing model. Prototype estimation can be understood as estimating a basic feature group that can represent each spatiotemporal feature to be detected and each spatiotemporal feature to be processed. The basic features in this basic feature group constitute a prototype matrix.
[0105] After the target spatiotemporal data processing model performs prototype estimation, it outputs a prototype contribution vector for each spatiotemporal feature to be detected and a prototype contribution vector for each spatiotemporal feature to be processed. The prototype contribution vector for each spatiotemporal feature to be detected represents the linear relationship between the spatiotemporal feature to be detected and the prototype matrix, while the prototype contribution vector for each spatiotemporal feature to be processed represents the linear relationship between the spatiotemporal feature to be processed and the prototype matrix.
[0106] Step S210, based on the prototype contribution vector of each spatiotemporal feature to be detected, the prototype contribution vector of each spatiotemporal feature to be processed, and the target prototype matrix of the target spatiotemporal data processing model, determine the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be detected and the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be processed, and calculate the anomaly score value of each spatiotemporal data to be detected;
[0107] Among them, the target prototype matrix is a prototype matrix obtained by performing prototype estimation on spatiotemporal data samples using a spatiotemporal data processing model, which can be understood as a standard prototype matrix.
[0108] In this embodiment, prediction can be made based on the prototype contribution vector and target prototype matrix of each spatiotemporal feature to be detected to obtain the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be detected, and prediction can be made based on the prototype contribution vector and target prototype matrix of each spatiotemporal feature to be processed to obtain the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be processed.
[0109] Then, the difference between each spatiotemporal feature to be detected and its predicted spatiotemporal feature, as well as the difference between each spatiotemporal feature to be processed and its corresponding predicted spatiotemporal feature, is compared to obtain the feature comparison result of each spatiotemporal data to be detected, that is, the anomaly score value of each spatiotemporal data to be detected is obtained.
[0110] Step S212A: If the anomaly score of the spatiotemporal data to be detected is greater than a preset threshold, the spatiotemporal data to be detected is determined to be abnormal;
[0111] Step S212B: if the abnormality score of the spatiotemporal data to be detected is less than or equal to the preset threshold, the spatiotemporal data to be detected is determined to be normal;
[0112] In this embodiment, if the anomaly score value of the spatiotemporal data to be detected is greater than the preset threshold, it means that the difference in the feature comparison results of the spatiotemporal data to be detected is large. It can be understood that the spatiotemporal features of the spatiotemporal data to be detected and the offset relative to the target prototype matrix exceed the preset range, that is, the spatiotemporal data to be detected is out of the target prototype matrix, so the spatiotemporal data to be detected is judged to be abnormal.
[0113] If the anomaly score value of the spatiotemporal data to be detected is less than or equal to the preset threshold, it means that the difference in the feature comparison results of the spatiotemporal data to be detected is small. It can be understood that the spatiotemporal features of the spatiotemporal data to be detected and the offset relative to the target prototype matrix are within the preset range, that is, the spatiotemporal data to be detected conforms to the target prototype matrix, so the spatiotemporal data to be detected is judged to be normal.
[0114] It can be understood that the embodiment of the present invention obtains spatiotemporal data containing global spatial information by spatially augmenting the original spatiotemporal data, and uses the spatiotemporal data processing model to obtain the spatiotemporal characteristics and prototype contribution vectors of the two spatiotemporal data, and then predicts the spatiotemporal characteristics of the two spatiotemporal data in combination with the standard prototype matrix, and determines whether the original spatiotemporal data is abnormal by comparing the difference between the spatiotemporal characteristics output by the model and the predicted spatiotemporal characteristics.
[0115] It can be seen that based on the above steps, multiple spatiotemporal data to be detected are obtained and spatially augmented to obtain multiple spatiotemporal data to be processed. Then, the target spatiotemporal data processing model is used to extract features from each spatiotemporal data to be detected and each spatiotemporal data to be processed, obtain the spatiotemporal features to be detected of each spatiotemporal data to be detected and the spatiotemporal features to be processed of each spatiotemporal data to be processed and perform prototype estimation, obtain the prototype contribution vector of each spatiotemporal feature to be detected and the prototype contribution vector of each spatiotemporal feature to be processed, and then combine the target prototype matrix of the target spatiotemporal data processing model to obtain the predicted spatiotemporal features corresponding to each spatiotemporal feature to be detected and each spatiotemporal feature to be processed, and calculate the anomaly score value of each spatiotemporal data to be detected to determine whether the spatiotemporal data to be detected is abnormal. By comparing the spatiotemporal features output by the model with the spatiotemporal features predicted based on the prototype matrix to detect whether the spatiotemporal data is abnormal, not only the spatiotemporal correlation of the spatiotemporal data is taken into account, but also the spatiotemporal features of the spatiotemporal data in different scenarios can be reflected through the prototype matrix, thereby improving the accuracy of spatiotemporal data anomaly detection.
[0116] Optionally, for step S210, an embodiment of the present invention provides a possible implementation method.
[0117] Step S210-1, according to a first preset formula, based on the prototype contribution vector of each spatiotemporal feature to be detected, the prototype contribution vector of each spatiotemporal feature to be processed, and the target prototype matrix of the target spatiotemporal data processing model, determining the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be detected and the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be processed;
[0118] The first preset formula is expressed as follows:
[0119]
[0120]
[0121] in, represents the predicted spatiotemporal feature corresponding to the u-th spatiotemporal feature to be detected; Represents the prototype contribution vector of the u-th spatiotemporal feature to be detected; represents the predicted spatiotemporal feature corresponding to the u-th spatiotemporal feature to be processed; represents the prototype contribution vector of the u-th spatiotemporal feature to be processed; P m represents the target prototype matrix;
[0122] In this embodiment, for a spatiotemporal feature to be detected, a predicted spatiotemporal feature corresponding to the spatiotemporal feature to be detected can be calculated according to a first preset formula based on the prototype contribution vector of the spatiotemporal feature to be detected and the target prototype matrix. Based on each spatiotemporal feature to be detected, a predicted spatiotemporal feature corresponding to each spatiotemporal feature to be detected can be obtained.
