A data detection method and apparatus, an electronic device, and a storage medium

Abstract

The application provides a data detection method and device, electronic equipment and storage medium. The method comprises: obtaining to-be-detected data; determining whether the to-be-detected data is abnormal based on an intelligent engine according to the to-be-detected data, and optimizing the to-be-detected data that is abnormal; wherein the intelligent engine determines first data and second data according to sequence information of the to-be-detected data; the intelligent engine determines first abnormal data in the first data based on abnormal basic data; and the intelligent engine determines second abnormal data in the second data based on abnormal processing data. The embodiment of the application uses supervised end-to-end abnormal detection to directly obtain the probability of the detection target, thereby reducing the step of determining the abnormality through clustering or threshold mode after the unsupervised model is trained.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data detection method, apparatus, electronic device, and storage medium. Background Technology

[0002] Anomaly detection refers to the technology of identifying anomalous data through data mining, machine learning, or deep learning. This technology has been applied across various industries, such as fraudulent lending in finance, hacking in security, product defect detection in industry, and malicious buyer groups in e-commerce. Currently, anomaly detection methods include statistical methods, data mining algorithm-based methods, and deep learning methods based on autoencoders. Statistical methods rely on the experience of business personnel, which is limited and not easily replicated, making them effective only for specific business scenarios. Data mining algorithm-based methods rely on large amounts of feature data, failing to address data sparsity, exhibiting poor model generalization ability, high time complexity, and low computational efficiency. Deep learning methods based on autoencoders require normal data for model training and cannot solve the end-to-end model training problem for multiple issues. Therefore, a new anomaly detection method is needed to address these problems. Summary of the Invention

[0003] This application is made in view of at least one of the above-mentioned technical problems existing in the prior art. According to one aspect of this application, a data detection method is provided, the method comprising:

[0004] Acquire the data to be tested;

[0005] Based on the data to be detected, and using an intelligent engine, it is determined whether there are any anomalies in the data to be detected, and the data to be detected that has anomalies is optimized.

[0006] The intelligent engine determines the first data and the second data based on the sequence information of the data to be detected.

[0007] The intelligent engine determines the first abnormal data in the first data based on the abnormal basic data.

[0008] The intelligent engine, based on the anomaly processing data, determines the second abnormal data in the second data.

[0009] In some embodiments, the intelligent engine includes a first module.

[0010] The first module is constructed based on the aforementioned abnormal basic data;

[0011] If it is determined that the data to be detected is abnormal, the first module is further configured to determine the first abnormal data in the first data.

[0012] In some embodiments, the first module includes a first parameter, which is determined based at least on interaction data and object data of at least two objects that generate the interaction, so as to be able to distinguish the individual interaction information of the objects and thus determine whether the data to be detected is abnormal.

[0013] In some embodiments, the intelligent engine further includes a second module.

[0014] The second module is constructed based on the aforementioned anomaly handling data;

[0015] If it is determined that the data to be detected is abnormal, the second module is further configured to determine the second abnormal data in the second data.

[0016] In some embodiments, the second module is further configured to determine relationship data between at least two objects that generate interaction based on the behavioral data in the exception handling data;

[0017] The relational data represents the relationships between various objects, so as to determine whether the data to be detected is abnormal based on the relationships between the various objects.

[0018] In some embodiments, at least one first module and at least one second module are integrated into the intelligent engine based on the integration ratio.

[0019] In some embodiments, the method further includes:

[0020] The intelligent engine is also used to process the first abnormal data and the second abnormal data to obtain a report that the data to be detected is abnormal.

[0021] Another embodiment of this application provides a data detection device, the device comprising:

[0022] The acquisition module is used to acquire the data to be detected;

[0023] The processing module is used to determine whether there is an anomaly in the data to be detected based on the intelligent engine.

[0024] The intelligent engine determines the first data and the second data based on the sequence information of the data to be detected.

[0025] The intelligent engine determines the first abnormal data in the first data based on the abnormal basic data.

[0026] The intelligent engine, based on the anomaly processing data, determines the second abnormal data in the second data.

[0027] Another aspect of this application provides an electronic device, the electronic device comprising:

[0028] The system includes a memory and a processor, wherein the memory stores a computer program that is executed by the processor, and the computer program, when executed by the processor, causes the processor to perform the data detection method as described above.

[0029] In another aspect, this application provides a storage medium storing a computer program, which, when run by a processor, causes the processor to execute the data detection method described above.

[0030] In the data detection method of this application embodiment, the intelligent engine determines the detection data as first data and second data based on the sequence information of the data to be detected, and then determines the abnormal data in the first data and second data respectively. Attached Figure Description

[0031] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0032] Figure 1 A schematic flowchart of a data detection method according to an embodiment of this application is shown;

[0033] Figure 2 A schematic flowchart illustrating a data detection method according to another embodiment of this application is shown;

[0034] Figure 3 A schematic diagram of a data detection apparatus according to an embodiment of this application is shown;

[0035] Figure 4 This diagram illustrates the processing procedure of the intelligent engine for the data to be detected according to an embodiment of this application.

