A data set processing method, device and system

Abstract

Embodiments of the present application provide a kind of data set processing method, device and system.The method comprises: obtaining the validation set of unlabeled time series dataset;The validation set is annotated to abnormal point, and the first pseudo-label set of the validation set is obtained;Second pseudo-label set of the validation set is obtained based on the first pseudo-label set of the validation set;Determine the target pseudo-label set based on the first pseudo-label set and second pseudo-label set, and process initial detection model based on the target pseudo-label set, determine target detection model.The embodiments of the present application can automatically annotate time series data, obtain the data set with label, so as to realize the automation modeling of time series data anomaly detection, improve the accuracy of anomaly model for anomaly detection, reduce cost.

Description

A method, apparatus and system for processing datasets Technical Field

[0001] This invention relates to the field of big data processing, and in particular to a method, apparatus and system for processing datasets. Background Technology

[0002] With the digitalization of various fields, many sensor-equipped devices generate massive amounts of time data, forming time series. These time series data have wide applications, including network security monitoring, quantitative trading, autonomous vehicles, and large industrial equipment. In predictive maintenance, anomaly monitoring, and management within these fields, anomaly detection in time series data is essential for routine operations. Time series anomaly detection is the process of identifying abnormal events or behaviors within a normal time series. The granularity and scale of time series data vary greatly, making manual identification of anomalies laborious and difficult. Therefore, most anomaly detection algorithms are unsupervised, meaning they analyze data to identify relatively isolated points and treat them as anomalies. However, existing unsupervised anomaly detection algorithms have low accuracy. Supervised anomaly detection algorithms transform unsupervised tasks into semi-supervised or fully supervised tasks, requiring large amounts of labeled data and significant human resources. Therefore, existing time series anomaly detection algorithms suffer from low accuracy and high cost. Summary of the Invention

[0003] This invention provides a method, apparatus, and system for processing datasets, addressing the problems of low accuracy and high cost of existing time series anomaly detection algorithms.

[0004] To address the aforementioned technical problems, this invention provides a method for processing datasets, the method comprising:

[0005] Obtain the validation set of the unlabeled time series dataset;

[0006] Anomaly markers are added to the validation set to obtain the first pseudo-label set of the validation set;

[0007] A second pseudo-label set of the verification set is obtained based on the first pseudo-label set of the verification set;

[0008] The target pseudo-label set is determined based on the first pseudo-label set and the second pseudo-label set, and the initial detection model is processed based on the target pseudo-label set to determine the target detection model.

[0009] Optionally, in the above method, obtaining the second pseudo-label set of the verification set based on the first pseudo-label set of the verification set includes:

[0010] Randomly select target feature sequences to be processed from the verification set;

[0011] The target feature sequence to be processed is segmented to determine multiple segmented data spaces and time samples to be processed within each segmented data space;

[0012] Based on the first pseudo-label set, the unprocessed time samples in each segmented data space are processed to determine the second pseudo-label set of the verification set.

[0013] Optionally, in the above method, the target feature sequence to be processed is a time feature sequence of size V*K, where V and K are both positive integers;

[0014] The step of segmenting the target feature sequence to be processed, and determining multiple segmented data spaces and time samples to be processed within each segmented data space, includes:

[0015] Calculate the variance of each feature dimension in the K-dimensional data of the target feature sequence to be processed, and obtain the segmentation reference feature dimension;

[0016] Based on the segmentation reference feature dimension, the 1*K dimensional data corresponding to the V time samples in the target feature sequence to be processed is segmented into multiple segmented data spaces to obtain the multiple segmented data spaces and the time samples to be processed in each segmented data space.

[0017] Optionally, in the above method, the step of segmenting the 1*K-dimensional data corresponding to the V time samples in the target feature sequence to be processed into multiple segmented data spaces based on the segmentation reference feature dimension includes:

[0018] Sort the feature values ​​of the segmentation reference feature dimension;

[0019] Select the median of the sorted feature values ​​as the split point to divide the target feature sequence into two K-dimensional spaces;

[0020] Based on the target feature sequence to be processed corresponding to each K-dimensional space, the step of segmenting the target feature sequence to be processed is continued until the number of samples in each segmented K-dimensional space is not less than a first preset value; and / or the number of K-dimensional spaces obtained after segmentation is not less than a second preset value, wherein the target feature sequence to be processed corresponding to each K-dimensional space is a time feature sequence of size V*K.

[0021] Optionally, in the above method, the step of processing the unprocessed time samples in each segmented data space based on the first pseudo-label set to determine the second pseudo-label set of the validation set includes:

[0022] The feature data in the first pseudo-label set is compared with the time samples to be processed in each segmented data space to determine the label of at least one time sample to be processed in each segmented data space.

