A data anomaly detection method, device, equipment and storage medium

Abstract

The application discloses a data anomaly detection method, device and equipment and a storage medium. The method comprises the following steps: inputting time series signal sample data into an initial data anomaly detection model; extracting features of the time series signal sample data through a feature extraction network in the initial data anomaly detection model to obtain a feature extraction result; performing parameter disturbance on the feature extraction network to obtain a feature extraction disturbance network; extracting features of the time series signal sample data through the feature extraction disturbance network to obtain a feature extraction disturbance result; inputting the feature extraction result into a feature fusion network and a reconstruction network in sequence to obtain a data reconstruction result; and adjusting network parameters of the initial data anomaly detection model according to a total loss function value calculated on the basis of the feature extraction result and the feature extraction disturbance result, the data reconstruction result and the time series signal sample data, so as to obtain a target data anomaly detection model, and improve feature representation and feature learning capability and generalization and adaptation capability of the model.

Description

Technical Field

[0001] This invention relates to the field of data detection technology, and in particular to a data anomaly detection method, apparatus, device, and storage medium. Background Technology

[0002] Cloud network status data refers to collected data that represents the usage and operational status of cloud network resources at a specific moment, such as network traffic uplink and downlink, CPU utilization, memory usage, packet loss rate, and network latency. Anomaly detection in cloud network status data is a typical example of time-series data anomaly detection. Time-series data anomaly detection is the process of identifying abnormal events or behaviors from normal time series data.

[0003] Traditional machine learning methods, such as statistical models, multivariate normal distribution models, and independent forests, can detect obvious outliers to some extent. However, they are sensitive to data noise and model each time series independently, making it difficult to address anomalies arising from interrelationships in multidimensional time series data. Furthermore, real-world time series data is characterized by high noise, large fluctuations, and significant environmental influences, making it difficult for traditional machine learning methods to meet the demands of complex scenarios.

[0004] Deep learning-based methods are increasingly being applied to anomaly detection in time-series data. Existing methods are based on recurrent neural networks (RNNs), convolutional neural networks (CNNs), and attention networks. While these methods can address the anomaly detection problem in time-series data to some extent, there is still significant room for improvement. For example, the limited size and lack of diversity of training data can easily lead to overfitting and poor model adaptability, resulting in low detection accuracy. Summary of the Invention

[0005] This invention provides a data anomaly detection method, apparatus, device, and storage medium to address the problem that existing deep learning-based time-series data anomaly detection models are prone to overfitting and have poor adaptability, resulting in low accuracy in anomaly detection.

[0006] According to one aspect of the present invention, a method for training a data anomaly detection model is provided, comprising:

[0007] The time-series signal sample data is input into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network;

[0008] The feature extraction network is used to extract features from the time-series signal sample data to obtain multiple feature extraction results.

[0009] The parameters of the feature extraction network are perturbed to obtain a feature extraction perturbation network based on a graph neural network; the feature extraction perturbation network is used to extract features from the time-series signal sample data to obtain multiple feature extraction perturbation results;

[0010] The multiple feature extraction results are input into the feature fusion network to obtain the feature fusion result; and the feature fusion result is input into the reconstruction network to obtain the data reconstruction result.

[0011] The total loss function value is calculated based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction results and the time-series signal sample data; and the network parameters in the initial data anomaly detection model are adjusted based on the total loss function value to obtain the target data anomaly detection model.

[0012] According to another aspect of the present invention, a data anomaly detection method is provided, comprising:

[0013] Obtain the status data of the cloud network to be tested;

[0014] The cloud network status data to be detected is input into the target data anomaly detection model trained using the data anomaly detection model training method to obtain the cloud network status data reconstruction result.

[0015] The data detection result of the cloud network status data to be detected is determined based on the reconstruction error between the cloud network status data to be detected and the reconstruction result of the cloud network status data.

[0016] According to another aspect of the present invention, a training apparatus for a data anomaly detection model is provided, comprising:

[0017] The input module is used to input time-series signal sample data into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network;

[0018] The feature extraction module is used to extract features from the time-series signal sample data through the feature extraction network to obtain multiple feature extraction results;

[0019] The feature extraction perturbation module is used to perturb the parameters of the feature extraction network to obtain a feature extraction perturbation network based on a graph neural network; and to extract features from the time-series signal sample data through the feature extraction perturbation network to obtain multiple feature extraction perturbation results.

[0020] The feature fusion module is used to input the multiple feature extraction results into the feature fusion network to obtain the feature fusion result; and to input the feature fusion result into the reconstruction network to obtain the data reconstruction result;

[0021] The parameter adjustment module is used to calculate the total loss function value based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction results and the time-series signal sample data; and to adjust the network parameters in the initial data anomaly detection model based on the total loss function value to obtain the target data anomaly detection model.

[0022] According to another aspect of the present invention, a data anomaly detection device is provided, comprising:

[0023] The data acquisition module is used to acquire the status data of the cloud network to be detected;

[0024] The data detection module is used to input the cloud network status data to be detected into the target data anomaly detection model trained by the training method of the above-mentioned data anomaly detection model, and obtain the cloud network status data reconstruction result.

[0025] The detection result determination module is used to determine the data detection result of the cloud network status data to be detected based on the reconstruction error between the cloud network status data to be detected and the reconstruction result of the cloud network status data.

[0026] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0027] At least one processor; and

[0028] A memory communicatively connected to the at least one processor; wherein,

[0029] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the training method or data anomaly detection method of the data anomaly detection model according to any embodiment of the present invention.

[0030] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the training method or data anomaly detection method of the data anomaly detection model according to any embodiment of the present invention.

