Active anomaly detection method driven by data independent subset and multi-expert hybrid training

Abstract

The application discloses an active anomaly detection method of data independent subset driving multi-expert hybrid training. Through active learning feedback in each round, samples are divided into two parts according to the setting of a threshold value according to the ranking of an anomaly score, and multiple sample subsets are divided based on the similarity and diversity of features. A plurality of weak expert groups are independently trained on each subset in the form of an expert hybrid network, reasoning is performed by means of integration, and the most abnormal samples are cross-selected on each expert network, so that the interference caused by the single-class setting of unlabelled data to the model is reduced. The application specifically applies a multi-task expert hybrid network model to single-task anomaly detection, intelligently learns the weight of integration and combination, strengthens the connection between data and expert networks, improves the detection performance, and provides a new idea for semi-supervised anomaly detection.

Description

Technical Field

[0001] This invention relates to the field of anomaly detection and active learning technology, specifically to an active anomaly detection method driven by data-independent subsets and multi-expert hybrid training. Background Technology

[0002] With the continuous development and implementation of artificial intelligence technology, anomaly detection is becoming increasingly widespread. Compared to unsupervised learning, methods utilizing labeled information, especially anomalous samples, significantly improve detection performance. Semi-supervised learning effectively constrains the learning of labeled content while also utilizing unlabeled data. However, in both daily life and industrial production, ubiquitous targets or phenomena constitute humanity's definition of "normal." Therefore, most semi-supervised anomaly detection methods assume that unlabeled data is anomaly-free, making labeled anomaly information particularly important. On the one hand, erroneous supervisory signals from unlabeled anomalous data can interfere with model learning; on the other hand, corrected anomaly labels are lacking in model training.

[0003] The availability of normal samples means that collecting and labeling anomalies in massive datasets is extremely difficult, and active learning is specifically designed to address this problem. By selecting a certain number of samples for labeling based on specific principles and continuously iterating and updating the model, researchers can reduce the budget for sample labeling through active learning. Therefore, for the aforementioned semi-supervised anomaly detection, the focus of active learning should be on how to select as many true anomalies as possible. Past active anomaly detection methods followed the assumption that all unlabeled data is normal, adding erroneous supervisory signals to potentially unlabeled anomalies during training and selecting data from the unlabeled pool, making it difficult to select hard-to-identify anomaly samples. Summary of the Invention

[0004] (a) Technical problems to be solved

[0005] To address the shortcomings of existing technologies, this invention provides an active anomaly detection method driven by independent subsets of data and multi-expert hybrid training. It focuses on solving the problem of how to discover as many true anomaly samples as possible in a contaminated unlabeled data pool. In other words, under the premise that the unlabeled data follows the single-class hypothesis, it studies how to use active learning methods to correct the small number of true anomalies mixed in the unlabeled pool, thereby improving the detection performance of the model without changing the settings that the model itself follows.

[0006] (II) Technical Solution

[0007] To address the aforementioned issues, this invention designs a scheme for partitioning data subsets, while simultaneously replicating multiple copies of the expert network model for independent training on unlabeled data. Inference is then performed using cross-validation of subsets and the expert network. This invention uniquely integrates a multi-task expert hybrid network model into this framework. The specific technical solution adopted is as follows:

[0008] An active anomaly detection method driven by data-independent subsets and multi-expert hybrid training includes the following steps:

[0009] S1: Initial conditions. Given an initial dataset without labels. in, It contains real abnormal data. Let n represent the set of real numbers. The number of samples in the middle, d represents The feature dimensions of each sample.

[0010] Using the semi-supervised anomaly detection expert ε ε follows the assumption that the unlabeled data portion is single-class (i.e., only normal samples exist, and all detectors with this function can serve as semi-supervised anomaly detection experts in this invention), and infers an anomaly score for each sample separately.

[0011] S2: Construct and train an anomaly detection ensemble model, which includes E copies of ε, ε1, ε2…ε E The expert hybrid network consists of D gated networks G1, G2...GD, where each gated network corresponds one-to-one with a subset, and one subset corresponds to multiple ε.

[0012] Based on the D subsets, the anomaly detection ensemble model is correspondingly copied into D replicas ε1, ..., ε D These expert networks have identical network structures and are trained using the same form of task loss for anomaly detection. The difference lies in their independent parameters, each training a weak expert with independent reasoning capabilities.

[0013]

[0014] Representing a subset of data The kth sample in the dataset.

[0015] Subset and Gated Networks: We propose replicating the same model into multiple copies, each called an expert, and training each copy separately on a subset of unlabeled data. This allows for cross-validation between model copies and data subsets during inference. For example, data subset 1 infers on model copies 2, 3, ..., E, and then an ensemble score (i.e., average) is generated. Another advantage is that labeled normal samples can be incorporated into the training of all copies, meaning that labeled normal samples are also effectively utilized, unlike previous approaches where labeled normal samples did not provide additional improvement to the overall model. A drawback of this approach is the inefficient use of unlabeled data. To disrupt the one-to-one relationship between data and model, we introduce and adapt existing expert hybrid networks to fit our proactive anomaly detection scheme.