[0123] For the spatiotemporal feature to be processed, the predicted spatiotemporal feature corresponding to the spatiotemporal feature to be processed can be calculated according to the prototype contribution vector of the spatiotemporal feature to be processed and the target prototype matrix according to the first preset formula. Based on each spatiotemporal feature to be processed, the predicted spatiotemporal feature corresponding to each spatiotemporal feature to be processed can be obtained.
[0124] Step S210-3, calculating an anomaly score value for each spatiotemporal data to be detected based on each spatiotemporal feature to be detected and its corresponding predicted spatiotemporal feature and each spatiotemporal feature to be processed and its corresponding predicted spatiotemporal feature according to a second preset formula;
[0125] The second preset formula is expressed as follows:
[0126]
[0127] Among them, r u Represents the abnormal score value of the u-th spatiotemporal data to be detected; represents the u-th spatiotemporal feature to be detected; represents the u-th spatiotemporal feature to be processed;
[0128] In this embodiment, each spatiotemporal data point to be tested has two corresponding sets of spatiotemporal features: one set is the two spatiotemporal features output by the model, and the other set is the two spatiotemporal features obtained by prediction. According to the second preset formula, the difference between the two sets of spatiotemporal features corresponding to a spatiotemporal data point to be tested is calculated to obtain the anomaly score corresponding to the spatiotemporal data point to be tested. Based on each spatiotemporal data point to be tested, an anomaly score for each spatiotemporal data point to be tested can be obtained.
[0129] Optionally, for the target spatiotemporal data processing model, the present invention provides a training method for the spatiotemporal data processing model. Figure 3 .
[0130] Step S220: Obtain traffic sequence samples of multiple detection areas within a historical time period and an adjacency matrix of the multiple detection areas, where the adjacency matrix includes the relationship between each detection area and all adjacent detection areas;
[0131] In this embodiment, we can obtain the traffic flow sequence for each detection zone within the target area over a historical time period, obtaining multiple traffic flow sequence samples, thus forming the original temporal dataset. Furthermore, based on the location of each detection zone, we determine the relationship between each detection zone and all adjacent detection zones, and obtain the adjacency matrix of these multiple detection zones, thus forming the original spatial data. The original temporal dataset is then combined with the original spatial data to form the original spatiotemporal dataset.
[0132] Step S222: performing a first temporal augmentation on each traffic sequence sample to obtain a first view including each first traffic sequence sample and an adjacency matrix;
[0133] In this embodiment, the original spatiotemporal data set can be temporally augmented to add noise to the spatiotemporal data, so that the model can be trained based on the spatiotemporal data samples carrying noise, thereby improving the model's anti-interference ability and improving the model's performance.
[0134] Each traffic sequence sample in the original spatiotemporal dataset can be subjected to a first temporal augmentation, such as any one or a combination of operations such as dithering, scaling, rotating, and bending, to obtain each first traffic sequence sample, i.e., a first view. The first view can be understood as a spatiotemporal dataset obtained by performing the first temporal augmentation on the time data of the original spatiotemporal dataset.
[0135] Step S224: performing a second temporal augmentation on each traffic sequence sample and a spatial augmentation on the adjacency matrix to obtain a second view including each second traffic sequence sample and a global matrix; the global matrix includes the relationship between each detection area and all other detection areas;
[0136] In this embodiment, a second time augmentation can be performed on each traffic sequence sample in the original spatiotemporal dataset, such as any one or a combination of operations such as jittering, scaling, rotation, and bending, to obtain each second traffic sequence sample; and spatial augmentation is performed on the spatial data in the original spatiotemporal dataset, i.e., the adjacency matrix, to obtain a global matrix, i.e., a second view containing each second traffic sequence sample and the global matrix is obtained.
[0137] The second view can be understood as the spatiotemporal dataset obtained by performing a second temporal augmentation on the temporal data of the original spatiotemporal dataset and spatial augmentation on its spatial data. Compared to the first view, the spatial data in the second view can express global spatial information. It can be understood that the first view focuses on the relationship between adjacent detection areas and can be called a local view; the second view can aggregate the relationships between non-adjacent detection areas and can be called a global view.
[0138] It should be understood that the processing methods for the first and second temporal augmentations can be the same or different; their purpose is to introduce noise into the temporal data, thereby improving the model's anti-interference capabilities by training the model with noisy spatiotemporal data samples. Furthermore, the process of spatially augmenting the adjacency matrix in the original spatiotemporal dataset is similar to the aforementioned process of spatially augmenting the adjacency matrix in the spatiotemporal data to be detected. For a specific implementation, please refer to the above-mentioned embodiments.
[0139] Step S226: performing spatiotemporal sampling on the first view to obtain a plurality of first spatiotemporal data samples and performing spatiotemporal sampling on the second view to obtain a plurality of second spatiotemporal data samples; one first spatiotemporal data sample corresponds to one second spatiotemporal data sample;
[0140] In this embodiment, spatiotemporal sampling can be performed on the first view, i.e., temporal data and spatial data can be correlated and sampled to obtain multiple first spatiotemporal data samples. Furthermore, spatiotemporal sampling can be performed on the second view, i.e., temporal data and spatial data can be correlated and sampled to obtain multiple second spatiotemporal data samples. Each first spatiotemporal data sample has a corresponding second spatiotemporal data sample. A first spatiotemporal data sample and its corresponding second spatiotemporal data sample constitute a comparison instance group.
[0141] It can be understood that the first spatiotemporal data sample and the second spatiotemporal data sample having a corresponding relationship have the same time information represented and the same spatial information, ie, the same detection area, included therein.