[0023] Randomly select the current target feature sequence from the verification set, determine the current target feature sequence as the current target feature sequence to be processed, and perform the step of segmenting the target feature sequence to be processed to obtain multiple currently segmented data spaces;

[0024] Repeat the above process until all feature sequences in the verification set have been selected, and / or the number of executions reaches a preset number, to determine the second pseudo-label set of the verification set.

[0025] Optionally, in the above method, determining the label of at least one time sample to be processed within each segmented data space includes:

[0026] Compare the unprocessed time samples in each segmented data space with the labeled samples in the first pseudo-label set to determine the time samples that are the same as the labeled samples in the first pseudo-label set in each segmented data space.

[0027] Based on the labels of the labeled samples, labels are determined for samples at the same time as the labeled samples, and the labels include normal and abnormal.

[0028] Optionally, in the above method, determining the second pseudo-label set of the verification set includes:

[0029] This statistic counts the number of time samples to be processed that are labeled as abnormal in each segmented data space. If the number of time samples to be processed that are labeled as abnormal in the target segmented data space exceeds a first preset threshold, the label of all time samples in the target segmented data space is set to abnormal.

[0030] Based on the data characteristics of the time samples to be processed, target time samples with the same data characteristics in multiple segmented data spaces are identified. If the number of target time samples with the label of "abnormal" exceeds a second preset threshold, the label of the target time samples to be processed is set to "abnormal".

[0031] Based on the labels of the time samples to be processed in each segmented data space, a second pseudo-label set of the validation set is determined.

[0032] This invention also provides a method for detecting timing anomalies, the method comprising:

[0033] Acquire multiple time-series data to be identified;

[0034] A target detection model is obtained by processing an initial detection model based on a target pseudo-label set, wherein the target pseudo-label set is determined based on a first pseudo-label set and a second pseudo-label set.

[0035] The target detection model is used to detect the multiple time-series data to be identified, and the detection results corresponding to the multiple time-series data to be identified are determined.

[0036] Based on the detection results, abnormal time series data are identified among the multiple time series data to be identified.

[0037] This invention also provides a dataset processing apparatus, the processing apparatus comprising:

[0038] The acquisition module is used to acquire the validation set of the unlabeled time series dataset;

[0039] The annotation module is used to annotate the validation set with outliers to obtain the first pseudo-label set of the validation set;

[0040] The obtaining module is used to obtain a second pseudo-label set of the verification set based on the first pseudo-label set of the verification set;

[0041] The determination module is used to determine the target pseudo-label set based on the first pseudo-label set and the second pseudo-label set, and to process the initial detection model based on the target pseudo-label set to determine the target detection model.

[0042] Optionally, in the above processing apparatus, the obtaining module includes:

[0043] The selection submodule is used to randomly select a target feature sequence to be processed from the verification set;

[0044] The segmentation submodule is used to segment the target feature sequence to be processed, and determine multiple segmented data spaces and time samples to be processed in each segmented data space;

[0045] The determination submodule is used to process the unprocessed time samples in each segmented data space based on the first pseudo-label set, and determine the second pseudo-label set of the verification set.

[0046] Optionally, in the above processing device, the target feature sequence to be processed is a time feature sequence of size V*K, where V and K are both positive integers;

[0047] The segmentation sub-module includes:

[0048] The calculation unit is used to calculate the variance of each feature dimension of the K-dimensional data in the target feature sequence to be processed, and to obtain the segmentation reference feature dimension;

[0049] The segmentation unit is used to segment the 1*K dimensional data corresponding to V time samples in the target feature sequence to be processed into multiple segmented data spaces based on the segmentation reference feature dimension, so as to obtain the multiple segmented data spaces and the time samples to be processed in each segmented data space.

[0050] Optionally, in the above processing apparatus, the segmentation unit is specifically used to perform:

[0051] Sort the feature values ​​of the segmentation reference feature dimension;

[0052] Select the median of the sorted feature values ​​as the split point to divide the target feature sequence into two K-dimensional spaces;

[0053] Based on the target feature sequence to be processed corresponding to each K-dimensional space, the step of segmenting the target feature sequence to be processed is continued until the number of samples in each segmented K-dimensional space is not less than a first preset value; and / or the number of K-dimensional spaces obtained after segmentation is not less than a second preset value, wherein the target feature sequence to be processed corresponding to each K-dimensional space is a time feature sequence of size V*K.

[0054] Optionally, in the above processing apparatus, the determining submodule includes:

[0055] The comparison unit is used to compare the feature data in the first pseudo-label set with the time samples to be processed in each segmented data space, and determine the label of at least one time sample to be processed in each segmented data space.