[0016] S2-1: Set t=1, set a threshold, and initialize the public pool.

[0017] S2-2: Using the diversity and similarity partitioning module DSS to... Divide into D subsets as evenly as possible. D subsets This constitutes a private pool, where no two subsets share common data. and During training, they are isolated from each other. To fully utilize the labeled samples after each round of active learning iteration, they are repeatedly added to various data subsets. The public pool is added to each subset to form the input of each semi-supervised expert group in the expert hybrid network. Merging Construct the i-th semi-supervised training subset

[0018] S2-3: The training of the expert hybrid network is carried out simultaneously on all subsets. In one iteration, N cycles are completed. In each cycle, B batches of training samples are completed. Each batch consists of the same number of samples randomly sampled from D training subsets.

[0019] S2-4: In each batch The samples inside were processed by G i The mapping yields an E-dimensional probability vector, i = 1, 2, ..., D. The probability values ​​are then arranged in descending order. The samples are assigned to the top-k ε values ​​corresponding to the probability values. The ensemble output is the weighted sum of the output of the corresponding replica and the corresponding probability. The loss of the anomaly detection ensemble model is calculated, and the parameters of the anomaly detection ensemble model are updated based on the loss.

[0020] In the active selection phase, after completing N cycles, for Select replicas whose usage frequency is greater than the selection threshold. Corresponding Active Expert Group (ABS) i ,for Select replicas whose usage frequency is less than or equal to the selection threshold for masking, G i It's actually very difficult to... All samples are assigned to a fixed set of a few specific replicas. Therefore, after a training phase of active learning is completed, we need to statistically analyze the data. Furthermore, during training, all subsets are trained simultaneously (randomly selecting the same number of samples from each subset to form a batch). This is because the expert hybrid network model needs to ensure that all E model replicas are distributed as widely as possible across the entire dataset (i.e., the statistical results across all subsets), while within each subset, it is allocated as much as possible to a subset of model replicas for training. Only by training all subsets simultaneously can this effect be achieved using interactive information loss. i It's actually very difficult to... All samples are assigned to a fixed set of a few specific replicas. Therefore, after a training phase of active learning is completed, we need to statistically analyze the data. Use those ε more often.

[0021] S2-5: Will Unlabeled samples were processed by G i Assigned to the Active Expert Group AES j Inference is performed for j∈{1,2,...,D}\{i}, that is... The samples were assigned to other active expert groups for reasoning, rather than The corresponding active expert group performs inference, and each unlabeled sample receives D-1 anomaly scores. The average of these D-1 anomaly scores is the anomaly score of the unlabeled sample. The anomaly scores are sorted in descending order, and the top M unlabeled samples with the highest anomaly scores are labeled. The labeled samples are then placed into... In the middle, the top M unlabeled samples with the abnormal score are deleted from their corresponding subsets, and the data is updated. and

[0022] S2-6: Let t = t + 1;

[0023] S2-7: If t > T, output the pre-trained anomaly detection ensemble model and proceed to the next step; otherwise, return to S2-2.

[0024] S3: Using the update after the Tth iteration and The updated training subset is obtained using the S2-2 method. The updated Input the pre-trained anomaly detection ensemble model, and after N epochs, for each updated... The updated corresponding active expert group is obtained, which is the trained anomaly detection ensemble model.

[0025] S4: Input a test data into the trained anomaly detection ensemble model. D active expert groups output D anomaly scores for the test data. The average of the D anomaly scores is the anomaly score of the test data. The higher the anomaly score, the greater the possibility of anomaly in the test data.

[0026] After all the active learning cycles, the final model will be used for outlier reasoning. This invention discusses two different scenarios: inductive and inductive. In inductive learning, unlabeled samples need to be cross-validated on other expert networks (groups), and the ensemble result does not include the output of expert groups that may have incorrect pseudo-labels. In other cases, the ensemble result of reasoning from all expert networks is used.

[0027] Preferably, S2-2 uses DSS to... The steps to divide the data into D subsets as evenly as possible are as follows:

[0028] Based on the anomaly scores obtained from each round of active learning S2-4, a threshold is set to divide the unsupervised sample pool into two parts. The top-ranked samples are divided according to feature similarity, while the bottom-ranked samples are divided according to the diversity of sample features.

[0029] For the top λ% of unlabeled samples in the anomaly score ranking, DSS groups highly similar data together as much as possible. For simplicity, this invention uses FasterPAM (an accelerated implementation of the k-medoids clustering algorithm) to sample E groups from the top λ% of unlabeled data in the anomaly score ranking, i.e., setting the number of cluster centers to E. For the top λ% of unlabeled samples in the score ranking, DSS groups highly similar data together as much as possible because this part of the data has a higher proportion of potential true anomalies. Since anomaly data also has different types, data of the same type have a high degree of similarity, for example... Figure 2The dataset shown contains three different types of anomalies, with similar anomalies being more concentrated. Simply using random averaging might lead to anomalies of the same type being divided into multiple different subsets, incorrectly using similar anomaly samples, causing expert networks to fail in their inferences for this anomaly type, and significantly weakening the segmentation effectiveness. To reduce interference between similar anomalies, for simplicity, this invention uses FasterPAM (an accelerated implementation of the k-medoids clustering algorithm) to sample E groups from the top λ% of unlabeled data in the score ranking, i.e., setting the number of cluster centers to E.