[0031] This invention provides a training method for a data anomaly detection model. The method involves inputting time-series signal sample data into an initial data anomaly detection model. This initial model includes a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network. The feature extraction network extracts features from the time-series signal sample data, obtaining multiple feature extraction results. The parameters of the feature extraction network are perturbed to obtain a perturbed feature extraction network based on the graph neural network. The perturbed feature extraction network then extracts features from the time-series signal sample data, obtaining multiple perturbed feature extraction results. These multiple feature extraction results are input into the feature fusion network to obtain a feature fusion result. The feature fusion result is then input into the reconstruction network to obtain a data reconstruction result. A total loss function value is calculated based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple perturbed feature extraction results, as well as the reconstruction loss function value between the data reconstruction result and the time-series signal sample data. The network parameters in the initial data anomaly detection model are adjusted based on the total loss function value to obtain a target data anomaly detection model. By employing a contrastive learning method based on parameter perturbation, this approach addresses the issues of overfitting and poor adaptability in existing deep learning-based time-series anomaly detection models, which lead to low accuracy in anomaly detection. It avoids the damage to the intrinsic correlation features of data caused by changes in data characteristics resulting from data augmentation, thereby improving feature representation ability, feature learning ability, and the model's generalization and adaptability, and ultimately enhancing the accuracy of anomaly detection models in detecting anomalies.

[0032] The data anomaly detection method, the training device for the data anomaly detection model, the data anomaly detection device, the electronic device, and the computer-readable storage medium of the present invention also possess the aforementioned technical effects.

[0033] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0034] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0035] Figure 1 This is a flowchart of a training method for a data anomaly detection model provided in an embodiment of the present invention;

[0036] Figure 2This is a schematic diagram illustrating the principle of a training method for a data anomaly detection model provided in an embodiment of the present invention.

[0037] Figure 3 This is a flowchart of another training method for a data anomaly detection model provided in an embodiment of the present invention;

[0038] Figure 4 This is a schematic diagram of the feature extraction module in an initial data anomaly detection model provided in an embodiment of the present invention;

[0039] Figure 5 This is a schematic diagram of the feature extraction perturbation module in an initial data anomaly detection model provided in an embodiment of the present invention;

[0040] Figure 6 This is a flowchart of a data anomaly detection method provided in an embodiment of the present invention;

[0041] Figure 7 This is a schematic diagram of the structure of a target data anomaly detection model provided in an embodiment of the present invention;

[0042] Figure 8 This is a schematic diagram of the structure of a training device for a data anomaly detection model provided in an embodiment of the present invention;

[0043] Figure 9 This is a schematic diagram of the structure of a data anomaly detection device provided in an embodiment of the present invention;

[0044] Figure 10 This is a schematic diagram of the structure of an electronic device that implements the training method of the data anomaly detection model in this embodiment of the invention. Detailed Implementation

[0045] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0046] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0047] Deep learning-based methods are increasingly being applied to anomaly detection in time-series data. A common approach is sequence encoding based on recurrent neural networks (RNNs), combined with methods based on prediction, reconstruction, or data distribution distance to locate outliers. While RNNs have a natural advantage in processing time-series sequences, their limitations are also significant: they can only process data sequentially and cannot perform parallel computations, resulting in slow training and inference speeds.

[0048] The method based on recurrent neural networks and sequence reconstruction employs an LSTM (Laser-Structured Mechanism) for feature encoding and decoding, along with a Variational Autoencoder (VAE) architecture for feature encoding and decoding. This method is based on recurrent neural networks and uses reconstruction error for anomaly measurement. The main reasoning process is as follows: 1) Data preprocessing; 2) Inputting the image into a trained encoder network for feature extraction and encoding; 3) Inputting the encoded features into a decoder for decoding to reconstruct the signal at a specific time point; 4) Determining whether an anomaly is identified using a threshold judgment method.

[0049] Recurrent neural networks have a natural advantage in processing time-series sequences, but their disadvantages are also quite obvious, specifically:

[0050] (1) Due to the serial computation characteristics of recurrent neural networks, the training and inference speed of the model is relatively slow.

[0051] (2) It is easy to cause overfitting problems.

[0052] Overfitting encompasses not only poor generalization due to a lack of training data size and diversity, but also the problem of fitting abnormal samples to normal samples due to abnormal noise present in normal samples. This issue directly leads to misidentification during anomaly detection, such as: a) normal samples may be judged as abnormal due to poor generalization ability, and b) abnormal samples may not be detected because they are well-fitted, resulting in small reconstruction errors.

[0053] (3) The model has poor adaptability.

[0054] Because anomalies are inherently uncertain and come in many types, such as single-point anomalies, context-dependent anomalies, periodic anomalies, and trend anomalies, and because different anomaly types have different requirements for features and anomaly definitions, this method, which does not model the correlation between signals, struggles to utilize all anomaly types simultaneously, resulting in poor model adaptability and generalization ability.

[0055] (4) Poor model accuracy

[0056] This method fails to account for noise in the training data, which can interfere with reconstruction errors and thus affect detection performance. Secondly, the limited training data impacts the model's generalization ability, consequently affecting its accuracy. Thirdly, existing deep learning methods are insufficient at uncovering the relationships between data points, further compromising model accuracy. Furthermore, this method is also ineffective in handling concept drift.

[0057] Methods based on convolutional neural networks (CNNs) and attention networks have the advantage of parallel computing. Through optimization and improvement of their features, they can also be used to solve the problem of anomaly detection in time series data. Although these methods can solve the problem of anomaly detection in time series data to a certain extent, there are still three problems: (1) The problem of modeling the correlation between signals in multidimensional time series data. Some anomalies are reflected by the combined features of a series of signals. Therefore, it is necessary to model the relationship between signals to improve the stability and adaptability of the algorithm; (2) Due to the presence of noise in the training data (i.e., unlabeled anomaly data), the model can fit the anomaly data to a certain extent, resulting in poor discrimination of reconstruction error; (3) Due to the limited scale and lack of diversity of the training data, it is still easy to cause overfitting problem.

[0058] To address the aforementioned issues, this invention proposes a model training method based on a combination of graph neural networks and graph contrastive learning. This method utilizes a multi-dimensional graph neural network for feature learning and generates perturbation branches by perturbing the parameters of the feature extraction network. The extracted features from the perturbation branches are then compared and learned with those from the normal branches. This approach compensates for the negative impact of insufficient training data and reduces the risk of data augmentation methods damaging the internal features of the data, thereby further enhancing the model's feature representation ability, feature learning ability, generalization ability, and adaptability.