[0142] Step S228: Using the spatiotemporal data processing model, perform feature extraction on each first spatiotemporal data sample and each second spatiotemporal data sample to obtain a first spatiotemporal feature of each first spatiotemporal data sample and a second spatiotemporal feature of each second spatiotemporal data sample; one first spatiotemporal feature corresponds to one second spatiotemporal feature;
[0143] In this embodiment, each first spatiotemporal data sample can be input into the spatiotemporal data processing model, and the spatiotemporal data processing model can be used to perform feature extraction on each first spatiotemporal data sample to obtain the spatiotemporal features of each first spatiotemporal data sample, namely the first spatiotemporal features; and each second spatiotemporal data sample can be input into the spatiotemporal data processing model, and the spatiotemporal data processing model can be used to perform feature extraction on each second spatiotemporal data sample to obtain the spatiotemporal features of each second spatiotemporal data sample, namely the second spatiotemporal features.
[0144] It can be understood that since each first spatiotemporal data sample has a corresponding second spatiotemporal data sample, each first spatiotemporal feature also has a corresponding second spatiotemporal feature, and a first spatiotemporal feature and its corresponding second spatiotemporal feature are a comparison instance group.
[0145] Step S230: Performing prototype estimation based on each first spatiotemporal feature and each second spatiotemporal feature using the spatiotemporal data processing model to obtain a first prototype contribution vector for each first spatiotemporal feature and a second prototype contribution vector for each second spatiotemporal feature; the first prototype contribution vector represents a linear relationship between the first spatiotemporal feature and the prototype matrix, and the second prototype contribution vector represents a linear relationship between the second spatiotemporal feature and the prototype matrix;
[0146] In this embodiment, the spatiotemporal data processing model includes a contribution mapping head, which is a multilayer perceptron with a softmax layer. The contribution mapping head in the spatiotemporal data processing model can be used to perform prototype estimation based on each first spatiotemporal feature and each second spatiotemporal feature, thereby obtaining a prototype contribution vector (i.e., a first prototype contribution vector) for each first spatiotemporal feature and a prototype contribution vector (i.e., a second prototype contribution vector) for each second spatiotemporal feature.
[0147] The first prototype contribution vector represents the linear relationship between the first spatiotemporal feature and the prototype matrix, which includes the contribution of each prototype vector in the prototype matrix to the first spatiotemporal feature; the second prototype contribution vector represents the linear relationship between the second spatiotemporal feature and the prototype matrix, which includes the contribution of each prototype vector in the prototype matrix to the second spatiotemporal feature. It can be understood that the length of the first prototype contribution vector and the second prototype contribution vector are both equal to the total number of prototype vectors in the prototype matrix.
[0148] Step S232: Based on each first spatiotemporal feature and its first prototype contribution vector and each second spatiotemporal feature and its second prototype contribution vector, as well as a preset feature contrast loss function, a prototype contribution contrast loss function, and a cross-prediction loss function, the spatiotemporal data processing model is trained to obtain a target spatiotemporal data processing model and its target prototype matrix.
[0149] In this embodiment, based on each first spatiotemporal feature and its first prototype contribution vector and each second spatiotemporal feature and its second prototype contribution vector, as well as the preset feature contrast loss function, prototype contribution contrast loss function and cross-prediction loss function, the spatiotemporal data processing model is iteratively trained to obtain the target spatiotemporal data processing model and its target prototype matrix.
[0150] Optionally, for step S226, an embodiment of the present invention provides a possible implementation method.
[0151] Step S226-1, taking any detection area as a pending area;
[0152] In this embodiment, the first traffic sequence sample includes multiple first traffic data, and the second traffic sequence sample includes multiple second traffic data. It is understood that to ensure that the spatiotemporal data samples obtained after spatiotemporal sampling have spatiotemporal correlation, this embodiment of the present invention processes data based on detection areas. Since each detection area is processed similarly, for the sake of simplicity, any detection area will be used as the undetermined area for the following example.
[0153] Step S226-3A, obtaining a first matrix corresponding to the undetermined region in the adjacency matrix of the first view, the first matrix including the relationship between the undetermined region and its G nearest associated detection regions; G is a positive integer;
[0154] Step S226-5A, obtaining first traffic sequence samples corresponding to the pending area and the G associated detection areas in the first view, and obtaining G+1 first pending traffic sequence samples;
[0155] In this embodiment, the G associated detection areas closest to the area to be determined can be determined, and in the adjacency matrix of the first view, a matrix representing the relationship between the area to be determined and these G associated detection areas can be obtained, that is, the first matrix corresponding to the area to be determined is obtained; then, in all the first traffic sequence samples of the first view, the first traffic sequence samples corresponding to the area to be determined and the G associated detection areas are obtained, that is, G+1 first traffic sequence samples to be determined are obtained.
[0156] Step S226-7A: For each first undetermined traffic sequence sample, a window of a preset time length is used to slide sequentially in the first undetermined traffic sequence sample, and all first traffic data within the window is used as a first traffic subsequence to obtain multiple first traffic subsequences;
[0157] It is understandable that each first pending traffic sequence sample is processed in a similar manner. For the sake of brevity, one first pending traffic sequence sample will be used as an example for description.
[0158] In this embodiment, a window of a preset time length can be used to slide within the first pending traffic sequence sample at a step size, and all first traffic data within each window can be used as a first traffic subsequence to obtain multiple first traffic subsequences corresponding to the first pending traffic sequence sample. Based on each first pending traffic sequence sample, multiple first traffic subsequences corresponding to each first pending traffic sequence sample can be obtained. It should be understood that the preset time length can be set according to actual conditions, such as being represented by T, that is, the time length of each first traffic subsequence is T.