[0030] The remaining unlabeled samples, ranking in the bottom 1-λ%, are evenly distributed across different subsets based on the diversity of their features, ensuring that the unlabeled samples in each subset cover the overall data distribution as much as possible. All centroids are collected into a single subset, and sampling is repeated without replacement until all inputs have been assigned. This process eliminates random partitioning, reducing the impact of random seeds on the final result. Furthermore, the data partitioning is closely integrated with the active learning cycle, fully utilizing the feedback information and data feature distribution in each round.

[0031] If there is no anomaly score feedback during the initialization phase of the anomaly detection ensemble model, then the data is divided according to the diversity of sample features.

[0032] Preferably, the S2 training process for the anomaly detection ensemble model includes:

[0033] In expert hybrid networks, the same sample is assigned to multiple expert networks, and the final result is a weighted sum of their outputs. By receiving the same input as the expert networks, the gated network calculates the weights corresponding to the outputs of each expert network in the final ensemble result, where G has trainable weights W. i g TopK(•, K) is used to select the top K output probabilities so that the corresponding expert networks receive the appropriate inputs. Meanwhile, for each... Set up a separate G i ,convenient and G i Dependencies are established between them, and the partitioning of different data subsets is controlled by a specific gating network:

[0034]

[0035] in It's a masking operation, using the Hadamard product to mask parts of the expert network. An index of 0 corresponds to a masked replica, while 1 corresponds to a replica that is actually active. x represents... One of the samples.

[0036] During the training of the anomaly detection ensemble model Use a vector whose elements are all 1s In other words, the proportion of each output contribution is completely determined by the gating network and the task objective:

[0037]

[0038] in and ε j Representing subsets The k-th input, the corresponding ensemble output, and the j-th expert network.

[0039] This invention transforms a single detection task into a multi-subtask ensemble learning based on sample differences by partitioning the data:

[0040]

[0041] in Joint probability Through the j-th copy ε j exist Assigned to The frequency is used to approximate the value of P(ε). j ), L MI or Representing the expert network ε j The probability of being used The probability of being assigned, Assigned to ε j The probability of negative mutual information loss.

[0042] This loss will lead to a more concentrated frequency of assigning a single subset to various experts. (The sentence fragment about a single subset appears to be incomplete and lacks context.) From the complete training process, only a portion of the experts received high-frequency use, which was recorded as... The AFS (Adaptive Frontier Search) approach. In other words, some experts have hardly trained on that subset of samples, while across the entire dataset, each expert uses the data as frequently as possible, thus improving model utilization.

[0043] The training loss is recorded as Therefore, the overall loss L of the anomaly detection ensemble model is the sum of the multi-task loss and the negative mutual information loss on each training subset, and the hyperparameter α is used to adjust the relationship between the two:

[0044]

[0045] This invention employs the most commonly used anomaly score ranking principle actively selected for this task. Specifically, at the end of each training iteration, the data with the most anomalous inference result from the model is labeled. When inferring the anomalousness of unlabeled samples, since they are considered normal samples and assigned pseudo-labels under a single-class setting, their identification cannot be completed by their corresponding active expert group. In this invention, unlabeled samples in each data subset are subjected to inference by other expert networks that have not been trained on that data, and their anomaly scores are obtained after integrated calculation.

[0046] Preferably, the active selection stage S2-4 includes the following steps:

[0047] Record ε after b batches of training j quilt Frequency of use The forgetting factor μ is dynamically updated.

[0048]

[0049] Among them I b,i This indicates that it belongs to a subset in batch b. The index of all samples, This indicates an indicator function responsible for filtering ε, which is rarely used. Representing a subset In batch b, for the k′-th sample, this update method avoids the problem of insufficient coupling between the data subset and the expert network due to inadequate training of the gating network in the early stages of model training. Simultaneously, the μ value is set relatively small to prevent subsequent batches from having an excessive impact on the overall allocation.

[0050]

[0051] in, Represents the input scalar value, O t and O f The output of the indicator function is shown for both positive and negative values.

[0052] Before data selection begins, a corresponding AES is established for each data subset, which is an active expert group consisting of an expert network ε with a frequency exceeding θ.

[0053] According to G i The corresponding AES index will The corresponding element is set to 1, and the remaining positions are filled with -∞. The advantage of this setting is that -∞, after being processed by Softmax, results in a probability of 0, and the data... Will be G j Assign it to the corresponding AES.

[0054]

[0055] use The corresponding AES values ​​are respectively for The kth sample Individual inferences are then ensembled into a final result: considering the overall training and selection process, it's similar to cross-validation.

[0056]

[0057] Where R i = {1, ..., D}\{i}.