[0056] An iterative unit is used to select the current target feature sequence from the verification set, determine the current target feature sequence as the current target feature sequence to be processed, and perform the step of segmenting the target feature sequence to be processed to obtain multiple currently segmented data spaces;

[0057] A determining unit is used to repeat the above process until all feature sequences in the verification set are selected, and / or the number of executions reaches a preset number, to determine the second pseudo-label set of the verification set.

[0058] Optionally, in the above processing apparatus, the comparison unit is specifically used to perform:

[0059] Compare the unprocessed time samples in each segmented data space with the labeled samples in the first pseudo-label set to determine the time samples that are the same as the labeled samples in the first pseudo-label set in each segmented data space.

[0060] Based on the labels of the labeled samples, labels are determined for samples at the same time as the labeled samples, and the labels include normal and abnormal.

[0061] Optionally, in the above processing apparatus, the determining unit is specifically used to perform:

[0062] The number of unprocessed time samples labeled as abnormal in each segmented data space is counted. If the number of unprocessed time samples labeled as abnormal in the target segmented data space exceeds a first preset threshold, the label of all time samples in the target segmented data space is set as abnormal.

[0063] Based on the data characteristics of the time samples to be processed, target time samples with the same data characteristics in multiple segmented data spaces are identified. If the number of target time samples with the label of "abnormal" exceeds a second preset threshold, the label of the target time samples to be processed is set to "abnormal".

[0064] Based on the labels of the time samples to be processed in each segmented data space, a second pseudo-label set of the validation set is determined.

[0065] This invention also provides a device for detecting the timing anomaly, the device comprising:

[0066] The first acquisition module is used to acquire multiple time-series data to be identified;

[0067] The second acquisition module acquires a target detection model, which is obtained by processing an initial detection model based on a target pseudo-label set. The target pseudo-label set is determined based on a first pseudo-label set and a second pseudo-label set.

[0068] The detection module is used to detect the plurality of time-series data to be identified using the target detection model, and to determine the detection results corresponding to the plurality of time-series data to be identified.

[0069] The determination module is used to determine abnormal time-series data among the plurality of time-series data to be identified based on the detection results.

[0070] This invention also provides a dataset processing system, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the dataset processing method described above, or the steps of the timing anomaly detection method described above.

[0071] This invention also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the dataset processing method described above, or the steps of the timing anomaly detection method described above.

[0072] The embodiments of the present invention can automatically label time series data to obtain labeled datasets, thereby realizing automated modeling for anomaly detection in time series data. This greatly reduces the amount of labeled data required by existing supervised anomaly detection algorithms and saves a lot of manpower costs. In addition, it improves the accuracy of target detection models and accelerates the speed and deployment efficiency of automated training and iteration of target detection models in operation and maintenance, thereby reducing operation and maintenance costs. Attached Figure Description

[0073] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 is a flowchart of a dataset processing method provided in an embodiment of the present invention;

[0075] Figure 2 is a flowchart of a timing anomaly detection method provided by an embodiment of the present invention;

[0076] Figure 3 is a structural block diagram of a dataset processing device provided in an embodiment of the present invention;

[0077] Figure 4 is a structural block diagram of a timing anomaly detection device provided in an embodiment of the present invention;

[0078] Figure 5 is a structural block diagram of a dataset processing system provided in an embodiment of the present invention. Detailed Implementation

[0079] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0080] Referring to Figure 1, which is a flowchart of a dataset processing method provided in an embodiment of the present invention, the dataset processing method includes the following steps:

[0081] Step 101: Obtain the validation set of the unlabeled time series dataset.

[0082] In this context, a time series refers to the numerical values ​​of a statistical indicator of a phenomenon at different times, arranged chronologically. A value corresponding to a timestamp is considered a time sample. Unlabeled time series datasets can be generated during network security monitoring, or during quantitative trading, routine maintenance of autonomous vehicles, or large industrial equipment; this embodiment of the invention does not specifically limit this. Unlabeled time series datasets can contain text data, image data, or audio data, etc. Optionally, the method further includes: dividing the unlabeled time series dataset into a training set and a validation set based on chronological order. Specifically, to detect outliers in an unlabeled time series dataset of size T*M, the dataset needs to be first divided into a training set (TV)*M and a validation set V*M in chronological order. Here, T is the total number of timestamps in the unlabeled time series dataset, V is the number of timestamps in the validation set, and M is the number of feature variables; T, V, and M are all positive integers. Typically, the validation set accounts for 10%-40% of the original dataset, and the specific ratio can be set according to the application scenario.

[0083] Step 102: Anomaly labeling is performed on the verification set to obtain the first pseudo-label set of the verification set.