[0159] Step S226-9A, combining each first traffic subsequence with the first matrix to obtain a plurality of first spatiotemporal data samples corresponding to the area to be determined;
[0160] In this embodiment, each first traffic subsequence is combined with the first matrix to obtain multiple first spatiotemporal data samples corresponding to the undetermined region. This embodiment of the present invention first samples the spatial data and then samples the temporal data associated with the sampled spatial data. This ensures that the sampled spatiotemporal data samples have spatiotemporal correlation. Therefore, training the model based on these spatiotemporal data samples can improve model performance.
[0161] Step S226-11A, traversing each detection area based on the first view to obtain a plurality of first spatiotemporal data samples;
[0162] In this embodiment, based on the first view, each detection area is processed in a similar manner as described above to obtain a plurality of first spatiotemporal data samples.
[0163] Step S226-3B, obtaining a second matrix corresponding to the pending region in the global matrix of the second view, where the second matrix includes a relationship between the pending region and its G closest associated detection regions;
[0164] Step S226-5B, obtaining second traffic sequence samples corresponding to the pending area and the G associated detection areas in the second view, and obtaining G+1 second pending traffic sequence samples;
[0165] In this embodiment, the G associated detection areas closest to the area to be determined can be determined, and in the global matrix of the second view, a matrix representing the relationship between the area to be determined and these G associated detection areas can be obtained, that is, the second matrix corresponding to the area to be determined is obtained; then, in all the second traffic sequence samples of the second view, the second traffic sequence samples corresponding to the area to be determined and the G associated detection areas are obtained, that is, G+1 second traffic sequence samples to be determined are obtained.
[0166] Step S226-7B: For each second pending traffic sequence sample, a window of a preset time length is used to slide sequentially in the second pending traffic sequence sample, and all second traffic data within the window is used as a second traffic subsequence to obtain multiple second traffic subsequences;
[0167] It is understandable that each second pending traffic sequence sample is processed in a similar manner. For the sake of brevity, one second pending traffic sequence sample is used as an example for description.
[0168] In this embodiment, a window of a preset time length can be used to slide within the second pending traffic sequence sample at a step size, and all second traffic data within each window can be used as a second traffic subsequence to obtain multiple first traffic subsequences corresponding to the second pending traffic sequence sample. Based on each second pending traffic sequence sample, multiple first traffic subsequences corresponding to each second pending traffic sequence sample can be obtained. It should be understood that the time length of the first traffic subsequence is the same as the time length of the second traffic subsequence, that is, both are a preset time length, such as T.
[0169] Step S226-9B, combining each second traffic subsequence with the second matrix to obtain a plurality of second spatiotemporal data samples corresponding to the area to be determined;
[0170] In this embodiment, each second traffic subsequence is combined with the second matrix to obtain multiple second spatiotemporal data samples corresponding to the undetermined region. This embodiment of the present invention first samples the spatial data and then samples the temporal data associated with the sampled spatial data. This ensures that the sampled spatiotemporal data samples have spatiotemporal correlation. Therefore, training the model based on these spatiotemporal data samples can improve model performance.
[0171] Step S226-11B, traversing each detection area based on the second view to obtain a plurality of second spatiotemporal data samples;
[0172] In this embodiment, based on the second view, each detection area is processed in a similar manner as described above to obtain a plurality of second spatiotemporal data samples.
[0173] Optionally, for step S228, an embodiment of the present invention provides a possible implementation method.
[0174] Step S228-1, taking each first spatiotemporal data sample and each second spatiotemporal data sample as a pending spatiotemporal data sample;
[0175] Step S228-3, using the spatiotemporal encoder in the spatiotemporal data processing model to encode the to-be-timed spatiotemporal data samples to obtain encoded to-be-timed spatiotemporal data samples;
[0176] Step S228-5, using the feature mapping head in the spatiotemporal data processing model, maps the encoded spatiotemporal data samples to be timed to a preset feature space, obtains the spatiotemporal features of the spatiotemporal data samples to be timed, and obtains the first spatiotemporal features of each first spatiotemporal data sample and the second spatiotemporal features of each second spatiotemporal data sample.
[0177] In this embodiment, the spatiotemporal data processing model includes a spatiotemporal encoder (ST Encoder) and a feature mapping head (feature projection head), and the feature mapping head is a multi-layer perceptron. It is understood that each first spatiotemporal data sample and each second spatiotemporal data sample are processed in a similar manner. For the sake of simplicity, the following description uses the to-be-determined spatiotemporal data sample as an example.
[0178] First, the spatiotemporal encoder in the spatiotemporal data processing model is used to encode the pending spatiotemporal data sample to obtain a vector, thereby obtaining the encoded pending spatiotemporal data sample. Then, the feature mapping header in the spatiotemporal data processing model is used to map the encoded pending spatiotemporal data sample to a preset feature space, thereby obtaining the spatiotemporal features of the pending spatiotemporal data sample. For each first spatiotemporal data sample and each second spatiotemporal data sample, similar processing is performed to obtain each first spatiotemporal feature and each second spatiotemporal feature.
[0179] Alternatively, the feature contrast loss function is expressed as follows:
[0180]
[0181] in, represents the feature contrast loss function; N represents the total number of the first spatiotemporal features or the total number of the second spatiotemporal features; h i represents the first spatiotemporal feature of the i-th element, h i+N represents the second spatiotemporal feature corresponding to the i-th first spatiotemporal feature; h j represents the jth first spatiotemporal feature or the second spatiotemporal feature; τ ic represents the first preset coefficient; sim represents the similarity function; exp represents the exponential function.
[0182] In this embodiment, based on each first spatiotemporal feature and each second spatiotemporal feature obtained, the function value thereof can be calculated according to the expression of the feature comparison loss function to guide the model training.
[0183] The feature comparison loss function can be understood as treating the corresponding first and second spatiotemporal features as positive pairs and the uncorrelated first and second spatiotemporal features as negative pairs. This feature comparison loss function guides the model to bring positive pairs closer together (i.e., making them more similar) and to move negative pairs further apart.