[0059] Example 1

[0060] Figure 1This is a flowchart of a training method for a data anomaly detection model provided in Embodiment 1 of the present invention. This embodiment is applicable to training an anomaly detection model for time-series data using deep learning methods, for detecting anomalies in time-series data. This method can be executed by a training device for the data anomaly detection model, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0061] S110. Input the time-series signal sample data into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network.

[0062] The initial anomaly detection model can be understood as an untrained or incompletely trained data anomaly detection model. Time-series signal sample data refers to time-series signals used as training samples. In this embodiment of the invention, the time-series signal may contain data from multiple signals at multiple times. Optionally, the time-series signal sample data can be obtained by: collecting time-series signals within a preset time period and preprocessing the time-series signals to obtain the time-series signal sample data. Preprocessing may include operations such as filtering, cleaning, and normalization. For example, the size of the time-series signal sample data is X = n × w, where n is the number of signals and w is the time window size.

[0063] In this embodiment, the initial data anomaly detection model sequentially includes: a graph neural network-based feature extraction network, a feature fusion network, and a reconstruction network. The graph neural network-based feature extraction network (GNN Module) is used to extract features from time-series signal sample data to obtain feature extraction results; whereby, a graph neural network (GNN) is a network that represents data based on a graph structure composed of nodes and edges. The feature fusion network is used to fuse the feature extraction results to obtain a feature fusion result. The reconstruction network is used to reconstruct the data based on the feature fusion result to obtain the data reconstruction result.

[0064] S120. Feature extraction is performed on time-series signal sample data through a feature extraction network to obtain multiple feature extraction results.

[0065] The feature extraction result refers to the output of the feature extraction network after feature extraction. Multiple feature extraction results can be represented by a matrix of the same dimension.

[0066] In the embodiments of the invention, after the time series signal sample data is input into the initial data anomaly detection model, the feature extraction network in the initial data anomaly detection model is first used to extract features from the time series signal sample data to obtain multiple feature extraction results output by the feature extraction network.

[0067] In an optional embodiment of this example, the graph neural network-based feature extraction network includes N graph neural network-based feature extraction modules connected in series, and the i-th feature extraction module outputs the i-th level feature extraction result; where i is an integer taken sequentially from [1, N].

[0068] Where i is an integer taken from [1, N], i.e. i = 1, 2, 3, ..., N.

[0069] In this embodiment of the invention, the feature extraction network includes N feature extraction modules connected in series. Time-series signal sample data is input into the feature extraction network, and features are extracted sequentially through the N feature extraction modules connected in series, resulting in N feature extraction results. The feature extraction result output by the i-th feature extraction module is the i-th level feature extraction result.

[0070] S130. Perturb the parameters of the feature extraction network to obtain a feature extraction perturbation network based on a graph neural network; extract features from time-series signal sample data through the feature extraction perturbation network to obtain multiple feature extraction perturbation results.

[0071] The Feature Extraction Disturbed Module (GNN) is a graph neural network-based network obtained by adding perturbations to the existing graph neural network-based feature extraction module (GNN). It is used to extract features from time-series signal sample data, obtaining perturbed feature extraction results that are compared with the original feature extraction results. The perturbed feature extraction results are obtained through feature extraction using the perturbed feature extraction network. Multiple perturbed feature extraction results can be represented using a matrix of the same dimensions as the original feature extraction results.

[0072] In this embodiment of the invention, the network parameters of the feature extraction network are randomly perturbed to obtain a feature extraction perturbation network corresponding to the feature extraction network. Time-series signal sample data is input into the feature extraction perturbation network, and features are extracted from the time-series signal sample data through the feature extraction perturbation network to obtain the feature extraction perturbation results output by the feature extraction perturbation network. It can be understood that multiple feature extraction perturbation results correspond one-to-one with multiple feature extraction results.

[0073] In an optional embodiment of this example, the feature extraction perturbation network based on graph neural network includes N graph neural network-based feature extraction perturbation modules connected in series, and the multiple feature extraction perturbation results include: the i-th feature extraction perturbation module outputs the i-th level feature extraction perturbation result; where i is an integer taken sequentially from [1, N].

[0074] In this embodiment of the invention, parameter perturbations are applied to the N feature extraction modules connected in series in the feature extraction network to obtain a feature extraction perturbation network. Therefore, the feature extraction perturbation network includes N graph neural network-based feature extraction perturbation modules connected in series, corresponding to the N graph neural network-based feature extraction modules. Time-series signal sample data is input into the feature extraction perturbation network, and feature extraction is performed sequentially through the N feature extraction perturbation modules connected in series in the feature extraction perturbation network to obtain N feature extraction perturbation results. The multiple feature extraction perturbation results include: the feature extraction perturbation result output by the i-th feature extraction perturbation module is the i-th level feature extraction perturbation result.

[0075] S140. Input the multiple feature extraction results into the feature fusion network to obtain the feature fusion result; and input the feature fusion result into the reconstruction network to obtain the data reconstruction result.

[0076] The feature fusion result is obtained by fusing the feature extraction results. The data reconstruction result is obtained by reconstructing data based on the feature fusion result. Optionally, the feature fusion network can perform feature fusion by adding feature matrices or stacking feature channels. For example, the feature fusion network can adopt an Encoder-Decoder fusion network structure. The reconstruction network can adopt a Transformer network structure, a fully connected network structure, or a recurrent neural network structure, etc. This embodiment of the invention does not limit the network structure of the feature fusion network and the reconstruction network.

[0077] In this embodiment of the invention, multiple feature extraction results output by the feature extraction network are respectively input into a feature fusion network; the feature fusion network performs feature fusion on the multiple feature extraction results to obtain a feature fusion result. The feature fusion result output by the feature fusion network is input into a reconstruction network; the reconstruction network performs data reconstruction on the feature fusion result to obtain a data reconstruction result.

[0078] In an optional implementation, since multiple feature extraction results can all be represented by matrices of the same dimension, the feature extraction results can be input into a feature fusion network to obtain a feature fusion result by adding multiple feature extraction results of the same dimension into a matrix in the feature fusion network.

[0079] S150. Calculate the total loss function value based on the total contrastive learning loss function value between multiple feature extraction results and multiple feature extraction perturbation results, as well as the reconstruction loss function value between the data reconstruction results and the time-series signal sample data; and adjust the network parameters in the initial data anomaly detection model based on the total loss function value to obtain the target data anomaly detection model.