[0036] Figure 5 A schematic block diagram of an electronic device according to an embodiment of this application is shown. Detailed Implementation

[0037] To enable those skilled in the art to better understand the technical solutions of the embodiments of this application, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0038] Anomaly detection is a technique that uses data mining, machine learning, or deep learning to identify anomalies in data. This technology is widely used across various industries, such as fraudulent lending in finance, hacking in security, product defect detection in industry, and malicious buyer groups in e-commerce. Therefore, designing an accurate, efficient, and feasible multi-scenario, multi-objective anomaly detection model is a crucial step for enterprises to reduce losses. Traditional methods for anomaly detection include:

[0039] The first method is based on statistical detection. This method relies on the experience of business personnel and assumes that normal data follows a certain uniform data distribution, while data that does not follow this distribution is considered abnormal. However, this method is only effective for specific individual business operations because business personnel have limited experience, and business experience is not replicable; moreover, real data often does not have a single data distribution, thus limiting the accuracy of the detection results.

[0040] The second method is based on traditional data mining algorithms. This method considers the distance similarity between samples or calculates the density distribution of sample clusters based on statistical methods. The judgment logic is the same as that of statistical methods, but it uses common algorithms such as the nearest neighbor (KNN), K-means clustering (KMeans), and density-based clustering (DBSCAN). However, this method has the following disadvantages: (1) Unsupervised clustering models rely on a large amount of feature data and often require guidance from business experts; (2) These models cannot solve data sparsity well and have poor generalization ability; (3) The time complexity is high, and the model efficiency is extremely low on the massive data of e-commerce.

[0041] The third method is a deep learning detection approach based on autoencoders. This method is a fully end-to-end encoder and decoder detection approach. The input data learns some useful information from the encoder network and compresses it, then decompresses and restores it through the decoder network. Often, the differences between samples with large discrepancies will be very obvious after restoration. However, this method requires training data that relies on normal data; moreover, this method cannot solve the end-to-end model training problem for multiple issues.

[0042] To address at least one of the aforementioned problems, this application provides a data detection method that aims to solve the issues of traditional abnormal data detection methods, such as inability to detect in multiple scenarios, low detection accuracy, and low detection efficiency.

[0043] Based on at least one of the aforementioned technical problems, this application provides a data detection method, the method comprising: acquiring data to be detected; determining, based on an intelligent engine, whether the data to be detected is abnormal, and optimizing the abnormal data; wherein, the intelligent engine determines first data and second data based on the sequence information of the data to be detected; the intelligent engine determines first abnormal data in the first data based on abnormal basic data; and the intelligent engine determines second abnormal data in the second data based on abnormal processing data. In the data detection method of this application embodiment, the intelligent engine determines the detection data as first data and second data based on the sequence information of the data to be detected, then determines the abnormal data in the first data and second data respectively, and optimizes the abnormal data. Supervised end-to-end anomaly detection can directly obtain the probability of the detection target, reducing the need for clustering or thresholding to determine anomalies after training an unsupervised model.

[0044] Figure 1 This diagram illustrates a schematic flowchart of a data detection method according to an embodiment of the present application; as shown. Figure 1 As shown, a data detection method 100 according to an embodiment of this application may include the following steps S101 and S102:

[0045] In step S101, the data to be detected is obtained.

[0046] In one example, the data to be detected includes at least behavioral data, such as user historical click data and behavioral cross-feature data. The data to be detected may also include feature information of at least two objects that generated the interaction, such as user features and product features.

[0047] The stage of acquiring the data to be tested is the basic data preparation stage. The user characteristics mentioned above can include user activation, account information, and other data. The product characteristics mentioned above can include data such as large / small transaction amounts, frequent transactions, and concentrated order rates. User historical click data can include sequences of user historical click behaviors (such as clicks, shares, reviews, etc.). Behavioral cross-feature data can include cross-feature data of user browsing, purchasing, and searching behaviors.

[0048] In step S102, based on the data to be detected, and using the intelligent engine, it is determined whether there are any abnormalities in the data to be detected, and the data to be detected that has abnormalities is optimized.

[0049] For example, if the data to be detected contains abnormal data such as fake user data, fake order data, malicious information, or defective data, the data to be detected is considered to be abnormal.

[0050] The intelligent engine determines the first data and the second data based on the sequence information of the data to be detected. In this embodiment, the sequence information can refer to information such as time or order. In one example, the intelligent engine can determine the first data based on short-term data in the data to be detected, and determine the second data based on medium- to long-term data in the data to be detected. The first data and the second data are divided based on time information or order information. For example, if user click data, behavioral cross-feature data, user characteristics, and product characteristics are collected from 2010 to 2015 as the data to be detected, and if divided according to time order, the data of users' early account activation from 2010 to 2015 can be used as the first data, which may include information such as registration number and user ID; and the order data generated by users in the later stages from 2010 to 2015 can be used as the second data, which may include information such as order number and order time. For example, user click data, behavioral cross-feature data, user characteristics, and product characteristics collected from 2010 to 2015 can be used as the data to be tested. User click data can include user order confirmation data, user order cancellation data, etc., and behavioral cross-feature data can include user browsing data, order generation data, etc. The data can be divided according to the order in which the user operation data was generated. For example, if a user has 100 sets of operation data, the data to be tested corresponding to the first 5 sets of operation data can be used as the first data, and the data to be tested corresponding to the last 95 sets of operation data can be used as the second data.

[0051] The intelligent engine identifies the first abnormal data in the first data based on the abnormal basic data. For example, the abnormal basic data may include data such as user activation and account information in the first data.

[0052] The intelligent engine, based on the anomaly handling data, identifies a second anomaly in the second data. For example, the anomaly handling data may include user order data from the second data.

[0053] In one embodiment of this application, the intelligent engine includes a first module.