[0184] Optionally, the prototype matrix includes M prototype vectors, each prototype vector has a first contribution vector and a second contribution vector, the first contribution vector includes the contribution of the prototype vector to all first spatiotemporal features, and the second contribution vector includes the contribution of the prototype vector to all second spatiotemporal features;
[0185] The prototype contribution comparison loss function is expressed as follows:
[0186]
[0187] in, represents the prototype contribution comparison loss function; M represents the total number of prototype vectors; c k represents the first contribution vector of the k-th prototype vector; c k+M represents the second contribution vector of the k-th prototype vector; c l represents the first contribution vector or the second contribution vector of the lth prototype vector; τ Pc represents the second preset coefficient; sim represents the similarity function; exp represents the exponential function.
[0188] In this embodiment, based on the obtained first prototype contribution vector of each first spatiotemporal feature and the second prototype contribution vector of each second spatiotemporal feature, a first contribution vector and a second contribution vector of each prototype vector can be obtained. Furthermore, based on the first contribution vector and the second contribution vector of each prototype vector, a function value of the prototype contribution comparison loss function can be calculated according to its expression to guide model training.
[0189] It should be noted that the first prototype contribution vector and the first contribution vector are both related to the first spatiotemporal feature. It should be noted that the first prototype contribution vector refers to the contribution of all prototype vectors to a first spatiotemporal feature, and the first contribution vector refers to the contribution of a prototype vector to all first spatiotemporal features. The second prototype contribution vector and the second contribution vector are both related to the second spatiotemporal feature. It should be noted that the second prototype contribution vector refers to the contribution of all prototype vectors to a second spatiotemporal feature, and the second contribution vector refers to the contribution of a prototype vector to all second spatiotemporal features.
[0190] The prototype contribution contrast loss function can be understood as treating the first contribution vector and second contribution vector of a prototype vector as a positive pair, and treating two first contribution vectors, two second contribution vectors, or one first contribution vector and one second contribution vector that are not prototype vectors as negative pairs. The prototype contribution contrast loss function guides the model to make positive pairs closer, meaning they are more similar, and to keep negative pairs farther apart.
[0191] Alternatively, the cross-prediction loss function is expressed as follows:
[0192]
[0193] in, represents the cross-prediction loss function; N represents the total number of the first spatiotemporal features or the total number of the second spatiotemporal features; represents the i-th first spatiotemporal feature, represents the i-th second spatiotemporal feature; represents the i-th first prototype contribution vector; represents the i-th second prototype contribution vector; P represents the prototype matrix.
[0194] In this embodiment, based on each first spatiotemporal feature and each second spatiotemporal feature obtained, and the currently estimated prototype matrix, the function value is calculated according to the expression of the cross-prediction loss function to guide the model training.
[0195] The cross-prediction loss function can be understood as calculating the predicted spatiotemporal features corresponding to the first spatiotemporal features based on the second prototype contribution vector of the second spatiotemporal features corresponding to the first spatiotemporal features and the currently estimated prototype matrix, and calculating the difference between the first spatiotemporal features and their predicted spatiotemporal features; and calculating the predicted spatiotemporal features corresponding to the second spatiotemporal features based on the first prototype contribution vector of the first spatiotemporal features corresponding to the second spatiotemporal features and the currently estimated prototype matrix, and calculating the difference between the second spatiotemporal features and their predicted spatiotemporal features, that is, guiding the model to update the prototype matrix through cross-prediction so that the updated prototype matrix can reduce these two differences, that is, reduce the difference between the spatiotemporal features output by the model and the predicted spatiotemporal features.
[0196] In order to better understand the effects of the present invention, an example will be used below to compare the effects of the prior art and the present invention.
[0197] For example, a place can be divided into multiple areas. Based on the taxi travel records, shared bicycle travel records and other information in these multiple areas during different time periods, the inflow and outflow of people can be obtained and used as a spatiotemporal dataset; and the spatiotemporal dataset can be marked according to the abnormal event set. That is, if an abnormal event occurs in the area and time period corresponding to a certain spatiotemporal data, the spatiotemporal data is marked as abnormal, otherwise it is marked as normal.
[0198] In order to demonstrate the versatility of the method provided by the present invention, the embodiment of the present invention adopts two groups of spatiotemporal data sets. The first group is a short-term spatiotemporal data set, that is, the duration of the abnormal event corresponding to the spatiotemporal data set is relatively short, such as 6 hours; the second group is a long-term spatiotemporal data set, that is, the duration of the abnormal event corresponding to the spatiotemporal data set is relatively long, such as 40 hours.
[0199] The two sets of spatiotemporal data sets were tested using the method provided by the present invention, the existing elliptical envelope method, the isolation forest method, the local outlier factor method, and the single-category support vector machine method. Then, the ROC curve (Receiver Operating Characteristic curve) was drawn based on the test results. The comparison of the results of the first set of spatiotemporal data sets is shown in the figure below. Figure 4 As shown in the figure, the comparison of the results of the second set of spatiotemporal data sets is shown in Figure 5 And calculate the area under the ROC curve and the coordinate axis, namely AUC (Area Under Curve), and the obtained AUC is shown in the following table.
[0200]
[0201] It is understood that a larger AUC indicates a better classification effect of the method, that is, a larger AUC indicates a higher accuracy of spatiotemporal data anomaly detection. Based on the data in the above table, it can be seen that the AUCs obtained using the method provided by the present invention are all greater than those obtained by other methods, indicating that the method provided by the present invention can improve the accuracy of spatiotemporal data anomaly detection and reduce the error rate.
[0202] See also Figure 4 and Figure 5 , where the true positive rate on the ordinate represents the probability of identifying actually abnormal spatiotemporal data as abnormal, and the false positive rate on the abscissa represents the probability of identifying actually normal spatiotemporal data as abnormal. Figure 4 and Figure 5 It can be seen that when the true positive rate is constant, the false positive rate obtained by the method provided by the present invention is lower than that of other methods, which means that the method provided by the present invention can not only improve the accuracy of spatiotemporal data anomaly detection, but also reduce the error rate and have better performance.
