An abnormality detection model training method and device, and an electronic device

Abstract

The embodiment of the application discloses a kind of training method, device, electronic equipment and storage medium of abnormal detection model, belong to core network technical field, including: obtaining sample original data in special network preset time period, sample original data is preprocessed, and sample original data vector after pre-processing is obtained;Based on the data labeling model of pre-training unsupervised learning, data labeling processing is carried out to sample original data vector, and abnormal value after labeling processing is obtained;Performance data is analyzed in time sequence and feature vector is extracted, and sample time sequence feature vector is obtained;Sample time sequence feature vector is input into neural network module in abnormal detection model, sample abnormal feature vector in sample time sequence feature vector is extracted by neural network module, and sample abnormal data is output based on sample abnormal feature vector;Based on sample abnormal data and abnormal value, abnormal detection model is trained, and the problem of labeling difficulty, insufficient detection precision of to-be-detected data is solved.

Description

Technical Field

[0001] This application relates to the field of core network technology, and in particular to a training method, apparatus, electronic device and storage medium for an anomaly detection model. Background Technology

[0002] The current private network performance data records the network's operational status. Analyzing these performance metrics can detect any anomalies in the private network. When anomalies are detected, they are addressed before user complaints, reducing the number of complaints and improving the user's network experience.

[0003] In related technologies, the detection methods for anomalies in 5G private networks usually adopt statistical methods or machine learning-based methods for anomaly identification, but these still cannot solve the problems of difficulty in labeling the data to be detected and insufficient detection accuracy. Summary of the Invention

[0004] The purpose of this application is to provide a training method, apparatus, electronic device, and storage medium for an anomaly detection model, in order to solve the problems of difficulty in labeling the data to be detected and insufficient detection accuracy.

[0005] To solve the above-mentioned technical problems, the embodiments of this application are implemented as follows:

[0006] In a first aspect, embodiments of this application provide a training method for an anomaly detection model, comprising: acquiring sample raw data within a preset time period of a private network, and preprocessing the sample raw data to obtain a preprocessed sample raw data vector, wherein the sample raw data includes performance data and / or alarm data of network element operating status in the private network; performing data annotation processing on the sample raw data vector based on a pre-trained unsupervised learning data annotation model to obtain anomaly values ​​after annotation processing; performing time-series analysis and feature vector extraction on the performance data to obtain sample time-series feature vectors; inputting the sample time-series feature vectors into a neural network module in the anomaly detection model, extracting sample anomaly feature vectors from the sample time-series feature vectors through the neural network module, and outputting sample anomaly data based on the sample anomaly feature vectors; and training the anomaly detection model based on the sample anomaly data and the anomaly values.

[0007] Secondly, embodiments of this application provide a method for monitoring anomalies in a private network, comprising: acquiring alarm data of the private network; acquiring performance data of the corresponding network element of the private network within the alarm time period based on the alarm data; inputting the performance data into an anomaly detection model and outputting anomaly data, wherein the anomaly detection model is obtained by the anomaly detection training method according to any one of claims 1 to 5; and filtering the anomaly data through alarm level rules to obtain filtered anomaly data of the private network.

[0008] Thirdly, embodiments of this application provide a training apparatus for an anomaly detection model, comprising: an acquisition module, configured to acquire sample raw data within a preset time period of a private network, and preprocess the sample raw data to obtain a preprocessed sample raw data vector, wherein the sample raw data includes performance data and / or alarm data of network element operating status in the private network; an annotation module, configured to perform data annotation processing on the sample raw data vector based on a pre-trained unsupervised learning data annotation model to obtain anomaly values ​​after annotation processing; a time series analysis module, configured to perform time series analysis and feature vector extraction on the performance data to obtain sample time series feature vectors; an output module, configured to input the sample time series feature vectors into a neural network module in the anomaly detection model, extract sample anomaly feature vectors from the sample time series feature vectors through the neural network module, and output sample anomaly data based on the sample anomaly feature vectors; and a training module, configured to train the anomaly detection model based on the sample anomaly data and the anomaly values.

[0009] Fourthly, embodiments of this application provide an electronic device, including a processor and a memory electrically connected to the processor, the memory storing a computer program, and the processor being used to call and execute the computer program from the memory to implement the above-described training method for an anomaly detection model.