[0054] The first module is constructed based on the aforementioned abnormal basic data;

[0055] If it is determined that the data to be detected is abnormal, the first module is further configured to determine the first abnormal data in the first data.

[0056] In one example, the first module may include a time series model. For example, a time series model may include models such as a time series (ARIMA) model, a long short-term memory (LSTM) neural network model, a gated recurrent unit (GRU) model, a large-scale time series (Prophet) model, a sequence generation (WaveNet) model, a transformer (Transformer) model, a time series (ARMA-GARCH) model, and so on.

[0057] Among them, the Autoregressive Moving Average (ARIMA) model is an autoregressive moving average model used to analyze and predict time series data. The Long Short-Term Memory (LSTM) neural network model is a recurrent neural network capable of capturing long-term dependencies in time series. The Gated Recurrent Unit (GRU) model is a recurrent neural network similar to the LSTM model, but with fewer parameters and faster training speed. The Prophet model is a time series prediction model with advantages such as interpretability and adjustability, suitable for various types of time series data. The WaveNet model is a generative model based on convolutional neural networks, suitable for fields such as audio processing and speech synthesis. The Transformer model is a sequence-to-sequence model suitable for fields such as natural language processing, capable of handling variable-length sequences and capturing long-term dependencies. In the Autoregressive Moving Average (ARIMA) model, it is generally assumed that the variance of the disturbance term is constant; however, in many cases, the variance of the disturbance term in time series fluctuations is not constant. Therefore, time series models can be constructed based on the characteristic of variance (volatility), for example, constructing a variance model that changes over time—the ARMA-GARCH time series model in R. The ARMA-GARCH time series model in R is a heteroscedasticity model constructed using an autoregressive moving average algorithm, which can be used to model and predict volatility in time series data. However, the ARMA-GARCH time series model in R has strict requirements for the data being tested. If the data does not conform to the ARMA-GARCH model effect, forcibly modeling it will result in a significantly worse effect compared to the Autoregressive Moving Average (ARMA) model, leading to less than ideal results.

[0058] This article takes the Long Short-Term Memory (LSTM) neural network model as an example to introduce the first module.

[0059] In one embodiment of this application, the first module includes a first parameter, which is determined based at least on interaction data and object data of at least two objects that generate the interaction, so as to be able to distinguish the various interaction information of the objects and thus determine whether the data to be detected is abnormal.

[0060] For example, a Long Short-Term Memory (LSTM) neural network model can be constructed, which has a first parameter, namely an attention mechanism. Furthermore, interaction time weights, product popularity weights, and user activity weights can be introduced into the attention mechanism.

[0061] This can be built on the Keras framework, an open-source artificial neural network library. Its neural network application program interface (API) is a packaged component that interacts directly with the user, allowing calls to other Keras components. Besides data preprocessing, users can use the neural network API to perform common machine learning tasks, including building, compiling, learning, evaluating, and testing artificial neural networks. The Long Short-Term Memory (LSTM) neural network model is a type of recurrent neural network suitable for processing and predicting important events with relatively long intervals and delays in time series. In the early stages of data processing, an LSTM neural network model trained on abnormal baseline data can be used to process the first data to identify the first abnormal data, where the abnormal baseline data can be abnormal activation data. For the processing of medium- to long-term data (i.e., the second data), a graph embedding deep learning network trained on Node2vec based on abnormal processing data can be used to process the second data to identify the second abnormal data, where the abnormal processing data can be abnormal order data.

[0062] In one example, when building a Long Short-Term Memory (LSTM) neural network model, the following steps can be taken: (1) use the add module (e.g., add function) of the LSTM neural network model to add each layer of the neural network; (2) use the first building module (e.g., Sequential function) to build a sequential model, or use multiple network layers to be linearly stacked; (3) use the second building module (Bidirectional function) to build a bidirectional neural network structure.

[0063] In another example, when adding an attention mechanism to a Long Short-Term Memory (LSTM) neural network model, it is possible to distinguish individual interaction information of objects (e.g., users, goods, and orders) to optimize the intensity indiscriminateness of objects (e.g., orders (items)) in a sequence of user behavior.

[0064] The expression that determines the object data is as follows:

[0065]

[0066] Among them, U i α represents users who have taken action on product i, and its value ranges from 100 to 150; t i Indicates the time of item interaction, Iu Indicates an active user.

[0067] in, This indicates that the more popular a product is, the weaker its overall popularity. (log(1+|I)) u |) indicates that the more active a user is, the smaller the user activity factor becomes. exp(-α*|t i -t j |) represents the impact of the time difference between the interaction between item i and item j; the shorter the time, the greater the impact of the corresponding time factor.

[0068] In this embodiment, the attention-based Long Short-Term Memory (LSTM) neural network model uses a time-series data processing method based on the first data (training data) in the early stage to ensure that the target and the abnormal activation target remain consistent. The training data consists of user features, product features, user behavior features, and labels of abnormal activations. In the later stages, the LSTM neural network model will undergo remodeling and learning to evaluate the accuracy of the results. This remodeling and learning process can be represented by the cross-entropy loss function, as shown in equation (4) below.

[0069] In one embodiment of this application, the intelligent engine further includes a second module.

[0070] The second module is constructed based on the aforementioned anomaly handling data;

[0071] If it is determined that the data to be detected is abnormal, the second module is further configured to determine the second abnormal data in the second data.