[0058] Preferably, the abnormal score s of the test data in S4 is calculated as follows:

[0059]

[0060] Compared with the prior art, the present invention has at least the following advantages:

[0061] This paper presents an active anomaly detection method driven by independent subsets and multi-expert hybrid training. This method offers an intuitive and effective training and selection paradigm applicable to all semi-supervised anomaly detection tasks that adhere to the partial single-classification assumption for unlabeled data, regardless of the specific method or module. Based on the feedback anomaly scores obtained in each iteration, different data subsets are defined, balancing the similarity of anomaly samples with the diversity of normal data, thus enhancing the training reliability of each expert network. Using a hybrid expert network improves data utilization and strengthens the correlation between data subsets and expert networks. By improving the detection performance of the ensemble model, each iterative training round progressively acquires more real anomalies, fully leveraging the advantages of active learning. Attached Figure Description

[0062] To more clearly illustrate the technical solutions in the embodiments of the present invention and the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0063] Figure 1 This is a simplified flowchart of the method of the present invention.

[0064] Figure 2 It is a data partitioning module based on feature similarity and diversity.

[0065] Figure 3 It is an active anomaly detection implementation method based on multi-expert replication (IAE).

[0066] Figure 4 It is an active anomaly detection implementation method based on multi-expert hybrid (AES).

[0067] Figure 5 This is a comparison of the number of anomalies selected in each round using the method on the Cifar10 dataset. Detailed Implementation

[0068] The present invention will now be described in further detail.

[0069] This invention designs an active anomaly detection method driven by data-independent subsets and multi-expert hybrid training. This method does not change the assumption that unlabeled data is anomaly-free in semi-supervised anomaly detection. The selection principle does not depend on any specific anomaly detection method or additional modules. Based on the most commonly used selection principle in active learning for anomaly detection tasks—anomaly score ranking—the training and selection framework is redesigned. Specifically, samples are divided into different subsets based on the anomaly scores, sample feature diversity, and similarity in each round of feedback. Multi-subset expert hybrid network training is then conducted, and cross-validation among expert groups is used for inference on unlabeled data.

[0070] Specifically, Figure 2 This invention demonstrates the diversity and similarity partitioning module. The figure shows a schematic diagram of the two-dimensional feature space distribution, where D is set to 3, requiring the partitioning into three subsets. Assume there are exactly three types of anomalies, clustered close together in the space. Here, the similarity and diversity of data features are handled in two separate ways. Firstly, anomalies of the same type should be grouped into the same data subset as much as possible, i.e., the area marked by the dashed box in the figure. However, misclassification is possible because simple clustering methods lack supervised information and cannot accurately analyze category information, but can mitigate the mutual interference caused by erroneous labeling to some extent. Secondly, each data subset should have diverse features, thus improving the performance of individual detection by each trained expert group.

[0071] Figure 3 A simplified implementation (IAE) of a multi-expert replication network is demonstrated to verify the feasibility of this invention. The number of expert networks corresponds to the number of data subsets, with a one-to-one relationship. That is, each expert network is trained on only one data subset, and each data subset is fed to only one specific expert. The training of the overall ensemble model is performed independently and sequentially, without interfering with each other. This model design can be seen as an approximately simplified version of a hybrid expert network, specifically a hybrid expert network when K=1 and E=D. The illustration uses data subsets... For example, The samples were only fed to the expert network ε1, including the labeled portion. and unmarked parts When actively choosing The reasoning in The above is performed, and the integrated result is taken as... The score.

[0072] Figure 4 This paper demonstrates a specific implementation of the present invention based on IAE (Independent Expert Array) and introducing a hybrid expert network—Active Expert Group (AES). In this case, the number of expert networks is no longer aligned with the data subset; let's call it E. Experimental results show that E is generally suitable when it's close to D*K / 2. A value that is too high for E leads to a large number of expert networks and high resource consumption; a value that is too low diminishes the advantages of data partitioning and is unsuitable for scenarios with many anomaly types. The illustration also uses... For example, G1 will... Training is assigned to a specific AES set, while other subsets of AES sets are trained. The reasoning is complete. See below for details on the implementation.

[0073] The present invention will now be further described in conjunction with the accompanying drawings and embodiments, such as... Figure 1 As shown, an active anomaly detection method driven by data-independent subsets and multi-expert hybrid training includes the following steps.

[0074] S1: Initial conditions. Given an initial dataset without labels. The sample feature dimension is d. If it is image data, deep features are extracted and represented by a given backbone network (such as ResNet18). A certain proportion of real anomalies are mixed into this initial unlabeled dataset, where the number of real anomaly samples is generally much smaller than the number of normal samples. This active learning method is mainly applied to a semi-supervised anomaly detection ensemble model—the expert network ε—where the unlabeled data is a single-class classification. It maps the input x to an anomaly score in the range [0, 1], where the closer the value is to 1, the higher the probability that x is an anomaly.

[0075] y = ε(x).