[0084] In this process, a temporal anomaly detection algorithm can be used to label anomalies in the validation set, resulting in a first pseudo-label set for the validation set. In some embodiments, the temporal anomaly detection algorithm includes, for example, iForest, 3-sigma, etc. To ensure the acquisition of highly accurate pseudo-labels, this embodiment uses a temporal anomaly detection algorithm such as iForest, 3-sigma, etc., to automatically label anomalies in the validation set obtained in step 101, thereby obtaining a first pseudo-label set for the validation set, where normal points are marked as 0 and anomalies as 1. Thus, the obtained first pseudo-label set includes labeled samples with either anomaly or normal labels. Optionally, to improve the accuracy of anomaly labeling, the first pseudo-label set for the validation set can be determined during the automatic labeling process by using methods such as increasing model confidence or multi-model prediction voting.

[0085] Step 103: Obtain the second pseudo-label set of the verification set based on the first pseudo-label set of the verification set.

[0086] In this embodiment of the application, the validation set obtained in step 101 is used to search for the nearest neighbor features of abnormal samples in the validation set to obtain a second pseudo-label set of the validation set. The nearest neighbor features of the abnormal samples are actually time feature sequences in the validation set that are similar to or close to the features of the abnormal samples.

[0087] Optionally, step 103 of obtaining the second pseudo-label set of the verification set based on the first pseudo-label set of the verification set includes:

[0088] Select the target feature sequence to be processed from the verification set;

[0089] The target feature sequence to be processed is segmented to determine multiple segmented data spaces and time samples to be processed within each segmented data space;

[0090] Based on the first pseudo-label set, the time samples to be processed in each segmented data space are processed to determine the second pseudo-label set of the verification set.

[0091] Specifically, by randomly selecting a target feature sequence to be processed from the verification set obtained in step 101 and analyzing the target feature sequence, multiple segmented data spaces are obtained. Each segmented data space includes multiple nearest neighbor feature samples of the time sample to be processed. Based on the labeled samples marked as abnormal in the first pseudo-label set of the verification set, abnormal time samples to be processed in each segmented data space are determined, and these abnormalities are marked to obtain the second pseudo-label set of the verification set. In some examples, normal time samples to be processed may be marked as 0, and abnormal time samples to be processed may be marked as 1. This embodiment of the application does not limit this.

[0092] Optionally, the target feature sequence to be processed is a time feature sequence of size V*K, where V and K are both positive integers; usually K is less than M, and M is the number of feature variables.

[0093] The step of segmenting the target feature sequence to be processed, and determining multiple segmented data spaces and time samples to be processed within each segmented data space, includes:

[0094] Calculate the variance of each feature dimension in the K-dimensional data of the target feature sequence to be processed, and obtain the segmentation reference feature dimension;

[0095] Based on the cut reference feature dimension, the 1*K dimensional data corresponding to the V time samples in the target feature sequence to be processed is divided into multiple segmented data spaces to obtain the multiple segmented data spaces and the time samples to be processed in each segmented data space.

[0096] Among them, the step of dividing the 1*K-dimensional data corresponding to V time samples in the to-be-processed target feature sequence into multiple divided data spaces based on the divided reference feature dimension includes:

[0097] Sort the feature values of the divided reference feature dimension;

[0098] Select the feature median from the sorted feature values as the division point, and divide the to-be-processed target feature sequence into two K-dimensional spaces;

[0099] Based on the to-be-processed target feature sequence corresponding to each K-dimensional space, continue to execute the step of dividing the to-be-processed target feature sequence; until the number of samples in each divided K-dimensional space is not less than the first preset value; and / or the number of K-dimensional spaces obtained after division is not less than the second preset value, where the to-be-processed target feature sequence corresponding to each K-dimensional space is a time feature sequence of V*K dimension size.

[0100] Specifically, randomly select K feature indices from the M features of the validation set, and obtain a feature sequence of size V*K according to the feature indices; it should be noted that K<M, and K, V, and M are all positive integers. It should be noted that different K features are randomly selected in each iteration, which can not only reduce the amount of data to be processed and accelerate the operation, but also evaluate the correlation relationship between different features. Analyze the time feature sequence of V*K dimension size from the dimensions of time and space, divide the 1*K-dimensional data corresponding to V time samples into multiple data spaces, and each data space includes corresponding multiple neighbor feature samples. Calculate the variance of each feature dimension in the K-dimensional data, select the feature dimension with the largest variance as the divided reference feature dimension, sort the time samples in the to-be-processed target feature sequence according to the feature values in the divided reference feature dimension, select the feature corresponding to the feature median in the divided reference feature dimension as the reference point, and perform space division based on this reference point to obtain 2 K-dimensional data spaces; repeat the above operation, and continue to divide each K-dimensional data space until the division stop condition is met, and then stop the division, so as to obtain multiple data spaces. In some embodiments, the division stop condition includes: the number of samples in each divided K-dimensional data space is not less than the first preset value; and / or the number of K-dimensional data spaces obtained after division is not less than the second preset value.