[0203] In order to execute the corresponding steps in the above embodiments and various possible methods, a method for implementing a spatiotemporal data anomaly detection device is provided below. Figure 6 , Figure 6 This is a functional module diagram of a spatiotemporal data anomaly detection device 300 provided in an embodiment of the present invention. It should be noted that the basic principles and technical effects of the spatiotemporal data anomaly detection device 300 provided in this embodiment are the same as those of the above-mentioned embodiments. For the sake of brevity, any details not mentioned in this embodiment can be referred to the corresponding contents of the above-mentioned embodiments. The spatiotemporal data anomaly detection device 300 includes:
[0204] Acquisition module 310 is used to acquire multiple spatiotemporal data to be detected, where each spatiotemporal data to be detected includes flow sequences of multiple detection areas within a detection period and an adjacency matrix of the multiple detection areas, where the adjacency matrix includes the relationship between each detection area and all adjacent detection areas; spatially augment the adjacency matrix in each spatiotemporal data to be detected to obtain each spatiotemporal data to be processed; each spatiotemporal data to be detected corresponds to one spatiotemporal data to be processed, where each spatiotemporal data to be processed includes multiple flow sequences corresponding to a detection period and a global matrix, where the global matrix includes the relationship between each detection area and all other detection areas;
[0205] Processing module 330 is configured to perform feature extraction on each spatiotemporal data to be detected and each spatiotemporal data to be processed using the target spatiotemporal data processing model to obtain a spatiotemporal feature to be detected for each spatiotemporal data to be detected and a spatiotemporal feature to be processed for each spatiotemporal data to be processed; one spatiotemporal feature to be detected corresponds to one spatiotemporal feature to be processed; perform prototype estimation based on each spatiotemporal feature to be detected and each spatiotemporal feature to be processed using the target spatiotemporal data processing model to obtain a prototype contribution vector for each spatiotemporal feature to be detected and a prototype contribution vector for each spatiotemporal feature to be processed;
[0206] The detection module 350 is used to determine the predicted spatiotemporal features corresponding to each spatiotemporal feature to be detected and the predicted spatiotemporal features corresponding to each spatiotemporal feature to be processed based on the prototype contribution vector of each spatiotemporal feature to be detected, the prototype contribution vector of each spatiotemporal feature to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculate the anomaly score value of each spatiotemporal data to be detected; if the anomaly score value of the spatiotemporal data to be detected is greater than a preset threshold, the spatiotemporal data to be detected is determined to be abnormal; if the anomaly score value of the spatiotemporal data to be detected is less than or equal to the preset threshold, the spatiotemporal data to be detected is determined to be normal.
[0207] Optionally, the detection module 350 is further configured to execute the above steps S210 - 1 to S210 - 3 .
[0208] Optionally, the spatiotemporal data anomaly detection device 300 further includes a training module 370 for executing the above steps S220 to S232.
[0209] Optionally, the training module 370 is further configured to execute the above steps S226 - 1 to S226 - 11B.
[0210] Optionally, the training module 370 is further configured to execute the above steps S228 - 1 to S228 - 5 .
[0211] An embodiment of the present invention further provides an electronic device, including a processor and a memory, wherein the memory stores a computer program, and when the processor executes the computer program, the spatiotemporal data anomaly detection method disclosed in the embodiment of the present invention is implemented.
[0212] An embodiment of the present invention further provides a storage medium on which a computer program is stored. When the computer program is executed by a processor, the spatiotemporal data anomaly detection method disclosed in an embodiment of the present invention is implemented.
[0213] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the devices, methods, and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or part of the code, which contains one or more executable instructions for implementing the specified logical functions. It should also be noted that in some alternative implementations, the functions marked in the boxes can also occur in an order different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, as well as the combination of boxes in the block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified functions or actions, or can be implemented using a combination of dedicated hardware and computer instructions.
[0214] In addition, the functional modules in the various embodiments of the present invention may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.
[0215] If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
[0216] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.
Claims
1. A method for detecting anomalies in spatiotemporal data, characterized in that: The method comprises: Acquire a plurality of spatiotemporal data to be detected, wherein each of the spatiotemporal data to be detected includes a flow sequence of a plurality of detection areas within a detection period and an adjacency matrix of the plurality of detection areas, wherein the adjacency matrix includes a relationship between each detection area and all adjacent detection areas; Performing spatial augmentation on the adjacency matrix in each of the spatiotemporal data to be detected to obtain each spatiotemporal data to be processed; one of the spatiotemporal data to be detected corresponds to one of the spatiotemporal data to be processed, one of the spatiotemporal data to be processed includes multiple flow sequences corresponding to one detection period and a global matrix, the global matrix includes the relationship between each of the detection areas and all other detection areas; Using the target spatiotemporal data processing model, feature extraction is performed on each of the spatiotemporal data to be detected and each of the spatiotemporal data to be processed to obtain a spatiotemporal feature to be detected of each of the spatiotemporal data to be detected and a spatiotemporal feature to be processed of each of the spatiotemporal data to be processed; one spatiotemporal feature to be detected corresponds to one spatiotemporal feature to be processed; Using the target spatiotemporal data processing model, prototype estimation is performed based on each of the spatiotemporal features to be detected and each of the spatiotemporal features to be processed, to obtain a prototype contribution vector of each of the spatiotemporal features to be detected and a prototype contribution vector of each of the spatiotemporal features to be processed; Determine the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be detected and the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be processed according to the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculate the anomaly score value of each of the spatiotemporal data to be detected; The step of determining the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be detected and the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be processed based on the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculating the anomaly score value of each of the spatiotemporal data to be detected includes: According to a first preset formula, based on the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model, determining the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be detected and the predicted spatiotemporal features corresponding to each of the spatiotemporal features to be processed; The first preset formula is expressed as follows: ; ; in, Indicates the u The predicted spatiotemporal features corresponding to the spatiotemporal features to be detected; Indicates the u The prototype contribution vector of the spatiotemporal features to be detected; Indicates the u The predicted spatiotemporal features corresponding to the spatiotemporal features to be processed; Indicates the u The prototype contribution vector of the spatiotemporal features to be processed; represents the target prototype matrix; Calculate, according to a second preset formula, an anomaly score value of each of the spatiotemporal data to be detected based on each of the spatiotemporal features to be detected and its corresponding predicted spatiotemporal features and each of the spatiotemporal features to be processed and its corresponding predicted spatiotemporal features; The second preset formula is expressed as follows: ; in, Indicates the u Anomaly score value of the spatiotemporal data to be detected; Indicates the u spatiotemporal features to be detected; Indicates the u spatiotemporal features to be processed; If the anomaly score of the spatiotemporal data to be detected is greater than a preset threshold, the spatiotemporal data to be detected is determined to be abnormal; If the abnormality score value of the spatiotemporal data to be detected is less than or equal to a preset threshold, the spatiotemporal data to be detected is determined to be normal; and the spatiotemporal data to be detected is human traffic data.