[0072] In one embodiment of this application, the second module may include a graph embedding deep learning network based on node embedding (Node2vec).

[0073] Node2vec has the following characteristics: First, similarity, meaning that nodes in the Node2vec module are similar to their surrounding nodes; second, structural equivalence, meaning that the graph embeddings of the nodes are similar. The Node2vec algorithm can be used in fields including social network analysis, recommender systems, and bioinformatics. In the deep learning network model based on Node2vec graph embedding constructed in this embodiment, user features and product features are used as nodes, all user behavior sequences are transformed into edges in an item relationship graph, and the embedding representations of items in the item relationship graph are used to find abnormal order data, etc.

[0074] First, a deep learning network based on Node2Vec graph embedding is constructed. Then, graph features are generated using the graph embedding feature representation method in the Node2Vec graph embedding deep learning network. This graph embedding feature representation method can automatically discover implicit relationships between users and products. Its core significance is to transform all user behavior sequences into edges in an item relationship graph, and to establish a global item relationship graph through graph traversal. The anomaly detection task here requires homogeneity in the network's expressive power; therefore, the node random walk process leans towards a depth-first search (DFS) method. Nodes make multiple jumps using a method similar to DFS, making it easier for them to reach distant nodes and making the graph embeddings within the nodes more similar. In this embodiment, a random walk algorithm is used, employing a method similar to DFS to make nodes more likely to reach distant nodes, increasing the probability of nodes randomly walking to distant nodes, thereby improving the optimization capability of this embodiment and facilitating the acquisition of the optimal solution.

[0075] The basic idea of ​​the random walk algorithm here is to traverse a graph starting from one or a series of vertices. At any vertex, the traverser will move to its neighboring vertices with probability 1-a, and randomly jump to any vertex in the graph with probability a, where a is called the jump probability. After each walk, a probability distribution is obtained, which describes the probability of each vertex in the graph being visited. This probability distribution is used as the input for the next walk, and this process is iterated repeatedly. When certain preconditions are met, this probability distribution will tend to converge. After convergence, a stationary probability distribution can be obtained.

[0076] The probability of a graph embedding in this application jumping from node u to the next node x can be expressed as:

[0077] π ux =α pq (t,x).w ux (2);

[0078] Among them, w ux Let α represent the weight of edge ux. pq (t,x) represents the probability adjustment function.

[0079] Where, α pq The formula for calculating (t,x) is as follows:

[0080]

[0081] Where, d tx This indicates the distance from node t to x (the number of nodes traversed); p represents the return parameter; q represents the input and output parameters.

[0082] Where p is smaller, the probability of the walk returning to t is greater; where q is smaller, the probability of the random walk reaching a distant node is greater. This embodiment uses a random walk algorithm. When q is smaller, the probability of the random walk reaching a distant node is greater, indicating that this embodiment has better optimization capabilities.

[0083] In one embodiment of this application, the second module is further configured to determine relationship data between at least two objects that generate interaction based on the behavioral data in the exception handling data.

[0084] The relational data represents the relationships between various objects, so as to determine whether the data to be detected is abnormal based on the relationships between the various objects.

[0085] In one embodiment of this application, a second module can be established using medium- to long-term detection data to determine anomaly handling data.

[0086] In this embodiment of the application, the second module may include a graph embedding model to determine the relationship between users and orders. For example, the graph embedding model may include a deepwalk model, a node2vec model, a graph (EGES) model, etc.

[0087] The deepwalk model is a graph data mining algorithm that combines random walk and word2vec training models. This algorithm can learn the hidden information of the network, representing each node in the graph as a vector containing potential information. The node2vec module has the following characteristics: first, similarity, meaning that nodes in the node2vec model are similar to their surrounding nodes; second, structural equivalence, meaning that the graph embeddings of the nodes are similar. Graph modeling (EGES) involves generating a sequence of vertices through random walks in the graph, forming a training set, and then learning a low-dimensional vector representation for each node in the graph. This is an unsupervised training process for generating representation vectors. If EGES is used, clustering algorithms or thresholding methods are needed in post-processing to identify and handle abnormal data. Therefore, in this embodiment, a supervised end-to-end anomaly detection method, Node2vec, is employed. This allows for the direct acquisition of the probability of the detected target by traversing the item relationship graph using a random walk algorithm, reducing the need for clustering or thresholding to determine anomalies after training an unsupervised model. The detected target is anomaly processing data. For example, anomaly processing data may include anomaly order data.

[0088] This article takes the second module, which is a deep learning network based on node embedding (Node2Vec) graph embedding, as an example.

[0089] A deep learning network based on node-to-vec graph embedding is used to determine the relationship data between at least two objects that generate interaction based on the second data (training data), which can ensure that the target is consistent with the target of determining the anomaly handling data. Its training data consists of user features, product features, user behavior features, etc. in the second data mentioned above. Then, the deep learning network based on node-to-vec graph embedding can be remodeled to evaluate the accuracy of the output results. This remodeling process can be represented by the cross-entropy loss function, as shown in Equation (4) below.

[0090] In one embodiment of this application, at least one first module and at least one second module are integrated into the intelligent engine based on the integration ratio.

[0091] In one embodiment of this application, the method further includes:

[0092] The intelligent engine is also used to process the first abnormal data and the second abnormal data to obtain a report that the data to be detected is abnormal.