[0101] Optionally, considering the time correlation of adjacent samples in the time series data, a time window t can be set. Taking each sample as the time center, the t*K-dimensional data corresponding to each time sample is obtained, and the mean value is taken in the time direction to obtain the mean value of the sample within time t, that is, the size is 1*K dimension. If t = 1, each time sample is itself.

[0102] Optionally, the step of processing the unprocessed time samples in each segmented data space based on the first pseudo-label set to determine the second pseudo-label set of the validation set includes:

[0103] The feature data in the first pseudo-label set is compared with the time samples to be processed in each segmented data space to determine the label of at least one time sample to be processed in each segmented data space.

[0104] Select the current target feature sequence from the verification set, determine the current target feature sequence as the current target feature sequence to be processed, and perform the step of segmenting the target feature sequence to be processed to obtain multiple currently segmented data spaces;

[0105] Repeat the above process until all feature sequences in the validation set have been selected, and / or the number of executions reaches a preset number, to determine the label of the time sample to be processed in each segmented data space and the second pseudo-label set of the validation set.

[0106] Specifically, the time samples corresponding to the feature data in the first pseudo-label set are compared with the time samples to be processed in each segmented data space. Based on the comparison results, at least one time sample to be processed in each segmented data space is determined to be a normal or abnormal label. The current target feature sequence is then randomly selected from the validation set and designated as the current target feature sequence to be processed. The step of segmenting the target feature sequence to be processed is then performed to obtain multiple currently segmented data spaces. This process is repeated until all feature sequences in the validation set have been randomly selected, and / or the number of executions reaches a preset number, thus determining the second pseudo-label set of the validation set.

[0107] Optionally, determining the label of at least one time sample to be processed within each segmented data space includes:

[0108] Compare the unprocessed time samples in each segmented data space with the labeled samples in the first pseudo-label set to determine the time samples that are the same as the labeled samples in the first pseudo-label set in each segmented data space.

[0109] Based on the labels of the labeled samples, labels are determined for samples occurring at the same time as the labeled samples. These labels include "normal" and "abnormal". "Normal" is represented by "0", and "abnormal" is represented by "1".

[0110] Specifically, the unprocessed time samples in each segmented data space are compared with the labeled samples in the first pseudo-label set. The unprocessed time samples in each segmented data space that are the same as the labeled samples in the first pseudo-label set are determined. If the label of the labeled sample is abnormal, the label of the time sample that is the same as the labeled sample is determined to be abnormal. If the label of the labeled sample is normal, the label of the time sample that is the same as the labeled sample is determined to be normal.

[0111] Optionally, determining the second pseudo-label set of the verification set includes:

[0112] The number of unprocessed time samples labeled as abnormal in each segmented data space is counted. If the number of unprocessed time samples labeled as abnormal in the target segmented data space exceeds a first preset threshold, the label of all time samples in the target segmented data space is set as abnormal.

[0113] Based on the data characteristics of the time samples to be processed, target time samples with the same data characteristics in multiple segmented data spaces are identified. If the number of target time samples with the label of "abnormal" exceeds a second preset threshold, the label of the target time samples to be processed is set to "abnormal".

[0114] Based on the labels of the time samples to be processed in each segmented data space, a second pseudo-label set of the validation set is determined.

[0115] Specifically, the number of unprocessed time samples labeled as anomalous in each segmented data space is counted. If the number of unprocessed time samples labeled as anomalous in the target segmented data space exceeds a first preset threshold, the labels of all time samples in the target segmented data space are temporarily set to anomalous. If the number of unprocessed time samples labeled as anomalous in the target segmented data space does not exceed the first preset threshold, only the unprocessed time samples labeled as anomalous in the target segmented data space are considered anomalous time samples. Based on the data characteristics of the unprocessed time samples, target unprocessed time samples with the same data characteristics in multiple segmented data spaces are identified. If the number of target unprocessed time samples labeled as anomalous exceeds a second preset threshold, the labels of the target unprocessed time samples are finally set to anomalous. The second pseudo-label set of the validation set is obtained based on the unprocessed time samples ultimately labeled as anomalous in each segmented data space. It should be noted that different first and second thresholds can be set according to different application scenarios to adjust and expand the detection range of the target detection model for anomalies. The specific values ​​of the first and second thresholds are not limited in this embodiment. For example, when detecting financial risks, it's necessary to find as many high-risk samples as possible as early as possible. In this case, the threshold should be lowered to eliminate any possibility. Conversely, when detecting anomalies in test system logs, once the main anomaly is identified, other issues can usually be resolved. In this case, the threshold should be raised to find the most likely anomaly.