[0080] The total contrastive learning loss function value is the sum of the loss values ​​obtained through contrastive learning between each feature extraction result and its corresponding feature extraction perturbation result. The reconstruction loss function value is the loss value calculated based on the reconstruction error between the reconstructed data and the time-series signal sample data; the total loss function value is the loss function value calculated based on the total contrastive learning loss function value and the reconstruction loss function value. Optionally, the contrastive learning loss function used in contrastive learning can be the standard InfoNCE loss; the reconstruction error loss function used in the reconstruction error calculation can be the standard Mean Squared Loss function.

[0081] In this embodiment, to address the problems of limited training data and poor model generalization ability, a multi-level contrastive learning method based on network parameter perturbation is provided. By performing multi-level contrastive learning on multiple feature extraction results output by the feature extraction network and multiple feature extraction perturbation results output by the parameter perturbation-based feature extraction perturbation network, the total contrastive learning loss function value is obtained. This method differs from traditional contrastive learning methods that employ data augmentation; it does not require data augmentation to generate new contrastive perspectives, thus avoiding the damage to the intrinsic correlation features of the data caused by changes in data characteristics resulting from data augmentation, and further improving feature representation ability, feature learning ability, and model generalization ability.

[0082] It should also be noted that the contrastive learning loss function value in this embodiment can be calculated using a graph-level method, that is, the feature extraction results output by each feature extraction module in the entire graph neural network are treated as a whole to determine positive and negative samples. Compared with the traditional node-level graph contrastive loss calculation method, the graph-level method can better preserve the internal correlation characteristics of the data.

[0083] In an optional embodiment of this example, the total loss function value is calculated based on the total contrastive learning loss function value between multiple feature extraction results and multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction result and the time-series signal sample data. This includes: weighting and summing the total contrastive learning loss function value and the reconstruction loss function value to obtain the total loss function value; wherein the sum of the weights corresponding to the total contrastive learning loss function value and the weights of the reconstruction loss function value is 1.

[0084] In another optional implementation of this embodiment, adjusting the network parameters in the initial data anomaly detection model based on the total loss function value to obtain the target data anomaly detection model includes: updating the network parameter weights through backpropagation based on the total loss function value; methods that can be used to update the network parameter weights include, but are not limited to, SGD, RMSProp, Adam, Nesterov Accelerated Gradient, or any combination of two or more of the above methods. If the network parameter weights reach the termination condition, the parameter training of that branch is terminated; the updated network parameter weights are saved to obtain the target data anomaly detection model. The termination condition may be: the number of times the network parameters are adjusted reaches the set total number of optimizations, or the total loss function value is less than a preset value. The entire training process of the initial data anomaly detection model can adopt an end-to-end unsupervised training method, with different stages and branches of the model being trained, updated, and terminated simultaneously.

[0085] Figure 2 This is a schematic diagram illustrating the principle of a training method for a data anomaly detection model provided in an embodiment of the present invention. For example... Figure 2 As shown, the technical solution of this embodiment of the invention involves inputting time-series signal sample data into an initial data anomaly detection model. The initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network. The feature extraction network extracts features from the time-series signal sample data to obtain multiple feature extraction results. The parameters of the feature extraction network are perturbed to obtain a graph neural network-based feature extraction perturbation network. The feature extraction perturbation network extracts features from the time-series signal sample data to obtain multiple feature extraction perturbation results. These multiple feature extraction results are input into the feature fusion network to obtain a feature fusion result. The feature fusion result is then input into the reconstruction network to obtain a data reconstruction result. A total loss function value is calculated based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, as well as the reconstruction loss function value between the data reconstruction result and the time-series signal sample data. The network parameters in the initial data anomaly detection model are adjusted based on the total loss function value to obtain a target data anomaly detection model. By employing a contrastive learning method based on parameter perturbation, the inherent correlation features of data caused by changes in data characteristics resulting from data augmentation are avoided. This improves the feature representation ability, feature learning ability, and the generalization and adaptability of the model, thereby enhancing the accuracy of the abnormal data detection model in detecting abnormal data.

[0086] Figure 3This is a flowchart illustrating a training method for a data anomaly detection model provided in an embodiment of the present invention. This embodiment further specifies the parameter perturbation process, the calculation process of the total loss function value, and the structure of the feature extraction network in the initial data anomaly detection model of the above embodiment. Figure 3 As shown, the method includes:

[0087] S210. Input the time-series signal sample data into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network.

[0088] S220. The time-series signal sample data is subjected to feature extraction by N feature extraction modules based on graph neural networks connected in series in the feature extraction network, and N feature extraction results are obtained. The N feature extraction results include: the i-th feature extraction module outputs the i-th level feature extraction result; i is an integer taken from [1, N].

[0089] In this embodiment, feature extraction is performed on time-series signal sample data by N graph neural network-based feature extraction modules connected in series in the feature extraction network to obtain N feature extraction results. This includes: inputting the time-series sample data into the first feature extraction module in the feature extraction network to obtain the first-level feature extraction result output by the first feature extraction module; inputting the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network into the (i+1)-th feature extraction module in the feature extraction network to obtain the (i+1)-th level feature extraction result output by the (i+1)-th feature extraction module, thereby obtaining N feature extraction results output by the feature extraction network.

[0090] In an optional embodiment of this example, Figure 4 This is a schematic diagram of the feature extraction module in an initial data anomaly detection model provided in an embodiment of the present invention, as shown below. Figure 4 As shown, the i-th feature extraction module based on graph neural networks includes: a cascaded signal-dimensional graph neural network layer and a time-dimensional graph neural network layer; wherein, the signal-dimensional graph neural network layer of the feature extraction module is used to perform graph neural network feature calculation in the signal dimension on the input data to obtain signal-dimensional features; wherein, when i=1, the input data is the time-series signal sample data; when 2≤i≤N, the input data is the (i-1)-th level feature extraction result output by the (i-1)-th graph neural network-based feature extraction module; the time-dimensional graph neural network layer of the feature extraction module is used to perform graph neural network feature calculation in the time dimension on the signal-dimensional features to obtain the i-th level feature extraction result.