[0076] S2: Construct and train an anomaly detection ensemble model, which includes E copies of ε, ε1, ε2…ε E D gated networks G1, G2…G D In this context, the gating network and the subsets are in one-to-one correspondence, and one subset corresponds to multiple ε.

[0077] S2-1: Let t = 1, initialize...

[0078] S2-2: The similarity of anomalous samples is rarely mentioned or considered. In fact, mislabeled anomalous samples may also cause expert networks to have difficulty identifying similar anomalies. This invention designs a diversity and similarity partitioning module (DSS), such as... Figure 2 As shown, based on the scores obtained from each round of active learning, a threshold is set to divide the unsupervised sample pool into two parts. The top-ranked samples are divided according to feature similarity, while the bottom-ranked samples are divided considering the diversity of each subset. Therefore, an important assumption of this approach is that a relatively reliable expert network has been trained, and the scores of the inferred anomalous samples are generally higher than the scores of the normal samples.

[0079] Using the diversity and similarity segmentation module DSS to... Divide into D subsets as evenly as possible. D subsets This constitutes a private pool, where no two subsets share common data. and They were isolated from each other during training. Each subset Merging Construct the i-th semi-supervised training subset

[0080] For the top λ% of unlabeled samples in the anomaly score ranking, DSS groups data with high similarity together as much as possible. This is because the proportion of potentially true anomalies in this data segment is relatively high. Since anomaly data also comes in different types, data of the same type are highly similar, for example... Figure 2 The dataset shown contains three different types of anomalies, with similar anomalies being more concentrated. Simply using random averaging might lead to anomalies of the same type being divided into multiple different subsets, incorrectly using similar anomaly samples, causing expert networks to fail in their inferences for this anomaly type, and significantly weakening the segmentation effectiveness. To reduce interference between similar anomalies, for simplicity, this invention uses FasterPAM (an accelerated implementation of the k-medoids clustering algorithm) to sample E groups from the top λ% of unlabeled data in the score ranking, i.e., setting the number of cluster centers to E.

[0081] The remaining samples, ranking in the bottom 1-λ%, are distributed as diversely as possible across different subsets, ensuring that each subset covers the overall data distribution as much as possible. All centroids are collected into a single sample subset, and sampling is repeated without replacement until all inputs have been assigned. Random partitioning is no longer used, reducing the impact of random seeds on the final result. Furthermore, data partitioning is closely integrated with the active learning cycle, fully utilizing the information from each round of feedback and the distribution of data features.

[0082] If there is no anomaly score feedback in the initial stage of the anomaly detection ensemble model, then feature diversity partitioning is used.

[0083] To fully utilize the labeled samples after each round of active learning iterations, they are repeatedly added to various data subsets, forming the inputs to the semi-supervised expert groups of the expert hybrid network. Therefore, based on this characteristic, this labeled data is called the public pool. Each training subset consists of the following: Each can independently complete the entire anomaly detection training task.

[0084] S2-3: The training of the expert hybrid network is based on all subsets being carried out simultaneously, and the training samples in each batch are composed of the same number of samples randomly sampled from D training subsets.

[0085] The training of the expert hybrid network is based on simultaneous training across all subsets. Each iteration completes N epochs, with B batches of training samples completed in each epoch. Each batch consists of the same number of samples randomly sampled from D training subsets. B represents the total number of batches, and b represents the batch number. S2-4: [The remaining text appears to be incomplete and requires further context.] The samples inside were processed by G i The mapping yields an E-dimensional probability vector, i = 1, 2, ..., D. The probability values ​​are then arranged in descending order. The samples are assigned to the top-k k ε values ​​corresponding to the highest probability values. The ensemble output is the weighted sum of the output of the corresponding replica and the corresponding probability. The loss of the anomaly detection ensemble model is calculated, and the parameters of the anomaly detection ensemble model are updated based on this loss. In the active selection phase, after N cycles, for Select replicas whose usage frequency is greater than the selection threshold. Corresponding Active Expert Group (ABS) i .

[0086] For anomaly detection ensemble models, D expert networks are trained based on D subsets. These expert networks have identical network structures and use the same form of task loss for anomaly detection training. The difference lies in the fact that their parameters are independent, and each trains a weak expert with independent reasoning capabilities.

[0087]

[0088] in express The kth sample in the dataset.

[0089] S2-4-1: Since the unlabeled parts of the training subset are only trained on the corresponding experts, this invention introduces the existing expert hybrid model MoE into an active anomaly detection framework driven by data-independent subsets and multi-expert hybrid training. The number of expert networks does not need to be aligned with the number of subsets, and is denoted as E. Samples need to be assigned to multiple experts, and the final result is a weighted sum of their outputs. The contributions of multiple experts are represented by trainable weights W. i g The gating network G is learned. By receiving the same input as the experts, G calculates the weights corresponding to the outputs of each expert in the final ensemble result. Since the weights are dynamically adjustable, the contribution of each expert's inference result can be constrained and controlled using a loss term. On the one hand, the experts corresponding to the top K output probabilities are selected to receive the corresponding inputs, and low probabilities are filtered out using TopK(•,K) to achieve the purpose of sparse training. That is, each sample is not fed to all experts; only the parameters of a subset of experts are updated. On the other hand, this invention expects that the most frequently assigned experts in each training subset are not completely identical, retaining some differences. Therefore, for each training subset... Set up a separate gate G i ,convenient and G i Establish dependencies between them:

[0090]

[0091] Here This invention incorporates a masking operation to facilitate subsequent active learning. By constructing a null vector, the Hadamard product is used to mask part of the expert network. In other words, An index of 0 corresponds to a masked expert, while an index of 1 corresponds to an expert network that is actually active.