[0116] Step 104: Determine the target pseudo-label set based on the first pseudo-label set and the second pseudo-label set, and process the initial detection model based on the target pseudo-label set to determine the target detection model.

[0117] Specifically, the union of the obtained first and second pseudo-labels can be used as the target pseudo-label set for the validation set. Based on this target pseudo-label set and the training set, the initial detection model (e.g., an unsupervised anomaly detection model) is trained and optimized to obtain a more accurate target detection model. Alternatively, based on the target pseudo-label set, an evaluation strategy (e.g., an evolutionary algorithm) can be used to select a model from the initial detection model to obtain a superior target detection model. The target detection model can be a trained model or an evaluated model to be deployed. Using this target detection model (e.g., an automated unsupervised anomaly detection model) to detect multiple unlabeled time-series data sets can yield detection results.

[0118] The embodiments of the present invention can automatically label time series data to obtain labeled datasets, thereby realizing automated modeling for anomaly detection in time series data. This greatly reduces the amount of labeled data required by existing supervised anomaly detection algorithms and saves a lot of manpower costs. In addition, it improves the accuracy of target detection models and can accelerate the speed and deployment efficiency of automated training iteration of target detection models in operation and maintenance, thereby reducing operation and maintenance costs.

[0119] Referring to Figure 2, which is a flowchart of a timing anomaly detection method provided by an embodiment of the present invention, the method includes the following steps:

[0120] Step 201: Obtain multiple time-series data to be identified;

[0121] Step 202: Obtain the target detection model, which is obtained by processing the initial detection model based on the target pseudo-label set, and the target pseudo-label set is determined based on the first pseudo-label set and the second pseudo-label set;

[0122] Step 203: Detect the multiple time-series data to be identified using the target detection model, and determine the detection results corresponding to the multiple time-series data to be identified;

[0123] Step 204: Based on the detection results, identify the abnormal time series data among the multiple time series data to be identified.

[0124] Specifically, this embodiment of the invention is a specific application of an embodiment of the above-mentioned dataset processing method. Multiple time-series data to be identified are acquired. These time-series data may contain text, images, or speech data, etc. A target detection model determined in the embodiment of the above-mentioned dataset processing method is acquired. In some embodiments, the target detection model can be obtained based on the dataset processing method provided in this embodiment of the invention, which will not be elaborated here. The target detection model is obtained by processing an initial detection model based on a target pseudo-label set, which is determined based on a first pseudo-label set and a second pseudo-label set. The target detection model is used to detect the multiple time-series data to be identified, and anomaly detection results corresponding to the multiple time-series data to be identified are determined. Based on the anomaly detection results, abnormal time-series data among the multiple time-series data to be identified are determined, thereby improving the accuracy of the target detection model.

[0125] Based on the dataset processing method provided in the above embodiments, this embodiment of the invention also provides a dataset processing apparatus for implementing the above method. Referring to Figure 3, this embodiment of the invention provides a dataset processing apparatus 300, which includes:

[0126] Module 301 is used to obtain the validation set of the unlabeled time series dataset;

[0127] The annotation module 302 is used to annotate the verification set with outliers to obtain the first pseudo-label set of the verification set;

[0128] The obtaining module 303 is used to obtain a second pseudo-label set of the verification set based on the first pseudo-label set of the verification set;

[0129] The determination module 304 is used to determine a target pseudo-label set based on the first pseudo-label set and the second pseudo-label set, and to process the initial detection model based on the target pseudo-label set to determine the target detection model.

[0130] Optionally, the obtaining module 303 includes:

[0131] The selection submodule is used to randomly select a target feature sequence to be processed from the verification set;

[0132] The segmentation submodule is used to segment the target feature sequence to be processed, and determine multiple segmented data spaces and time samples to be processed in each segmented data space;

[0133] The determination submodule is used to process the unprocessed time samples in each segmented data space based on the first pseudo-label set, and determine the second pseudo-label set of the verification set.

[0134] Optionally, the target feature sequence to be processed is a time feature sequence of size V*K, where V and K are both positive integers;

[0135] The segmentation sub-module includes:

[0136] The calculation unit is used to calculate the variance of each feature dimension of the K-dimensional data in the target feature sequence to be processed, and to obtain the segmentation reference feature dimension;

[0137] The segmentation unit is used to segment the 1*K dimensional data corresponding to V time samples in the target feature sequence to be processed into multiple segmented data spaces based on the segmentation reference feature dimension, so as to obtain the multiple segmented data spaces and the time samples to be processed in each segmented data space.