[0093] In one embodiment of this application, a multi-gate Mixture-of-Experts (MMoE) model can be used to process and fuse the first abnormal data output by the first module and the second abnormal data output by the second module. The MMoE model is essentially an ensemble learning method. The first module uses a Long Short-Term Memory (LSTM) neural network model, and the second module uses a deep learning model based on node-to-visual embedding (Node2Vec) graph embedding. A gate network is then used to assign weights to the first abnormal data output by the first module (which can be considered the first sub-task) and the second abnormal data output by the second module (which can be considered the second sub-task). The data is then fused based on these weights. After optimization by the MMoE model, the optimal solution for the abnormal base data and the abnormal processing data is obtained. The abnormal base data can be abnormal activation data, and the abnormal processing data can be abnormal order data.

[0094] In one example, the Pareto optimal solution algorithm can be used to process the first and second anomalous data. First, determining the first anomalous data (the first data representing anomalous activation) and determining the second anomalous data (the second data representing anomalous order placement) can be viewed as two independent subtasks. t The basic features x obtained during the basic data preparation phase include user characteristics, product characteristics, and user behavior characteristics. iThis data can be shared when identifying the first and second outliers. In other words, the same training dataset can be used. To train the first module (e.g., a Long Short-Term Memory (LSTM) neural network model) and the second module (e.g., a deep learning network based on node embedding (Node2Vec) graph embeddings), where, This represents the label data for the i-th data in the t-th task. In the two subtasks of this application embodiment, the label for subtask A indicates whether the user is abnormally activated, and the label for subtask B indicates whether the order is an abnormal order. Based on this, the objective functions for subtask A and subtask B can be redefined:

[0095]

[0096] in, Loss of experience can be defined as θ sh θ represents parameters shared by different tasks. T These represent parameters related to the task.

[0097] The Pareto optimality algorithm provides a Pareto optimality, or a situation where no action or allocation is available that could make one person better off without making another worse off. Formally, a state is Pareto optimal if no alternative state can improve the well-being of at least one participant without decreasing the well-being of any other participant. If a state change exists that satisfies this condition, the new state is called a "Pareto improvement." A state is "Pareto optimal" when a Pareto improvement is impossible. In other words, Pareto efficiency means it is impossible to make one party better off without making the other party worse off. This state indicates that resources can no longer be allocated in a way that makes one party better off without harming the other party. In a Pareto-efficient state, resources are allocated in the most efficient way.

[0098] In the data detection method of this application embodiment, the intelligent engine determines the detection data as first data and second data based on the sequence information of the data to be detected. Then, abnormal data in the first data and second data are identified respectively, and the abnormal data to be detected is optimized. Supervised end-to-end anomaly detection can directly obtain the probability of the detection target, reducing the need for clustering or thresholding to determine anomalies after training the unsupervised model. Moreover, this application implementation utilizes powerful deep learning and vectorized network representation to learn the patterns of user behavior sequences, without the need for pre-assuming data distribution planning. The non-linear hidden layer has strong generalization ability. In addition, this application embodiment greatly saves training resource overhead and has better scalability.

[0099] This application's embodiments represent a fully automated anomaly detection technical solution developed by the inventors through continuous practice and deduction from numerous applications. The data detection method in this application constructs a time series model based on first data in the data to be detected to detect first anomalous data, and constructs a graph embedding model based on second data in the data to be detected to detect second anomalous data. By fusing graph embedding and time series models, the distribution patterns of anomalous data in the data to be detected are effectively mined. In this application's embodiments, constructing a time series model to detect the first anomalous data and constructing a graph embedding model to detect the second anomalous data can both be considered sub-objectives (i.e., sub-tasks mentioned above). Therefore, in the multi-objective learning anomaly detection framework proposed in this paper, the purpose of decomposing the deep learning time series algorithm is consistent with the accuracy of anomaly activation prediction in the early stage of anomaly detection prediction. Therefore, in the early stage of anomaly detection prediction, using the decomposition of the deep learning time series algorithm can ensure the accuracy of short-term time series and the model. The purpose of the graph embedding model is consistent with the accuracy of anomaly order prediction in the later stage of anomaly detection. Therefore, using the graph embedding model in the later stage of anomaly detection can ensure the diversity of long-term time series and the model. Then, based on the idea of ​​multi-task (i.e., multiple sub-tasks) optimization, the two types of sub-tasks are trained using a multi-task learning model to finally determine the Pareto optimal solution.

[0100] Figure 2 A schematic flowchart of a data detection method according to another embodiment of this application is shown; as follows: Figure 2 As shown, the data detection method 200 according to the embodiments of this application may include steps 201, 202, 203, 204, 205, 206 and 207.

[0101] In step 201, a data source is obtained; wherein the data source includes at least user information, order information, user behavior information, and user behavior sequence information.

[0102] In step 202, the data source is processed using a deep neural network (DNN) model, wherein the deep neural network (DNN) model includes a long short-term memory (LSTM) neural network and a transformer module.