[0091] The Inter-signal GNN layer is a graph neural network based on the signal dimension. It treats each signal in the data as a node and uses the data of that signal over a period of time as the node's features to form a graph with n nodes. The Temporal GNN layer is a graph neural network based on the time dimension. It treats the data of each signal at each time point as a node in the graph neural network and uses all the signal data at that time point as the features of that node to form a graph with w nodes.

[0092] Since multidimensional time-series signal data contains data from multiple signals at multiple times, the data contains two dimensions of information. The first dimension is the time dimension, where each signal is a time-series data sequence, and the data at different times in the sequence have temporal correlations; the second dimension is the signal dimension, because it is a multidimensional signal, multiple data will be generated at each time, each data corresponds to a signal, and there are also interrelated and interdependent relationships between different signals. Therefore, this embodiment of the invention provides a multidimensional graph neural network alternating feature representation method. Specifically, it is expressed as follows: (1) In the time dimension, a graph neural network layer is used to learn the temporal correlation features of the data; (2) In the signal dimension, a graph neural network layer is also used to learn the correlation features between signals; (3) Graph neural network layers in the signal dimension and the time dimension are alternately cascaded, and a graph neural network layer in the signal dimension is connected in series with a graph neural network layer in the time dimension to form a graph neural network-based feature extraction module, and then multiple such modules can be connected in series; (4) The feature extraction results of each graph neural network-based feature extraction module are fused to form the final feature extraction result, thereby improving the stability of model training. This method maximizes the extraction of deep patterns in the data and enhances the feature representation capability.

[0093] In this embodiment, inputting the time-series sample data into the first feature extraction module of the feature extraction network to obtain the first-level feature extraction result output by the first feature extraction module may include: inputting the time-series sample data into the signal dimension graph neural network layer of the first feature extraction module to obtain the first-level signal dimension graph neural network features obtained by the signal dimension graph neural network layer performing graph neural network feature calculation in the signal dimension; and inputting the first-level signal dimension graph neural network features into the time dimension graph neural network layer of the first feature extraction module to obtain the first-level feature extraction result obtained by the time dimension graph neural network layer performing graph neural network feature calculation in the time dimension.

[0094] Similarly, the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network is... Inputting the (i+1)th feature extraction module in the feature extraction network to obtain the (i+1)th level feature extraction result output by the (i+1)th feature extraction module may include: inputting the i-th level feature extraction result into the signal dimension graph neural network layer of the (i+1)th feature extraction module to obtain the (i+1)th level signal dimension graph neural network feature obtained by the signal dimension graph neural network layer performing graph neural network feature calculation in the signal dimension; inputting the (i+1)th level signal dimension graph neural network feature into the time dimension graph neural network layer of the (i+1)th feature extraction module to obtain the (i+1)th level feature extraction result obtained by the time dimension graph neural network layer performing graph neural network feature calculation in the time dimension.

[0095] S230. Using a normally distributed random perturbation sequence, the parameters of the i-th feature extraction module in the feature extraction network are perturbed to obtain the i-th feature extraction perturbation module in the feature extraction perturbation network.

[0096] In this embodiment, the i-th feature extraction perturbation module is obtained by perturbing the parameters of the i-th feature extraction module with a normally distributed random perturbation sequence.

[0097] S240. The time-series signal sample data is subjected to feature extraction by N feature extraction perturbation modules based on graph neural networks connected in series in the feature extraction perturbation network, and N feature extraction perturbation results are obtained. The N feature extraction perturbation results include: the i-th feature extraction perturbation module outputs the i-th level feature extraction perturbation result; where i is an integer taken from [1, N].

[0098] In this embodiment, feature extraction is performed on the time-series signal sample data by N feature extraction perturbation modules based on graph neural networks connected in series in the feature extraction perturbation network to obtain N feature extraction perturbation results. This includes: inputting the time-series sample data into the first feature extraction perturbation module in the feature extraction perturbation network to obtain the first-level feature extraction perturbation result output by the first feature extraction perturbation module; inputting the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network into the (i+1)-th feature extraction perturbation module in the feature extraction perturbation network to obtain the (i+1)-th level feature extraction perturbation result output by the (i+1)-th feature extraction perturbation module, thereby obtaining N feature extraction perturbation results output by the feature extraction perturbation network.

[0099] In an optional embodiment of this example, Figure 5This is a schematic diagram of the feature extraction perturbation module in an initial data anomaly detection model provided in an embodiment of the present invention, as shown below. Figure 5 As shown, the i-th feature extraction perturbation module based on graph neural networks includes: a cascaded signal-dimensional graph neural network perturbation layer and a time-dimensional graph neural network perturbation layer; wherein, the signal-dimensional graph neural network perturbation layer of the i-th feature extraction perturbation module is used to perform graph neural network perturbation feature calculation on the input data in the signal dimension to obtain the signal-dimensional features; wherein, when i=1, the input data is the time-series signal sample data; when 2≤i≤N, the input data is the (i-1)-th level feature extraction result output by the (i-1)-th graph neural network-based feature extraction module; the time-dimensional graph neural network perturbation layer of the feature extraction perturbation module is used to perform graph neural network perturbation feature calculation on the signal-dimensional features in the time dimension to obtain the i-th level feature extraction perturbation result.

[0100] In this embodiment, inputting the time-series sample data into the first feature extraction perturbation module in the feature extraction perturbation network to obtain the first-level feature extraction perturbation result output by the first feature extraction perturbation module includes: inputting the time-series sample data into the signal dimension graph neural network perturbation layer of the first feature extraction perturbation module to obtain the first-level signal dimension graph neural network perturbation feature calculated by the signal dimension graph neural network perturbation feature by the signal dimension graph neural network perturbation layer; and inputting the first-level signal dimension graph neural network perturbation feature into the time dimension graph neural network perturbation layer of the first feature extraction module to obtain the first-level feature extraction perturbation result calculated by the time dimension graph neural network perturbation feature by the time dimension graph neural network perturbation layer.