2. The method according to claim 1, characterized in that The target spatiotemporal data processing model is obtained in the following manner: Obtaining traffic sequence samples of a plurality of detection areas within a historical time period and an adjacency matrix of the plurality of detection areas, wherein the adjacency matrix includes a relationship between each of the detection areas and all adjacent detection areas; Performing a first time augmentation on each of the traffic sequence samples to obtain a first view including each first traffic sequence sample and the adjacency matrix; Performing a second temporal augmentation on each of the traffic sequence samples and performing a spatial augmentation on the adjacency matrix to obtain a second view including each of the second traffic sequence samples and a global matrix; The global matrix includes the relationship between each of the detection areas and all other detection areas; Performing spatiotemporal sampling on the first view to obtain a plurality of first spatiotemporal data samples and performing spatiotemporal sampling on the second view to obtain a plurality of second spatiotemporal data samples; one first spatiotemporal data sample corresponds to one second spatiotemporal data sample; Performing feature extraction on each of the first spatiotemporal data samples and each of the second spatiotemporal data samples using a spatiotemporal data processing model to obtain a first spatiotemporal feature of each of the first spatiotemporal data samples and a second spatiotemporal feature of each of the second spatiotemporal data samples; One of the first spatiotemporal features corresponds to one of the second spatiotemporal features; Performing prototype estimation based on each of the first spatiotemporal features and each of the second spatiotemporal features using a spatiotemporal data processing model to obtain a first prototype contribution vector for each of the first spatiotemporal features and a second prototype contribution vector for each of the second spatiotemporal features; the first prototype contribution vector represents a linear relationship between the first spatiotemporal feature and a prototype matrix, and the second prototype contribution vector represents a linear relationship between the second spatiotemporal feature and the prototype matrix; Based on each of the first spatiotemporal features and its first prototype contribution vector and each of the second spatiotemporal features and its second prototype contribution vector, as well as the preset feature contrast loss function, prototype contribution contrast loss function and cross-prediction loss function, the spatiotemporal data processing model is trained to obtain the target spatiotemporal data processing model and its target prototype matrix.
3. The method according to claim 2, characterized in that The first flow sequence sample includes a plurality of first flow data, and the second flow sequence sample includes a plurality of second flow data; The step of performing spatiotemporal sampling on the first view to obtain a plurality of first spatiotemporal data samples and the step of performing spatiotemporal sampling on the second view to obtain a plurality of second spatiotemporal data samples comprises: Taking any one of the detection areas as a pending area; In the adjacency matrix of the first view, a first matrix corresponding to the undetermined region is obtained, where the first matrix includes a relationship between the undetermined region and its G closest associated detection regions, where G is a positive integer; Acquire, in the first view, first traffic sequence samples corresponding to the pending area and the G associated detection areas, respectively, to obtain G+1 first pending traffic sequence samples; For each of the first undetermined traffic sequence samples, a window of a preset time length is used to sequentially slide through the first undetermined traffic sequence samples, and all first traffic data within the window is used as a first traffic subsequence to obtain a plurality of first traffic subsequences; Combining each of the first traffic subsequences with the first matrix to obtain a plurality of first spatiotemporal data samples corresponding to the undetermined area; Traversing each of the detection areas based on the first view to obtain a plurality of first spatiotemporal data samples; In the global matrix of the second view, a second matrix corresponding to the undetermined area is obtained, where the second matrix includes a relationship between the undetermined area and its G closest associated detection areas; Acquire, in the second view, second traffic sequence samples corresponding to the pending area and the G associated detection areas, respectively, to obtain G+1 second pending traffic sequence samples; For each of the second undetermined traffic sequence samples, a window of a preset time length is used to sequentially slide in the second undetermined traffic sequence samples, and all second traffic data within the window is used as a second traffic subsequence to obtain multiple second traffic subsequences; Combining each of the second traffic subsequences with the second matrix to obtain a plurality of second spatiotemporal data samples corresponding to the undetermined area; Each of the detection areas is traversed based on the second view to obtain a plurality of second spatiotemporal data samples.
4. The method according to claim 2, characterized in that The spatiotemporal data processing model includes a spatiotemporal encoder and a feature mapping head; The step of performing feature extraction on each of the first spatiotemporal data samples and each of the second spatiotemporal data samples using the spatiotemporal data processing model to obtain a first spatiotemporal feature of each of the first spatiotemporal data samples and a second spatiotemporal feature of each of the second spatiotemporal data samples includes: taking each of the first spatiotemporal data samples and each of the second spatiotemporal data samples as pending spatiotemporal data samples; Encoding the to-be-timed spatiotemporal data sample using a spatiotemporal encoder in a spatiotemporal data processing model to obtain encoded to-be-timed spatiotemporal data sample; Utilizing the feature mapping head in the spatiotemporal data processing model, the encoded spatiotemporal data samples to be timed are mapped to a preset feature space to obtain the spatiotemporal features of the spatiotemporal data samples to be timed, and the first spatiotemporal features of each of the first spatiotemporal data samples and the second spatiotemporal features of each of the second spatiotemporal data samples are obtained.