[0103] The deep neural network (DNN) in this embodiment is a multi-layer unsupervised neural network. It uses the output features of the previous layer as the input of the next layer for feature learning. Through layer-by-layer feature mapping, the features of the existing spatial samples are mapped to another feature space, thereby learning to have a better feature representation of the existing input. The deep neural network has feature transformations with multiple nonlinear mappings, which can fit highly complex functions. If the deep structure is regarded as a neuronal network, the core idea of ​​the deep neural network can be described as follows: (1) each layer of the network is pre-trained using unsupervised learning; (2) unsupervised learning trains each layer layer by layer, that is, the output of the previous layer is used as the input of the next layer; (3) supervised learning is used to fine-tune all layers (plus a classifier for classification). Since the deep neural network adopts the layer-by-layer pre-training training mechanism instead of the backpropagation training mechanism of the traditional neural network, it overcomes the shortcomings of the traditional neural network, such as easy overfitting and slow training speed. The deep neural network as a whole Its advantages are: overcoming the time-consuming and labor-intensive disadvantages of manually designing features; obtaining the primary features of each layer through layer-by-layer data pre-training; more effective (exponential) distributed data learning; and compared with shallow modeling methods, deep modeling can represent real-world complex nonlinear problems more meticulously and efficiently.

[0104] In this embodiment, both the Long Short-Term Memory (LSTM) neural network model and the Transformer module are based on Deep Neural Network (DNN) models. The LSTM neural network model is a type of Recurrent Neural Network (RNN), while the Transformer is a feedforward neural network. This means that the LSTM neural network model processes the input sequence element by element and updates the hidden state at each time step. The Transformer, on the other hand, processes the entire input sequence in parallel and uses an attention mechanism to selectively focus on different parts of the sequence.

[0105] In step 203, the deep neural network model outputs abnormal activation information.

[0106] The abnormal activation information can be calculated based on behavioral data from the data source. For example, behavioral data may include user information.

[0107] In step 204, the data source is processed using a graph embedding model, wherein the graph embedding model includes a node embedding (Node2vec) module and a graph model (EGES).

[0108] The Node2vec module has the following characteristics: First, similarity, meaning that the nodes in the Node2vec module are similar to the surrounding nodes; Second, structural equivalence, meaning that the graph embeddings of the nodes are similar.

[0109] Among them, the graph model (EGES) refers to the process of generating a sequence of vertices by random walk in a graph to form a training set, and then learning a low-dimensional vector representation for each node in the graph. This is an unsupervised training process to generate representation vectors.

[0110] In step 205, the graph embedding model outputs anomaly handling data.

[0111] The exception handling data can be obtained from the interaction data in the data source. This exception handling data can include exception order data. For example, interaction data can include order information (Item info), user behavior information (Userbehavior info), and user behavior sequence information (User behavior sequence info), etc.

[0112] In step 206, the abnormal activation information and abnormal processing data are processed using the summation / average calculation module (Sum / Avg) in the preset algorithm to output fused data. The abnormal processing data can be abnormal order data.

[0113] In step 207, the fused data is optimized using a multi-task loss function, and the optimization results are output.

[0114] The multi-task loss function can be found in equation (4) above, and will not be repeated here.

[0115] In specific implementations of this application, real data can also be used to test the above data detection method. The test results are as follows:

[0116] Compared with the Long Short-Term Memory (LSTM) neural network model in traditional technology, the LSTM neural network based on the attention mechanism in this application optimizes the traditional time series model by influencing factors such as interaction time weight, product popularity weight, and user activity weight. Compared with the abnormal activation positive samples defined by the business, the recall rate of the top 100 data to be detected is increased from 0.012 in the traditional technology to 0.016. Furthermore, positive and negative samples can be clearly distinguished from the vector visualization of the samples, which further demonstrates that the powerful deep learning time series network can distinguish abnormal activation behavior.

[0117] The data detection method in this application is based on multi-objective learning time series and uses the Pareto optimality algorithm to obtain the optimal loss weights for the sub-tasks. In the offline data of the abnormal activation sub-task model, the area under the curve (AUC) of the Receiver Operating Characteristic (ROC) curve increased by 0.3%, while the area under the curve (AUC) of the abnormal order detection sub-task increased by 1.1%. The offline evaluation results show that the two sub-tasks are positively correlated under the fusion of multi-objective learning. The shared network can simultaneously affect the sub-tasks, and the abnormal order detection sub-network can absorb long-term transaction changes in users, learning richer features compared to abnormal activation detection. All models also have stronger generalization ability.

[0118] The embodiments of this application have the following advantages:

[0119] (1) Supervised end-to-end anomaly detection can directly obtain the probability of the detected target, reducing the need to determine anomalies by clustering or thresholding after training unsupervised models.

[0120] (2) By leveraging powerful deep learning and vectorized network representations, the patterns of user behavior sequences can be learned without prior assumptions about the data distribution. The non-linear hidden layers have strong generalization capabilities.

[0121] (3) It greatly saves training resources and enriches the scalability of the method.

[0122] This application embodiment optimizes two (or more) single objectives (such as the first and second modules mentioned above) by constructing a multi-objective model (i.e., the aforementioned intelligent engine). The input to the model is a unified dataset (the data to be detected). A single model can distinguish and learn data suitable for its own model. For example, it can divide the data into first and second data based on sequence information, or determine the first and second data based on the nature of the abnormal data (false information, malicious information, abnormal information for the next check, etc.). Compared to the traditional approach of multiple single tasks, the data detection method of this application embodiment does not require the construction of multiple data models and the use of different systems for maintenance. Instead, it only requires one data detection method of this application embodiment to detect multiple types of abnormal data.

[0123] Figure 3 A schematic block diagram of a data detection apparatus according to an embodiment of this application is shown; as follows: Figure 2 As shown, the data detection device 300 according to an embodiment of this application may include an acquisition module 301 and a processing module 302.

[0124] The acquisition module 301 is used to acquire the data to be detected.