[0101] Similarly, inputting the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network into the (i+1)-th feature extraction perturbation module in the feature extraction network to obtain the (i+1)-th level feature extraction perturbation result output by the (i+1)-th feature extraction perturbation module includes: inputting the i-th level feature extraction result... Input the signal dimension graph neural network perturbation layer of the (i+1)th feature extraction perturbation module to obtain the (i+1)th level signal dimension graph neural network perturbation feature calculated by the signal dimension graph neural network perturbation feature of the signal dimension graph neural network perturbation layer; input the (i+1)th level signal dimension graph neural network perturbation feature into the time dimension graph neural network perturbation layer of the (i+1)th feature extraction perturbation module to obtain the (i+1)th level feature extraction perturbation result calculated by the time dimension graph neural network perturbation layer.

[0102] S250. Input multiple feature extraction results into the feature fusion network to obtain feature fusion results, and then input the feature fusion results into the reconstruction network to obtain data reconstruction results.

[0103] S260. Calculate the i-th level contrastive learning loss function value based on the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network and the i-th level feature extraction perturbation result output by the i-th level feature extraction perturbation module in the feature extraction perturbation network; and determine the sum of the contrastive learning loss function values ​​at each level as the total contrastive learning loss function value.

[0104] In this embodiment, the total contrastive learning loss function value can be:

[0105]

[0106] Among them, Loss Comparisons The total contrastive learning loss function value; Comparisons is the contrastive learning function; This represents the result of feature extraction at level i. This represents the perturbation result for the i-th level feature extraction.

[0107] S270. Calculate the reconstruction loss function value between the data reconstruction result and the time series signal sample data.

[0108] In this embodiment, the reconstruction loss function value can be:

[0109] Loss reconstruction =Mean_Square_Error(X,R);

[0110] Among them, Loss reconstruction The value of the reconstruction loss function is denoted as X; Mean_Square_Error is the mean square error function; X is the time series signal sample data; and R is the data reconstruction result.

[0111] S280. The total contrastive learning loss function value and the reconstruction loss function value are weighted and summed to obtain the total loss function value.

[0112] In this embodiment, the total loss function value is:

[0113] Loss total =αLoss Comparosons +βLoss reconstruction ;

[0114] Among them, Loss totalLet α be the total loss function value, β be the weight corresponding to the total contrastive learning loss function value, and α + β = 1. This embodiment of the invention does not impose restrictions on the specific values ​​of α and β, which can be determined according to the data characteristics of the actual application.

[0115] S290. Adjust the network parameters in the initial data anomaly detection model according to the total loss function value to obtain the target data anomaly detection model.

[0116] The technical solution of this invention trains a data anomaly detection model using a multi-level contrastive learning method with network parameter perturbation. It combines graph neural networks with graph contrastive learning, employing a multi-dimensional graph neural network for feature learning, thus enhancing feature representation capabilities. By perturbing the feature extraction network parameters to generate perturbed branches and comparing them with normal branches, it avoids the damage to the intrinsic correlation features of the data caused by changes in data characteristics resulting from data augmentation, thereby improving feature learning capabilities and the model's generalization and adaptability. Simultaneously, training the data anomaly detection model based on a multi-dimensional graph neural network with alternating feature representations maximizes the mining of deep data patterns, further improving feature representation capabilities, feature learning capabilities, and model stability. It also further enhances the accuracy of the data anomaly detection method based on the target data anomaly model.

[0117] Figure 6 This is a flowchart of a data anomaly detection method provided in an embodiment of the present invention. This embodiment is applicable to situations where an anomaly detection model obtained using the above-described data anomaly detection model training method is used to detect anomalies in the cloud network status data to be detected. This method can be executed by a data anomaly detection device, which can be implemented in hardware and / or software and can be configured in an electronic device. Figure 6 As shown, the method includes:

[0118] S310, Obtain the status data of the cloud network to be tested.

[0119] Among them, the cloud network status data to be detected refers to the cloud network status data that needs to be detected for abnormal data. The cloud network status data refers to the data collected that can represent the usage and operation status of cloud network resources at a certain moment.

[0120] In an optional embodiment of this example, cloud network status data is collected within a preset time period, and the cloud network status data is normalized to obtain the number of cloud network states to be detected, X' = n × w, where n is the number of signals and w is the size of the time window.

[0121] S320. Input the cloud network status data to be detected into the target data anomaly detection model trained using the above-mentioned data anomaly detection model training method, and obtain the cloud network status data reconstruction result.

[0122] The target data anomaly detection model is a complete model trained using the training method provided in this embodiment of the invention. The cloud network state data reconstruction result is the output of the target data anomaly detection model.

[0123] Figure 7 This is a schematic diagram of the structure of a target data anomaly detection model provided in an embodiment of the present invention. For example... Figure 7 As shown, in this embodiment, the target data anomaly detection model includes: a feature extraction network based on a graph neural network, a feature fusion network, and a reconstruction network. The cloud network state data to be detected is input into the target data anomaly detection model; the feature extraction network based on a graph neural network in the target data anomaly detection model extracts features from the time-series signal sample data to obtain multiple feature extraction results; the multiple feature extraction results are input into the feature fusion network to obtain a feature fusion result; and the feature fusion result is input into the reconstruction network to obtain the cloud network state data reconstruction result.

[0124] In an optional embodiment of this example, the graph neural network-based feature extraction network includes N graph neural network-based feature extraction modules connected in series; the multiple feature extraction results include: the i-th feature extraction module outputs the i-th level feature extraction result. The i-th graph neural network-based feature extraction module includes: a signal dimension graph neural network layer and a time dimension graph neural network layer connected in series; wherein, the signal dimension graph neural network layer of the i-th graph neural network-based feature extraction module is used to perform graph neural network feature calculation in the signal dimension on the input data to obtain signal dimension features; wherein, when i=1, the input data is the cloud network state data to be detected; when 2≤i≤N, the input data is the (i-1)-th level feature extraction result output by the (i-1)-th graph neural network-based feature extraction module; the time dimension graph neural network layer of the i-th graph neural network-based feature extraction module is used to perform graph neural network feature calculation in the time dimension on the signal dimension features to obtain the i-th level feature extraction result.

[0125] S330. Based on the reconstruction error between the cloud network status data to be detected and the reconstruction result of the cloud network status data, determine the data detection result of the cloud network status data to be detected.