5. The method according to claim 2, characterized in that The feature contrast loss function is expressed as follows: ; in, represents the feature contrast loss function; N represents the total number of the first spatiotemporal features or the total number of the second spatiotemporal features; Indicates the i The first spatiotemporal feature, Indicates the i The second space-time feature corresponding to the first space-time feature; Indicates the j a first spatiotemporal feature or a second spatiotemporal feature; represents the first preset coefficient; represents the similarity function; exp represents the exponential function; The prototype matrix includes M prototype vectors, each of the prototype vectors has a first contribution vector and a second contribution vector, the first contribution vector includes the contribution of the prototype vector to all first spatiotemporal features, and the second contribution vector includes the contribution of the prototype vector to all second spatiotemporal features; The prototype contribution comparison loss function is expressed as follows: ; in, represents the prototype contribution comparison loss function; M represents the total number of prototype vectors; Indicates the k The first contribution vector of the prototype vector; Indicates the k The second contribution vector of the prototype vector; Indicates the l A first contribution vector or a second contribution vector of a prototype vector; represents the second preset coefficient; represents the similarity function; exp Represents the exponential function.
6. The method according to claim 2, characterized in that The cross prediction loss function is expressed as follows: ; in, represents the cross-prediction loss function; N represents the total number of the first spatiotemporal features or the total number of the second spatiotemporal features; Indicates the i The first spatiotemporal feature, Indicates the i A second spatiotemporal feature; Indicates the i First prototype contribution vector; Indicates the i Second prototype contribution vector; P Represents the prototype matrix.
7. A device for detecting anomalies in spatiotemporal data, characterized in that: The device comprises: An acquisition module is configured to acquire a plurality of spatiotemporal data to be detected, wherein the spatiotemporal data to be detected includes a flow sequence of a plurality of detection areas within a detection period and an adjacency matrix of the plurality of detection areas, wherein the adjacency matrix includes a relationship between each detection area and all adjacent detection areas; Performing spatial augmentation on the adjacency matrix in each of the spatiotemporal data to be detected to obtain each spatiotemporal data to be processed; one of the spatiotemporal data to be detected corresponds to one of the spatiotemporal data to be processed, one of the spatiotemporal data to be processed includes multiple flow sequences corresponding to one detection period and a global matrix, the global matrix includes the relationship between each of the detection areas and all other detection areas; a processing module, configured to perform feature extraction on each of the spatiotemporal data to be detected and each of the spatiotemporal data to be processed using a target spatiotemporal data processing model, to obtain a spatiotemporal feature to be detected for each of the spatiotemporal data to be detected and a spatiotemporal feature to be processed for each of the spatiotemporal data to be processed; one spatiotemporal feature to be detected corresponds to one spatiotemporal feature to be processed; Using the target spatiotemporal data processing model, prototype estimation is performed based on each of the spatiotemporal features to be detected and each of the spatiotemporal features to be processed, to obtain a prototype contribution vector of each of the spatiotemporal features to be detected and a prototype contribution vector of each of the spatiotemporal features to be processed; A detection module is used to determine the predicted spatiotemporal features corresponding to each spatiotemporal feature to be detected and the predicted spatiotemporal features corresponding to each spatiotemporal feature to be processed based on the prototype contribution vector of each spatiotemporal feature to be detected, the prototype contribution vector of each spatiotemporal feature to be processed, and the target prototype matrix of the target spatiotemporal data processing model, and calculate the anomaly score value of each spatiotemporal data to be detected; The detection module is further configured to determine, according to a first preset formula, a predicted spatiotemporal feature corresponding to each of the spatiotemporal features to be detected and a predicted spatiotemporal feature corresponding to each of the spatiotemporal features to be processed based on the prototype contribution vector of each of the spatiotemporal features to be detected, the prototype contribution vector of each of the spatiotemporal features to be processed, and the target prototype matrix of the target spatiotemporal data processing model; The first preset formula is expressed as follows: ; ; in, Indicates the u The predicted spatiotemporal features corresponding to the spatiotemporal features to be detected; Indicates the u The prototype contribution vector of the spatiotemporal features to be detected; Indicates the u The predicted spatiotemporal features corresponding to the spatiotemporal features to be processed; Indicates the u The prototype contribution vector of the spatiotemporal features to be processed; represents the target prototype matrix; Calculate, according to a second preset formula, an anomaly score value of each of the spatiotemporal data to be detected based on each of the spatiotemporal features to be detected and its corresponding predicted spatiotemporal features and each of the spatiotemporal features to be processed and its corresponding predicted spatiotemporal features; The second preset formula is expressed as follows: ; in, Indicates the u Anomaly score value of the spatiotemporal data to be detected; Indicates the u spatiotemporal features to be detected; Indicates the u spatiotemporal features to be processed; If the anomaly score of the spatiotemporal data to be detected is greater than a preset threshold, the spatiotemporal data to be detected is determined to be abnormal; If the abnormality score value of the spatiotemporal data to be detected is less than or equal to a preset threshold, the spatiotemporal data to be detected is determined to be normal; and the spatiotemporal data to be detected is human traffic data.
8. An electronic device, characterized in that: The method comprises a processor and a memory, wherein the memory stores a computer program, and when the processor executes the computer program, the method according to any one of claims 1 to 6 is implemented.
9. A storage medium, characterized in that: The storage medium stores a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 6.