[0010] Fifthly, embodiments of this application provide a computer-readable storage medium for storing a computer program that can be executed by a processor to implement the above-described training method for an anomaly detection model.

[0011] Sixthly, embodiments of this application provide a chip, the chip including a processor and a communication interface, the communication interface being coupled to the processor, the processor being used to run programs or instructions to implement the above-described training method for an anomaly detection model.

[0012] In a seventh aspect, embodiments of this application provide a computer program product, the computer program product including a computer program, which, when executed by a processor, implements the above-described training method for an anomaly detection model.

[0013] The technical solution of this application embodiment acquires sample raw data within a preset time period of the private network, and preprocesses the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data related to the operating status of network elements in the private network. Based on a pre-trained unsupervised learning data annotation model, the sample raw data vector is annotated to obtain anomalies. Temporal analysis and feature vector extraction are performed on the performance data to obtain sample temporal feature vectors. The sample temporal feature vectors are input into the neural network module of the anomaly detection model. The neural network module extracts sample anomaly feature vectors from the sample temporal feature vectors and outputs sample anomaly data based on these vectors. The anomaly detection model is trained based on the sample anomaly data and anomalies. It is evident that a pre-trained unsupervised learning data labeling model can automatically label and process the original sample data to obtain outliers without the need for manual labeling of large amounts of data. By performing time-series analysis on performance data and extracting sample anomaly feature vectors using a neural network module, sample anomaly data is output based on the sample anomaly feature vectors. An anomaly detection model is then trained based on the sample anomaly data and outliers. The trained anomaly detection model can mine the anomaly features of the original sample data from multiple dimensions through time-series analysis and identify sample anomalies through detailed analysis of the performance data in the original sample data. This can solve the problems of difficult labeling of the data to be detected and insufficient detection accuracy. Attached Figure Description

[0014] To more clearly illustrate the technical solutions in one or more embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in one or more embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0015] Figure 1 This is a schematic flowchart of a training method for an anomaly detection model according to an embodiment of this application;

[0016] Figure 2 This is a schematic diagram of the structure of a PDU session number according to an embodiment of this application;

[0017] Figure 3 This is a schematic diagram of the UPF flow rate change according to an embodiment of this application;

[0018] Figure 4 This is a schematic diagram of the uplink / downlink rate / packet loss rate of DPI according to an embodiment of this application;

[0019] Figure 5This is a schematic diagram of an anomaly detection model structure according to an embodiment of this application;

[0020] Figure 6 This is a schematic flowchart of a training method for an anomaly detection model according to another embodiment of this application;

[0021] Figure 7 This is a schematic flowchart of a method for monitoring anomalies in a private network according to an embodiment of this application;

[0022] Figure 8 This is a schematic block diagram of a training apparatus for an anomaly detection model according to an embodiment of this application;

[0023] Figure 9 This is a schematic diagram of the hardware structure of a training device for an anomaly detection model according to an embodiment of this application. Detailed Implementation

[0024] This application provides a training method, apparatus, electronic device, and storage medium for an anomaly detection model to solve the problems of difficult data labeling and insufficient detection accuracy.

[0025] To enable those skilled in the art to better understand the technical solutions in this application, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this application.

[0026] The training method for the anomaly detection model provided in this application can be executed by an electronic device or by software installed in an electronic device. Specifically, the electronic device can be a terminal device or a server device. The terminal device can include smartphones, laptops, smart wearable devices, vehicle terminals, etc., and the server device can include an independent physical server, a server cluster consisting of multiple servers, or a cloud server capable of cloud computing.

[0027] The training method of an anomaly detection model provided in this application will be described in detail below with reference to the accompanying drawings, through specific embodiments and application scenarios.

[0028] Figure 1 The diagram illustrates a schematic flowchart of a training method for an anomaly detection model according to an embodiment of the present invention, the method comprising the following steps:

[0029] S102, acquire the original sample data within a preset time period of the private network, and preprocess the original sample data to obtain the preprocessed original sample data vector.

[0030] The original sample data includes performance data and / or alarm data of network elements in the private network.