[0125] The processing module 302 is used to determine whether there is an anomaly in the data to be detected based on the intelligent engine.

[0126] like Figure 4 The diagram illustrates the processing procedure of the intelligent engine for the data to be detected, according to an embodiment of this application. The intelligent engine in the diagram determines first data and second data based on the sequence information of the data to be detected. The data to be detected is data collected during the basic data preparation stage and may include behavioral data, such as user historical click data and behavioral cross-feature data; it may also include feature information of at least two objects that generated the interaction, such as user features and product features. Furthermore, the data to be detected also includes various abnormal data, such as false user registration information or false orders placed by the user.

[0127] In one example of this application, the intelligent engine, upon receiving data to be detected, can divide the data into first data and second data based on the data sequence information (the division method can be found in the example above). Then, the first data is processed by the intelligent engine's Long Short-Term Memory Neural Network model (i.e., the first model), and the second data is processed by the intelligent engine's Node Embedding-based Graph Embedding Deep Learning Network model (i.e., the second model). Since the data to be detected may contain various anomalous data, in specific implementations, it may be necessary to construct multiple Long Short-Term Memory Neural Network models (such as...). Figure 4 The long short-term memory neural network models 1 to m are shown in the figure, and there are multiple graph embedding deep learning network models based on node embedding (such as...). Figure 4 The diagram shows multiple node-embedded graph embedding deep learning network models (1 to n). Multiple long short-term memory neural network models process the first data to obtain first anomalous data (e.g., anomalous activation data). Multiple node-embedded graph embedding deep learning network models process the second data to obtain second anomalous data (e.g., anomalous order data).

[0128] Then, the first and second anomalous data are processed using a multi-task model in the intelligent engine. For example, appropriate weights are assigned to the first anomalous data (e.g., anomalous activation data) and the second anomalous data (e.g., anomalous order data). Then, the Pareto optimal algorithm is used to optimize the first and second anomalous data (e.g., anomalous activation data) to obtain the optimal solutions for both. Finally, an anomalous data report is output based on the optimal solutions for the first and second anomalous data (e.g., anomalous activation data) and the second anomalous data (e.g., anomalous order data). This anomalous data report contains a set of the first and second anomalous data (e.g., anomalous activation data).

[0129] Depend on Figure 4 As can be seen, the intelligent engine is a model that includes multiple long short-term memory neural network models, multiple graph embedding deep learning network models based on node embedding, and a multi-task model. After processing the data to be detected, the intelligent engine outputs a set containing optimized first anomalous data (e.g., anomalous activation data) and second anomalous data (e.g., anomalous order data).

[0130] It is worth noting that, in the examples of this application, the Long Short-Term Memory neural network model and the node embedding-based graph embedding deep learning network model are merely examples to clearly illustrate the embodiments of this application. Other models capable of achieving the same function can also be included within the scope of protection of this application.

[0131] The following is combined Figure 5 The electronic device described in this application, wherein, Figure 5 A schematic block diagram of an electronic device according to an embodiment of this application is shown.

[0132] like Figure 5 As shown, the electronic device 500 includes: one or more memories 501 and one or more processors 502. The memories 501 store a computer program that is executed by the processors 502. When the computer program is executed by the processors 502, the processors 502 perform the data detection method described above.

[0133] Electronic device 500 may be part or all of a computer device that can implement a power device layout design method through software, hardware, or a combination of software and hardware.

[0134] like Figure 5As shown, the electronic device 500 includes one or more memories 501, one or more processors 502, a display (not shown), and a communication interface, etc., which are interconnected via a bus system and / or other forms of connection mechanisms (not shown). It should be noted that... Figure 5 The components and structure of the electronic device 500 shown are merely exemplary and not limiting. The electronic device 500 may also have other components and structures as needed.

[0135] Memory 501 is used to store various data and executable program instructions generated during operation, such as storing various application programs or algorithms that implement various specific functions. It may include one or more computer program products, which may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc.

[0136] The processor 502 may be a central processing unit (CPU), a graphics processing unit (GPU), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other processing units with data processing capabilities and / or instruction execution capabilities, and may be other components in the electronic device 500 to perform the desired functions.

[0137] In one example, the electronic device 500 also includes an output device that can output various information (such as images or sounds) to the outside (e.g., a user), and may include one or more of a display device, a speaker, etc.

[0138] The communication interface can be any known communication protocol interface, such as a wired interface or a wireless interface. The communication interface may include one or more serial ports, USB interfaces, Ethernet ports, WiFi, wired networks, DVI interfaces, device integrated interconnect modules, or other suitable ports, interfaces, or connections.

[0139] Furthermore, according to embodiments of this application, a storage medium is also provided, on which program instructions are stored. When executed by a computer or processor, these program instructions are used to perform corresponding steps of the data detection method of this application. The storage medium may, for example, include a memory card of a smartphone, a storage component of a tablet computer, a hard disk of a personal computer, a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a portable compact disc read-only memory (CD-ROM), a USB memory, or any combination of the above storage media.

[0140] The electronic device and storage medium of the present application embodiments have the same advantages as the aforementioned data detection method because they are able to implement the aforementioned data detection method.

[0141] Although exemplary embodiments have been described herein with reference to the accompanying drawings, it should be understood that the above exemplary embodiments are merely illustrative and are not intended to limit the scope of this application. Various changes and modifications can be made therein by those skilled in the art without departing from the scope and spirit of this application. All such changes and modifications are intended to be included within the scope of this application as claimed in the appended claims.