[0138] Optionally, the segmentation unit is specifically used to perform:

[0139] Sort the feature values ​​of the segmentation reference feature dimension;

[0140] Select the median of the sorted feature values ​​as the split point to divide the target feature sequence into two K-dimensional spaces;

[0141] Based on the target feature sequence to be processed corresponding to each K-dimensional space, the step of segmenting the target feature sequence to be processed is continued until the number of samples in each segmented K-dimensional space is not less than a first preset value; and / or the number of K-dimensional spaces obtained after segmentation is not less than a second preset value, wherein the target feature sequence to be processed corresponding to each K-dimensional space is a time feature sequence of size V*K.

[0142] Optionally, the determining submodule includes:

[0143] The comparison unit is used to compare the feature data in the first pseudo-label set with the time samples to be processed in each segmented data space, and determine the label of at least one time sample to be processed in each segmented data space.

[0144] An iterative unit is used to randomly select the current target feature sequence from the verification set, determine the current target feature sequence as the current target feature sequence to be processed, and perform the step of segmenting the target feature sequence to be processed to obtain multiple currently segmented data spaces;

[0145] A determination unit is used to repeat the above process until all feature sequences in the verification set are selected, and / or the number of executions reaches a preset number, to determine the label of the time sample to be processed in each segmented data space and the second pseudo-label set of the verification set.

[0146] Optionally, the comparison unit is specifically used to perform:

[0147] Compare the unprocessed time samples in each segmented data space with the labeled samples in the first pseudo-label set to determine the time samples that are the same as the labeled samples in the first pseudo-label set in each segmented data space.

[0148] Based on the labels of the labeled samples, labels are determined for samples at the same time as the labeled samples, and the labels include normal and abnormal.

[0149] Optionally, the determining unit is specifically used to perform:

[0150] The number of unprocessed time samples labeled as abnormal in each segmented data space is counted. If the number of unprocessed time samples labeled as abnormal in the target segmented data space exceeds a first preset threshold, the label of all time samples in the target segmented data space is set as abnormal.

[0151] Based on the data characteristics of the time samples to be processed, target time samples with the same data characteristics in multiple segmented data spaces are identified. If the number of target time samples with the label of "abnormal" exceeds a second preset threshold, the label of the target time samples to be processed is set to "abnormal".

[0152] Based on the labels of the time samples to be processed in each segmented data space, a second pseudo-label set of the validation set is determined.

[0153] Based on the timing anomaly detection method provided in the above embodiments, this embodiment of the invention also provides a timing anomaly detection device for implementing the above method. Referring to Figure 4, this embodiment of the invention provides a timing anomaly detection device 400, which includes:

[0154] The first acquisition module 401 is used to acquire multiple time-series data to be identified;

[0155] The second acquisition module 402 acquires a target detection model, which is obtained by processing an initial detection model based on a target pseudo-label set, and the target pseudo-label set is determined based on a first pseudo-label set and a second pseudo-label set.

[0156] The detection module 403 is used to detect the plurality of time-series data to be identified through the target detection model, and determine the detection results corresponding to the plurality of time-series data to be identified;

[0157] The determination module 404 is used to determine abnormal time series data among the plurality of time series data to be identified based on the detection results.

[0158] Based on the dataset processing methods provided in the above embodiments, and referring to FIG5, an embodiment of the present invention provides a dataset processing system 500, which includes a processor 501 and a memory 502. The implementation methods in the above embodiments are all applicable to the embodiments of this dataset processing system and can achieve the same technical effects.

[0159] This invention also provides a dataset processing system, including a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the dataset processing method as described in the above embodiments, or implements the steps of the timing anomaly detection method as described in the above embodiments.

[0160] This invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the dataset processing method described in the above embodiments, or the steps of the timing anomaly detection method described in the above embodiments.

[0161] This invention also provides a readable storage medium storing a computer program. When executed by a processor, this computer program implements the various processes of the above-described dataset processing method embodiment or timing anomaly detection method embodiment, achieving the same technical effect. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk, etc.

[0162] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0163] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0164] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for processing a dataset, characterized in that, The method includes: obtaining a validation set of an unlabeled time series dataset; labeling outliers on the validation set to obtain a first pseudo-label set of the validation set; obtaining a second pseudo-label set of the validation set based on the first pseudo-label set; determining a target pseudo-label set based on the first and second pseudo-label sets, and processing an initial detection model based on the target pseudo-label set to determine a target detection model; the step of obtaining the second pseudo-label set of the validation set based on the first pseudo-label set includes: selecting a target feature sequence to be processed from the validation set; segmenting the target feature sequence to be processed to determine multiple segmented data spaces and time samples to be processed within each segmented data space; and processing each segmented data space based on the first pseudo-label set. The unprocessed time samples in the segmented data space are processed to determine the second pseudo-label set of the validation set; the unprocessed target feature sequence is a V*K dimensional time feature sequence, where V and K are both positive integers; the segmentation of the unprocessed target feature sequence to determine multiple segmented data spaces and unprocessed time samples in each segmented data space includes: calculating the variance of each feature dimension of the K-dimensional data in the unprocessed target feature sequence to obtain the segmentation reference feature dimension; based on the segmentation reference feature dimension, the 1*K dimensional data corresponding to the V time samples in the unprocessed target feature sequence are segmented into multiple segmented data spaces to obtain the multiple segmented data spaces and unprocessed time samples in each segmented data space.