[0031] Within a preset time period for the private network, including during the operation of the 5G private network, sample raw data is collected over a period of time, such as collecting network element performance data of the private network within the past 3 months, with a data collection granularity of 15 minutes.

[0032] Performance data primarily includes data related to the 5G core network's Session Management Function (SMF), User Plane Function (UPF), and user-side performance data (Deep Packet Inspection, DPI). Specifically, SMF describes the average number of Professional Development Units (PDU) sessions and the PDU session establishment success rate; UPF describes the Packet Forwarding Control Protocol (PFCP) session establishment success rate and the number of uplink and downlink bytes per interface; and DPI describes the Transfer Control Protocol (TCP) establishment success rate, average data rate, and packet loss rate.

[0033] Alarm data mainly includes: alarm data of network elements within the corresponding preset time period. The alarm types mainly include: software system, hardware system, communication system, signaling system, and service quality type faults.

[0034] Preprocessing of the original sample data includes: data cleaning, data exchange, and data augmentation to obtain the feature vector of the original sample data after data preprocessing.

[0035] Therefore, performance data is used to describe the operating status information of major network elements. Combined with alarm data, it constitutes the original sample data for detecting anomalies in core network element indicators. The original sample data is then preprocessed to obtain the feature vector of the original sample data, which is used as the training set to train the anomaly detection model.

[0036] S104 is a pre-trained unsupervised learning-based data labeling model that performs data labeling on the original sample data vectors to obtain labeled outliers.

[0037] The performance data in the original sample data lacks data labels and cannot be directly input into the anomaly detection model for training. Therefore, a pre-trained unsupervised learning data labeling model can be used to automatically label the original sample data. The data labeling model is the Transformer Auto Encoder (transAE) model. The transAE model is based on the encoder-decoder principle, which does not require complex data processing or human experience. It uses the original sample data vectors to reconstruct the anomaly data values ​​and then labels them to obtain the anomaly values, thus achieving efficient data labeling.

[0038] Since manual data annotation cannot quickly label large amounts of data, unsupervised learning methods use data annotation models to quickly label data. They have good accuracy and can meet the requirements of labeling large amounts of data. The labeled outliers can be used as a label set to train anomaly detection models.

[0039] S106 performs time-series analysis and extracts feature vectors from the performance data to obtain sample time-series feature vectors.

[0040] Specifically, time-series analysis of performance data is performed from multiple dimensions. For example, aggregation analysis is conducted on session data in the SMF corresponding to the Deep Network Name (DNN); network traffic data on User Plane Function (UPF) devices is statistically analyzed at the network element granularity; and data such as uplink / downlink average speed and packet loss rate are statistically analyzed at the slice granularity. By statistically analyzing the changes in performance data from multiple dimensions and extracting the corresponding feature vectors, sample time-series feature vectors of performance data in each dimension are obtained.

[0041] S108, input the sample time-series feature vector into the neural network module in the anomaly detection model, extract the sample anomaly feature vector from the sample time-series feature vector through the neural network module, and output the sample anomaly data based on the sample anomaly feature vector.

[0042] The temporal feature vectors of the samples obtained from time-series analysis are input into the neural network module of the anomaly detection model. The neural network module includes a Long Short-Term Memory (LSTM) module, which is used for temporal feature extraction. The LSTM module has a moderate number of parameters, enabling rapid extraction of temporal features. After generating the temporal feature vectors, they are joined to form the sample anomaly feature vectors. Based on the sample anomaly feature vectors, the sample anomaly data is output.

[0043] S110 trains the anomaly detection model based on sample abnormal data and outliers.

[0044] Based on the sample anomaly data and outliers after time series analysis and feature vector extraction, a comparison is made, and the parameters in the anomaly detection model are adjusted to train the anomaly detection model. The parameters in the anomaly detection model, such as the parameters of the neural network module in the anomaly detection model, are adjusted to make the output sample anomaly data and outliers more consistent.