[0126] The reconstruction error can be calculated using the standard mean squared loss function. Data detection results can indicate whether the data is normal or abnormal.

[0127] In this embodiment, an error calculation is performed on the cloud network status data to be detected and the cloud network status data reconstruction result to obtain a reconstruction error. Based on the reconstruction error, it is determined whether the cloud network status data to be detected is abnormal, and a data detection result is obtained. For example, if the reconstruction error is greater than a preset error threshold, the data detection result of the cloud network status data to be detected is determined to be abnormal; if the reconstruction error is less than or equal to the preset error threshold, the data detection result of the cloud network status data to be detected is determined to be normal.

[0128] The technical solution of this invention obtains cloud network status data to be detected; inputs the cloud network status data to be detected into a target data anomaly detection model trained using a data anomaly detection model training method to obtain cloud network status data reconstruction results; and determines the data detection results of the cloud network status data to be detected based on the reconstruction error between the cloud network status data to be detected and the cloud network status data reconstruction results, thereby improving the accuracy and stability of anomaly data detection.

[0129] Figure 8 This is a schematic diagram of the structure of a training device for a data anomaly detection model provided in an embodiment of the present invention. Figure 8 As shown, the device includes: an input module 410, a feature extraction module 420, a feature extraction perturbation module 430, a feature fusion module 440, and a parameter adjustment module 450; wherein,

[0130] The input module 410 is used to input time-series signal sample data into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network;

[0131] Feature extraction module 420 is used to extract features from the time-series signal sample data through the feature extraction network to obtain multiple feature extraction results;

[0132] The feature extraction perturbation module 430 is used to perturb the parameters of the feature extraction network to obtain a feature extraction perturbation network based on a graph neural network; and to extract features from the time-series signal sample data through the feature extraction perturbation network to obtain multiple feature extraction perturbation results.

[0133] The feature fusion module 440 is used to input the multiple feature extraction results into the feature fusion network to obtain the feature fusion result; and to input the feature fusion result into the reconstruction network to obtain the data reconstruction result;

[0134] The parameter adjustment module 450 is used to calculate the total loss function value based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction results and the time series signal sample data; and to adjust the network parameters in the initial data anomaly detection model based on the total loss function value to obtain the target data anomaly detection model.

[0135] The technical solution of this invention involves inputting time-series signal sample data into an initial data anomaly detection model. This initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network. The feature extraction network extracts features from the time-series signal sample data, obtaining multiple feature extraction results. The parameters of the feature extraction network are perturbed to obtain a graph neural network-based feature extraction perturbation network. The feature extraction perturbation network extracts features from the time-series signal sample data, obtaining multiple feature extraction perturbation results. These multiple feature extraction results are input into the feature fusion network to obtain a feature fusion result. The feature fusion result is then input into the reconstruction network to obtain a data reconstruction result. A total loss function value is calculated based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, as well as the reconstruction loss function value between the data reconstruction result and the time-series signal sample data. The network parameters in the initial data anomaly detection model are adjusted based on the total loss function value to obtain a target data anomaly detection model, thereby improving feature representation ability, feature learning ability, and the model's generalization and adaptability.

[0136] Based on the above embodiments, the graph neural network-based feature extraction network includes N graph neural network-based feature extraction modules connected in series, and the multiple feature extraction results include: the i-th feature extraction module outputs the i-th level feature extraction result;

[0137] The graph neural network-based feature extraction perturbation network includes N graph neural network-based feature extraction perturbation modules connected in series. The multiple feature extraction perturbation results include: the i-th feature extraction perturbation module outputs the i-th level feature extraction perturbation result; where i is an integer taken sequentially from [1, N].

[0138] Based on the above embodiments, the i-th feature extraction module based on graph neural networks includes: a cascaded signal dimension graph neural network layer and a time dimension graph neural network layer;

[0139] Wherein, the signal dimension graph neural network layer of the i-th graph neural network-based feature extraction module is used to perform graph neural network feature calculation on the input data in the signal dimension to obtain the features in the signal dimension; wherein, when i=1, the input data is the time-series signal sample data; when 2≤i≤N, the input data is the (i-1)-th level feature extraction result output by the (i-1)-th graph neural network-based feature extraction module;

[0140] The time-dimensional graph neural network layer of the i-th graph neural network-based feature extraction module is used to perform time-dimensional graph neural network feature calculation on the features of the signal dimension to obtain the i-th level feature extraction result.

[0141] Based on the above embodiments, the i-th feature extraction perturbation module is obtained by perturbing the parameters of the i-th feature extraction module with a normally distributed random perturbation sequence.

[0142] Based on the above embodiments, the parameter adjustment module 450 includes:

[0143] The contrastive learning loss calculation unit is used to calculate the i-th level contrastive learning loss function value based on the i-th level feature extraction result output by the i-th feature extraction module in the feature extraction network and the i-th level feature extraction perturbation result output by the i-th level feature extraction perturbation module in the feature extraction perturbation network;

[0144] The total contrastive learning loss calculation unit calculates the sum of the contrastive learning loss function values ​​at each level and determines it as the total contrastive learning loss function value.

[0145] A reconstruction loss calculation unit is used to calculate the reconstruction loss function value between the data reconstruction result and the time-series signal sample data;

[0146] The total loss calculation unit is used to perform a weighted summation of the total contrastive learning loss function value and the reconstruction loss function value to obtain the total loss function value.

[0147] The training device for the data anomaly detection model provided in this embodiment of the invention can execute the training method for the data anomaly detection model provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0148] Figure 9 This is a schematic diagram of the structure of a data anomaly detection device provided in an embodiment of the present invention. Figure 9 As shown, the device includes: a data acquisition module 510, a data detection module 520, and a detection result determination module 530; wherein,

[0149] Data acquisition module 510 is used to acquire the status data of the cloud network to be detected;

[0150] The data detection module 520 is used to input the cloud network status data to be detected into the target data anomaly detection model trained by the above-mentioned data anomaly detection model training method, and obtain the cloud network status data reconstruction result.