[0092] S2-4-2: During training, Use a vector whose elements are all 1s In other words, the proportion of each output contribution is completely determined by the gating network and the task objective:

[0093]

[0094] S2-4-3: This invention transforms a single detection task into a multi-subtask ensemble learning based on sample differences by partitioning the data into subsets. In other words, the training of each training subset can be regarded as an independent task, thus creatively transferring Mod-Squad to the framework of this invention, and using negative mutual information loss L... MI When applied to this invention, that is

[0095]

[0096] in Joint probability Through expert ε j Assigned to subsets on the entire dataset The frequency is approximated by the value. This loss will guide the frequency of a single subset allocated to each expert to be more concentrated. Considering the complete training process of a single training subset, only a portion of experts are used frequently, which are denoted as . The AES of this subset. In other words, some experts have hardly trained on this subset of samples, while across the entire dataset, each expert uses the data as frequently as possible, thus improving model utilization.

[0097] S2-4-4: Training subsets of each data set The training loss is recorded as Therefore, the overall loss of the model is the sum of the multi-task loss and the negative mutual information loss on the training subset, and the hyperparameter α is used to adjust the relationship between the two:

[0098]

[0099] S2-4-5: This invention adopts the most commonly used anomaly score ranking principle actively selected for this task. That is, at the end of each training iteration, the data with the most anomalous model inference results is labeled. When inferring the anomalousness of unlabeled samples, since they are considered normal samples and assigned pseudo-labels under a single-class setting, their identification cannot be completed by their corresponding active expert group. In this invention, unlabeled samples in each data subset are given inferences by other experts who have not been trained on that data, and their anomaly scores are obtained after integrated calculation.

[0100] 1) During the sample selection stage, due to L MI prompting each subset Feed more to a fixed number of experts ε j Therefore, this invention needs to record ε after b batches of training. j quilt Frequency of use Specifically, the forgetting factor μ is dynamically updated:

[0101]

[0102] I b，i This indicates that it belongs to a subset in batch b. The index of all samples is updated. This update method avoids the problem of insufficient coupling between the data subset and the expert network due to insufficient training of the gating network in the early stages of model training. At the same time, the μ value is set relatively small to prevent subsequent batches from having an excessive impact on the overall allocation. Specifically, This indicates an indicator function responsible for filtering experts who have hardly ever been used, i.e.

[0103]

[0104] Before data selection begins, this invention establishes a corresponding AES for each data subset, which is a specific combination of experts whose frequency exceeds θ.

[0105] 2) Utilizing the filtering effect of the mask mentioned above, according to G... i The corresponding AES index will The corresponding element is set to 1, and the remaining positions are filled with -∞. The advantage of this setting is that -∞, after being processed by Softmax, results in a probability of 0, and the data... Will be G j Assigned to the corresponding AES, that is

[0106]

[0107] 3) Use The corresponding AFS are for private pools. The kth sample Individual inferences are then ensembled into a final result. Considering the combined training and selection process, this is similar to cross-validation.

[0108]

[0109] Here R i = (1, ..., D}\{i}. S2-5: ... Unlabeled samples were processed by G i Assigned to the Active Expert Group AES j Inference is performed on j∈{1,2,...,D}\{i}, which is the anomaly score of the unlabeled sample. The anomaly scores are sorted in descending order, and the top M unlabeled samples with the highest anomaly scores are labeled. The labeled samples are then placed into... In the middle, the top M unlabeled samples with the abnormal score are deleted from their corresponding subsets, and the data is updated. and

[0110] S2-6: Let t = t + 1;

[0111] S2-7: If t > T, output the pre-trained anomaly detection ensemble model and proceed to the next step; otherwise, return to S2-2.

[0112] S3: Using the update after the Tth iteration and The updated training subset is obtained using the S2-2 method. The updated Input the pre-trained anomaly detection ensemble model, and after N epochs, for each updated... The updated corresponding active expert group is obtained, which is the trained anomaly detection ensemble model.

[0113] Based on the ensemble results of the anomaly scores predicted by various expert networks, the samples in the unlabeled dataset are sorted from high to low, and the top M samples are selected for annotation. After annotation, the corresponding samples are removed from the unlabeled dataset and added to the annotation pool. Iterative training is then performed until the agreed-upon number of labeled samples is reached.