2. The processing method according to claim 1, characterized in that, The step of segmenting the 1*K dimensional data corresponding to V time samples in the target feature sequence to be processed into multiple segmented data spaces based on the segmentation reference feature dimension includes: sorting the feature values ​​of the segmentation reference feature dimension; selecting the median of the features from the sorted feature values ​​as the segmentation point to segment the target feature sequence to be processed into two K-dimensional spaces; continuing to perform the step of segmenting the target feature sequence to be processed based on the target feature sequence to be processed corresponding to each K-dimensional space; until the number of samples in each segmented K-dimensional space is not less than a first preset value; and / or the number of K-dimensional spaces obtained after segmentation is not less than a second preset value, wherein the target feature sequence to be processed corresponding to each K-dimensional space is a time feature sequence of size V*K.

3. The processing method according to any one of claims 1-2, characterized in that, The step of processing the unprocessed time samples in each segmented data space based on the first pseudo-label set to determine the second pseudo-label set of the verification set includes: comparing the feature data in the first pseudo-label set with the unprocessed time samples in each segmented data space to determine the label of at least one unprocessed time sample in each segmented data space; randomly selecting the current target feature sequence from the verification set, determining the current target feature sequence as the current unprocessed target feature sequence, and performing the step of segmenting the unprocessed target feature sequence to obtain multiple currently segmented data spaces; repeating the above process until all feature sequences in the verification set are selected, and / or the number of executions reaches a preset number, to determine the second pseudo-label set of the verification set.

4. The processing method according to claim 3, characterized in that, The step of determining the label of at least one time sample to be processed in each segmented data space includes: comparing the time sample to be processed in each segmented data space with the labeled samples in the first pseudo-label set, and determining the time sample in each segmented data space that is the same as the labeled sample in the first pseudo-label set; determining the label of the time sample that is the same as the labeled sample based on the label of the labeled sample, wherein the label includes normal and abnormal.

5. The processing method according to claim 4, characterized in that, The step of determining the second pseudo-label set of the verification set includes: counting the number of unprocessed time samples labeled as anomalous in each segmented data space; if the number of unprocessed time samples labeled as anomalous in the target segmented data space exceeds a first preset threshold, setting the label of all time samples in the target segmented data space as anomalous; based on the data characteristics of the unprocessed time samples, determining target unprocessed time samples with the same data characteristics in multiple segmented data spaces; if the number of target unprocessed time samples labeled as anomalous exceeds a second preset threshold, setting the label of the target unprocessed time samples as anomalous; and determining the second pseudo-label set of the verification set based on the labels of the unprocessed time samples in each segmented data space.

6. A dataset processing apparatus, characterized in that, The apparatus includes: an acquisition module for acquiring a validation set of an unlabeled time series dataset; an annotation module for annotating the validation set with outliers to obtain a first pseudo-label set of the validation set; an acquisition module for obtaining a second pseudo-label set of the validation set based on the first pseudo-label set; and a determination module for determining a target pseudo-label set based on the first and second pseudo-label sets, and processing an initial detection model based on the target pseudo-label set to determine a target detection model. The acquisition module includes: a selection submodule for randomly selecting a target feature sequence to be processed from the validation set; and a segmentation submodule for segmenting the target feature sequence to be processed, determining multiple segmented data spaces and the data within each segmented data space. The data includes: a time sample to be processed; a determination submodule, used to process the time sample to be processed in each segmented data space based on the first pseudo-label set, and determine the second pseudo-label set of the validation set; the target feature sequence to be processed is a time feature sequence of size V*K, where V and K are both positive integers; the segmentation submodule includes: a calculation unit, used to calculate the variance of each feature dimension of the K-dimensional data in the target feature sequence to be processed, to obtain the segmentation reference feature dimension; and a segmentation unit, used to segment the 1*K-dimensional data corresponding to the V time samples in the target feature sequence to be processed into multiple segmented data spaces based on the segmentation reference feature dimension, to obtain the multiple segmented data spaces and the time sample to be processed in each segmented data space.

7. A dataset processing system, characterized in that, It includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the data set processing method as described in any one of claims 1 to 5.

Images