[0142] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0143] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed.

[0144] Numerous specific details are set forth in the specification provided herein. However, it will be understood that embodiments of this application may be practiced without these specific details. In some instances, well-known methods, structures, and techniques have not been shown in detail so as not to obscure the understanding of this specification.

[0145] Similarly, it should be understood that, in order to simplify this application and aid in understanding one or more of the various inventive aspects, features of this application are sometimes grouped together in a single embodiment, figure, or description thereof in the description of exemplary embodiments of this application. However, this approach should not be construed as reflecting an intention that the claimed application requires more features than are expressly recited in each claim. Rather, as reflected in the corresponding claims, the inventive point lies in solving the corresponding technical problem with fewer features than all of those in a single disclosed embodiment. Therefore, the claims following the detailed description are hereby expressly incorporated into that detailed description, wherein each claim itself is a separate embodiment of this application.

[0146] Those skilled in the art will understand that, apart from the mutual exclusion of features, all features disclosed in this specification (including the accompanying claims, abstract, and drawings) and all processes or units of any method or apparatus so disclosed can be combined in any combination. Unless otherwise expressly stated, each feature disclosed in this specification (including the accompanying claims, abstract, and drawings) may be replaced by an alternative feature that serves the same, equivalent, or similar purpose.

[0147] Furthermore, those skilled in the art will understand that although some embodiments described herein include certain features but not others included in other embodiments, combinations of features from different embodiments are intended to be within the scope of this application and form different embodiments. For example, in the claims, any one of the claimed embodiments can be used in any combination.

[0148] The various component embodiments of this application can be implemented in hardware, or as software modules running on one or more processors, or a combination thereof. Those skilled in the art will understand that microprocessors or digital signal processors (DSPs) can be used in practice to implement some or all of the functions of some modules according to the embodiments of this application. This application can also be implemented as an apparatus program (e.g., a computer program and computer program product) for performing part or all of the methods described herein. Such an implementation of this application can be stored on a computer-readable medium, or can be in the form of one or more signals. Such signals can be downloaded from an Internet website, provided on a carrier signal, or provided in any other form.

[0149] It should be noted that the above embodiments are illustrative of this application and not restrictive, and that those skilled in the art can devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between parentheses should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. This application can be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In the unit claims enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third, etc., does not indicate any order. These words can be interpreted as names.

[0150] The above description is merely a specific embodiment or illustration of the embodiments of this application. The scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. The scope of protection of this application shall be determined by the scope of the claims.

Claims

1. A data detection method, the method comprising: Acquire the data to be tested; Based on the data to be detected, and using an intelligent engine, it is determined whether there are any anomalies in the data to be detected, and the data to be detected that has anomalies is optimized. The intelligent engine determines first data and second data based on the sequence information of the data to be detected. The first data is preliminary data, which includes interaction data and object data of at least two objects that generate the interaction. The second data is subsequent data, which includes behavioral data of the relationship between at least two objects that generate the interaction. The intelligent engine determines the first abnormal data in the first data based on the abnormal basic data. The intelligent engine determines the second abnormal data in the second data based on the abnormal processing data; The intelligent engine includes a first module and a second module. The first module includes a temporal model, and the second module includes a deep learning network based on node embedding and graph embedding.

2. The method according to claim 1, The first module is constructed based on the aforementioned abnormal basic data; If it is determined that the data to be detected is abnormal, the first module is further configured to determine the first abnormal data in the first data.

3. The method according to claim 2, wherein the first module includes a first parameter, the first parameter being determined based at least on interaction data and object data of at least two objects that generate the interaction, so as to be able to distinguish the various interaction information of the objects and thereby determine whether the data to be detected is abnormal.

4. The method according to claim 1, The second module is constructed based on the aforementioned anomaly handling data; If it is determined that the data to be detected is abnormal, the second module is further configured to determine the second abnormal data in the second data.

5. The method according to claim 4, wherein the second module is further configured to determine relationship data between at least two objects that generated the interaction based on the behavioral data in the exception handling data; The relational data represents the relationships between various objects, so as to determine whether the data to be detected is abnormal based on the relationships between the various objects.

6. The method according to claim 1, wherein at least one first module and at least one second module are integrated into the intelligent engine based on the integration ratio.

7. The method according to claim 6, further comprising: The intelligent engine is also used to process the first abnormal data and the second abnormal data to obtain a report that the data to be detected is abnormal.

8. A data detection device, the device comprising: The acquisition module is used to acquire the data to be detected; The processing module is used to determine whether there is an anomaly in the data to be detected based on the intelligent engine. The intelligent engine determines first data and second data based on the sequence information of the data to be detected. The first data is preliminary data, which includes interaction data and object data of at least two objects that generate the interaction. The second data is subsequent data, which includes behavioral data of the relationship between at least two objects that generate the interaction. The intelligent engine determines the first abnormal data in the first data based on the abnormal basic data. The intelligent engine determines the second abnormal data in the second data based on the abnormal processing data; The intelligent engine includes a first module and a second module. The first module includes a temporal model, and the second module includes a deep learning network based on node embedding and graph embedding.

9. An electronic device, the electronic device comprising: A memory and a processor, wherein the memory stores a computer program that is executed by the processor, the computer program, when executed by the processor, causes the processor to perform the data detection method as described in any one of claims 1 to 7.

10. A storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the data detection method as described in any one of claims 1 to 7.

Images