[0114] A value too large for M results in fewer iterations, failing to train an optimal model and providing insufficient selection criteria, thus failing to achieve the best performance. Conversely, a value too small for M leads to excessive iterations, causing training efficiency issues. Therefore, determining the appropriate M value is crucial, using a suitable M value for different datasets. For ease of comparison, this invention employs the same annotation method as previous active anomaly detection schemes, i.e., M = 20.

[0115] Each time the private and public pools are reallocated, the parameters of the expert network are initialized and retrained based on the new labels. The total number of labeled samples in the entire active learning process is T*M. Similarly, this invention adopts the same setting as before, with T set to 5, resulting in 100 labeled samples in total. To reduce the cost of manual labeling in the experiment, this embodiment uses a fully labeled dataset. In the initial stage, the labels of all samples are masked and used as unlabeled samples. Once a sample is selected as a sample to be labeled, it is no longer masked in subsequent training, and its label from the dataset is directly used. It is also assumed that the labelers are error-free and their labels are always correct; labeling errors are not considered here.

[0116] The expert hybrid network is trained again using T*M labeled samples and unlabeled samples, without any tuning, to obtain the final ensemble model that can be used for anomaly detection inference.

[0117] S4: After all the active learning cycles, the final model will be used for outlier reasoning. This invention discusses two different scenarios: inductive and inductive. In inductive learning, unlabeled samples need to be cross-validated on other active expert groups, while in other cases, the ensemble results of reasoning from all expert networks are used.

[0118] S4-1: For unlabeled data, the inference in the inductive scenario follows the same process as step 3) in S2-4-5, and the integration result does not include the output of the expert group that may have erroneously labeled it.

[0119] S4-2: For both invisible and labeled data, the degree of anomaly is directly calculated using the ensemble results provided by all expert networks. This is because the invisible dataset... The labeled data never appeared in the training, while it was used in training on all data. Therefore, there was no need to additionally isolate the expert network and the test samples.

[0120]

[0121] Table 1. Comparison of the present invention with existing methods (Average Accuracy AUC)

[0122]

[0123] Table 2. Comparison of variants in the similarity and diversity division modules

[0124]

[0125] This invention uses the Cifar10 dataset to verify the rationale behind its claims. Cifar10 consists of 10 different categories: airplane, car, bird, cat, deer, dog, frog, horse, boat, and truck, distinguished by labels ranging from 0 to 9. The samples are 32*32 pixel RGB images. Following the ADBench benchmark, each class in the Cifar10 dataset has 5263 samples, including 5000 normal samples and 263 anomalous samples. After feature extraction using ResNet18, each sample is individually mapped to a 512-dimensional feature representation. For fair comparison, both this invention and its comparison objects are based on the DeepSAD semi-supervised anomaly detection ensemble model. The main comparison focuses on the common anomaly ranking and selection principle used in past work: selecting the most anomalous sample in each round as the labeled object, which serves as the baseline method, compared with the simple implementation IAE and the complex implementation AES of this invention. The evaluation criteria used for comparison were the anomaly detection curve (ADC) and the area under the ROC curve (AUC). The former plots the relationship between the number of anomalies detected and the number of queries, while the latter compares the accuracy of the final expert network. All experiments in this paper were repeated 10 times using different random seeds, and the final results were averaged. The values ​​were: D = 5, E = 8, K = 3, θ = 0.05, and λ = 0.35.

[0126] Figure 5 This paper demonstrates the number of anomalous samples discovered by this invention on the Cifar10 dataset. Using this invention, anomaly sorting can uncover more potential anomalies in the data.

[0127] Table 1 shows the comparison between the two variants of the present invention and the baseline method. The bold text indicates the highest detection accuracy. It is clear that AES outperforms both IAE and the baseline method on most classes of Cifar10, and IAE also performs much better than the baseline method. This shows that even a simple expert-replicated cross-validation method can more effectively stimulate the performance of the semi-supervised model.

[0128] Table 2 shows the results of a combined comparative experiment of the similarity and diversity segmentation modules based on AES. SS represents feature similarity segmentation, and DS represents feature diversity segmentation. If SS or DS is not used, a random method is used. The results in the table show that using both SS and DS simultaneously yields the best results, indicating that the similarity and diversity segmentation modules have some effect. Due to the simple implementation method used, the improvement in performance is limited. This invention provides a feasible segmentation method for reference.