[0151] The detection result determination module 530 is used to determine the data detection result of the cloud network status data to be detected based on the reconstruction error between the cloud network status data to be detected and the reconstruction result of the cloud network status data.

[0152] The technical solution of this invention improves the accuracy and stability of abnormal data detection by acquiring the cloud network status data to be detected; inputting the cloud network status data to be detected into a target data anomaly detection model trained using a data anomaly detection model training method; and acquiring the data anomaly detection results output by the target data anomaly detection model.

[0153] Figure 10 A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0154] like Figure 10 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0155] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0156] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as training methods for data anomaly detection models or data anomaly detection methods.

[0157] In some embodiments, the training method for the data anomaly detection model or the data anomaly detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the training method for the data anomaly detection model or the data anomaly detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the training method for the data anomaly detection model or the data anomaly detection method by any other suitable means (e.g., by means of firmware).

[0158] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0159] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0160] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0161] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0162] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0163] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0164] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0165] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A training method for a data anomaly detection model, characterized in that, include: The time-series signal sample data is input into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network; the time-series signal sample data is cloud network state data; The feature extraction network is used to extract features from the time-series signal sample data to obtain multiple feature extraction results. The parameters of the feature extraction network are perturbed to obtain a feature extraction perturbation network based on a graph neural network; the feature extraction perturbation network is used to extract features from the time-series signal sample data to obtain multiple feature extraction perturbation results; The multiple feature extraction results are input into the feature fusion network to obtain the feature fusion result; and the feature fusion result is input into the reconstruction network to obtain the data reconstruction result. The total loss function value is calculated based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction results and the time-series signal sample data; and the network parameters in the initial data anomaly detection model are adjusted based on the total loss function value to obtain the target data anomaly detection model.

2. The method according to claim 1, characterized in that, The graph neural network-based feature extraction network comprises N graph neural network-based feature extraction modules connected in series, and the multiple feature extraction results include: the first... i The output of the first graph neural network-based feature extraction module is the first... i Level feature extraction results; The graph neural network-based feature extraction perturbation network comprises N cascaded graph neural network-based feature extraction perturbation modules, and the multiple feature extraction perturbation results include: the first... i The output of the feature extraction perturbation module is the first... i Level feature extraction perturbation results; among which, i It is an integer that takes values ​​sequentially from [1, N].

3. The method according to claim 2, characterized in that, No. i A graph neural network-based feature extraction module includes: a cascaded signal dimension graph neural network layer and a time dimension graph neural network layer; Among them, the first i The signal dimension graph neural network layer of the graph neural network-based feature extraction module is used to perform graph neural network feature calculation on the input data to obtain signal dimension features; among them, in i When = 1, the input data is the time-series signal sample data; when 2 ≤ i ≤ N, the input data is the first... i -1 The output of the feature extraction module based on graph neural network is the first i -1 level feature extraction results; The first i The temporal graph neural network layer of the graph neural network-based feature extraction module is used to perform temporal graph neural network feature calculation on the features of the signal dimension, to obtain the first... i Level feature extraction results.

4. The method according to any one of claims 2-3, characterized in that, The first i The first feature extraction perturbation module is composed of a normally distributed random perturbation sequence on the first feature extraction module. i The parameter perturbation is performed on a feature extraction module based on a graph neural network.

5. The method according to claim 1, characterized in that, The step of calculating the total loss function value based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction result and the time-series signal sample data, includes: According to the first in the feature extraction network i The output of the first feature extraction module based on graph neural network is the first... The first-level feature extraction result and the first-level feature extraction perturbation network i The output of the first feature extraction perturbation module is the... The calculation of the perturbation results of the first level feature extraction Level contrastive learning loss function value; The sum of the contrastive learning loss function values ​​at each level is determined as the total contrastive learning loss function value; Calculate the reconstruction loss function value between the data reconstruction result and the time-series signal sample data; The total loss function value is obtained by weighted summing of the total contrastive learning loss function value and the reconstruction loss function value.

6. A method for detecting data anomalies, characterized in that, include: Obtain the status data of the cloud network to be tested; The cloud network status data to be detected is input into the target data anomaly detection model trained using the training method of any one of the data anomaly detection models described in claims 1-5, and the cloud network status data reconstruction result is obtained. The data detection result of the cloud network status data to be detected is determined based on the reconstruction error between the cloud network status data to be detected and the reconstruction result of the cloud network status data.

7. A training device for a data anomaly detection model, characterized in that, include: The input module is used to input time-series signal sample data into the initial data anomaly detection model; wherein, the initial data anomaly detection model includes: a feature extraction network, a feature fusion network, and a reconstruction network based on a graph neural network; the time-series signal sample data is cloud network state data; The feature extraction module is used to extract features from the time-series signal sample data through the feature extraction network to obtain multiple feature extraction results; The feature extraction perturbation module is used to perturb the parameters of the feature extraction network to obtain a feature extraction perturbation network based on a graph neural network; and to extract features from the time-series signal sample data through the feature extraction perturbation network to obtain multiple feature extraction perturbation results. The feature fusion module is used to input the multiple feature extraction results into the feature fusion network to obtain the feature fusion result; and to input the feature fusion result into the reconstruction network to obtain the data reconstruction result; The parameter adjustment module is used to calculate the total loss function value based on the total contrastive learning loss function value between the multiple feature extraction results and the multiple feature extraction perturbation results, and the reconstruction loss function value between the data reconstruction results and the time-series signal sample data; and to adjust the network parameters in the initial data anomaly detection model based on the total loss function value to obtain the target data anomaly detection model.

8. A data anomaly detection device, characterized in that, include: The data acquisition module is used to acquire the status data of the cloud network to be detected; The data detection module is used to input the cloud network status data to be detected into the target data anomaly detection model trained by the training method of any one of the data anomaly detection models described in claims 1-5, and obtain the cloud network status data reconstruction result. The detection result determination module is used to determine the data detection result of the cloud network status data to be detected based on the reconstruction error between the cloud network status data to be detected and the reconstruction result of the cloud network status data.

9. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the training method of the data anomaly detection model according to any one of claims 1-5 or the data anomaly detection method according to claim 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the training method of the data anomaly detection model according to any one of claims 1-5 or the data anomaly detection method according to claim 6.

Images