Claims

1. An active anomaly detection method of data-independent subset-driven multi-expert hybrid training, characterized in that: Includes the following steps: S1: Initial condition: Given an initial dataset without labels , wherein real abnormal data is mixed in, represents a real number set, n represents the number of samples in each sample in d represents the feature dimension; Using semi-supervised anomaly detection experts , Following the assumption that the unlabeled data part is single class, infer an anomaly score for each sample individually; S2: build and train an anomaly detection ensemble model, the anomaly detection ensemble model comprising one copy of an expert mixed network, D gated networks , wherein the gated networks and the subsets are one-to-one correspondence, one subset corresponds to multiple ; S2-1: Let... Set a threshold and initialize the public pool. ; S2-2: Using the diversity and similarity partitioning module DSS to... Divide into as evenly as possible Subset , Subset This constitutes a private pool, where no two subsets share common data. and During training, they are isolated from each other, each subset Merging Constituting the first A subset of supervised training , ; S2-3: The training of the expert hybrid network is carried out simultaneously on all subsets. N cycles are completed in one iteration, and B batches of training samples are completed in each cycle. Each batch consists of the same number of samples randomly sampled from D training subsets. S2-4: For each batch The samples inside were processed The mapping yields an E-dimensional probability vector, i = 1, 2, ..., D. The probability values ​​are then arranged in descending order. The middle samples are respectively assigned to the k corresponding to the top-k probability values. The integrated output is a weighted sum of the output of the corresponding replica and the corresponding probability. The loss of the anomaly detection ensemble model is calculated, and the parameters of the anomaly detection ensemble model are updated based on the loss. In the active selection phase, after completing N cycles, for Select replicas whose usage frequency is greater than the selection threshold. Corresponding active expert group ; S2-5: Will Unlabeled samples in D = 1, 2, ... D were processed Assigned to the active expert group , Inference is performed, and each unlabeled sample yields D-1 outlier scores. The average of these D-1 outlier scores is the outlier score for that unlabeled sample. The outlier scores are then sorted in descending order, and the top-ranked outliers are selected. Label the unlabeled samples and then put the labeled samples into... In the middle, at the same time, the abnormal score is in front Each unlabeled sample is removed from its corresponding subset, and the following is updated: and ; S2-6: Order ; S2-7: If If the model is not trained, output the preliminarily trained anomaly detection ensemble model and proceed to the next step; otherwise, return to S2-2. S3: Using the update after the Tth iteration and The updated training subset is obtained using the S2-2 method. , , will be updated Input the pre-trained anomaly detection ensemble model, and after N epochs, for each updated... The updated corresponding active expert group is obtained, which is the trained anomaly detection ensemble model; S4: Input a test data into the trained anomaly detection ensemble model. Each active expert group outputs the data to be tested. An abnormal score will The average of the anomaly scores is the anomaly score of the data to be tested. The higher the anomaly score, the greater the possibility that the data to be tested is abnormal.

2. The active anomaly detection method driven by data-independent subsets and multi-expert hybrid training as described in claim 1, characterized in that: S2-2 uses DSS to Divide into as evenly as possible The steps for creating a subset are as follows: Based on the abnormal scores obtained from each round of active learning S2-4, a threshold is set to divide the unsupervised sample pool into two parts. The top-ranked samples are divided according to feature similarity, while the bottom-ranked samples are divided according to the diversity of sample features. Before sorting outlier scores %Unlabeled samples, sorted from outlier scores % Sampled from unlabeled data Groups, i.e., the number of cluster centers set is ; The remaining rankings are below. The unlabeled samples are then evenly distributed into different subsets according to the diversity of sample features, so that the unlabeled samples in each subset can cover the overall data distribution as much as possible. If there is no anomaly score feedback during the initialization phase of the anomaly detection ensemble model, then the data is divided according to the diversity of sample features.

3. The active anomaly detection method driven by data-independent subsets and multi-expert hybrid training as described in claim 2, characterized in that: The S2 training process for the anomaly detection ensemble model includes: In a hybrid expert network, the same sample is assigned to multiple expert networks, and the final result is a weighted sum of their outputs. By receiving the same input as the expert networks, the gating network calculates the weights of each expert network's output in the final ensemble result. With trainable weights , for each Set one separately : in It is a masking operation, using the Hadamard product to mask part of the expert network; An index of 0 corresponds to a masked replica, while an index of 1 corresponds to a replica that is actually active. express One of the samples; During the training of the anomaly detection ensemble model Use a vector whose elements are all 1s ; in , and Representing subsets The The input, the corresponding integrated output, and the... A network of experts; in , Joint probability Through the j-th copy exist Assigned to The frequency is used to approximate the result; , , or Representing expert networks The probability of being used The probability of being assigned, Assigned to The probability of negative mutual information loss; The training loss is recorded as Therefore, the overall loss of the anomaly detection ensemble model is... The sum of the multi-task loss and negative mutual information loss across each training subset is calculated using hyperparameters. To regulate the relationship between the two: 。 4. The active anomaly detection method driven by data-independent subsets and multi-expert hybrid training as described in claim 3, characterized in that: The active selection phase S2-4 includes the following steps: Record in the process After each batch of training quilt Frequency of use Using the forgetting factor Dynamic update method: in Indicates in batch The middle belongs to a subset The index of all samples, This indicates an indicator function responsible for filtering functions that are rarely used. , Representing a subset In batch The first in One sample; in, This represents the input scalar value. and The output of the indicator function is corresponding to both positive and non-positive values. according to The corresponding AES index will Set the element at the corresponding position to 1, and use 1 for the rest. filling: use The corresponding AES values ​​are respectively for The Sample Individual inferences are then combined to form the final result: in .

5. The active anomaly detection method driven by data-independent subsets and multi-expert hybrid training as described in claim 4, characterized in that: The abnormal score s of the test data in S4 is calculated as follows:

Images