[0045] The technical solution of this application embodiment acquires sample raw data within a preset time period of the private network, and preprocesses the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data related to the operating status of network elements in the private network. Based on a pre-trained unsupervised learning data annotation model, the sample raw data vector is annotated to obtain anomalies. Temporal analysis and feature vector extraction are performed on the performance data to obtain sample temporal feature vectors. The sample temporal feature vectors are input into the neural network module of the anomaly detection model. The neural network module extracts sample anomaly feature vectors from the sample temporal feature vectors and outputs sample anomaly data based on these vectors. The anomaly detection model is trained based on the sample anomaly data and anomalies. It is evident that a pre-trained unsupervised learning data labeling model can automatically label and process the original sample data to obtain outliers without the need for manual labeling of large amounts of data. By performing time-series analysis on performance data and extracting sample anomaly feature vectors using a neural network module, sample anomaly data is output based on the sample anomaly feature vectors. An anomaly detection model is then trained based on the sample anomaly data and outliers. The trained anomaly detection model can mine the anomaly features of the original sample data from multiple dimensions through time-series analysis and identify sample anomalies through detailed analysis of the performance data in the original sample data. This can solve the problems of difficult labeling of the data to be detected and insufficient detection accuracy.

[0046] In one embodiment, performing time-series analysis and feature vector extraction on performance data to obtain sample time-series feature vectors (i.e., S106) can be achieved by executing the following steps A1-A4:

[0047] Step A1: Based on the aggregation analysis of session data in SMF network elements in the performance data, determine the session change data in the session data.

[0048] By aggregating and analyzing PDU session-related data of SMF network elements using different DNNs, time-series variation curves of PDU session-related data are obtained. A PDU session refers to the communication process between a user terminal and the data network.

[0049] like Figure 2As shown, the number of PDU sessions was recorded from September 21, 2022 to October 1, 2022. The curve represents the number of PDU sessions, and its values ​​show a clear pattern. The nighttime period (0:00-8:00) is a low-incidence period with fewer sessions, while the daytime period (8:00-23:00) is a high-incidence period with more sessions. The straight line represents the PDU session establishment success rate, which is the ratio of the number of successful PDU session establishments to the number of requests.

[0050] When an anomaly occurs in the 5G private network, the SMF network element indicator, PDU session count, will suddenly drop during busy hours, and the establishment success rate curve will fluctuate. To measure the anomaly of the network element indicator, key performance indicators within a sliding window range are statistically analyzed during the busy time interval. The calculation method is as follows:

[0051]

[0052] Where D is the sliding window time range, d is the sampling time interval (e.g., 15 minutes), and x k Let x be the sampled value at time k. s x is the sampled value at the start of the sliding window. e This represents the sampled value at the end of the sliding window. The area of ​​the trapezoid formed by the two sampled points and the horizontal axis is (x1+x2)·d / 2. The degree of sudden drop in PDU session count is measured by calculating the ratio of the area between each sampled point within the sliding window (decreasing to a negative value) to the area between the two sampled points at the ends. i .

[0053] When the PDU session establishment success rate fluctuates significantly, it indicates a potential anomaly. The duration (δ) of the session establishment success rate (rate) within the sliding window is used to measure this anomaly. j As shown in the following formula:

[0054]

[0055] By aggregating and analyzing the session data in the SMF network element of the performance data, a curve of the number of sessions is obtained. Based on this curve, the session change data in the session data is determined. For example, if there is a sudden drop in the number of sessions, the drop point is determined to be abnormal session data.

[0056] Step A2: Determine the UPF traffic change data based on the traffic change data of the UPF traffic data in the statistical performance data.

[0057] UPF is primarily responsible for routing and forwarding user plane data packets in the 5G core network. It collects network traffic data on each UPF device at the core network element level, including the number of Internet Protocol (IP) packets sent / received and the number of bytes sent / received, analyzing the changes in network element traffic at different times. When a network element experiences an anomaly, the traffic data may suddenly drop to a very small value, such as... Figure 3 As shown, the data recorded from May 1, 2023 to May 29, 2023 is presented. The curves in the figure represent the traffic changes in the number of IP packets sent by the interface, the number of IP packets received by the interface, the number of bytes sent by the interface, and the number of bytes received by the interface.

[0058] Obtain the window to be detected, compare the traffic value within the current time window with the historical 7-day average, and determine that the UPF traffic is abnormal when the difference exceeds the threshold, as shown in the following formula:

[0059] f u =diff(mean(u k-7 :u k-1 ),u k ) / mean(u k-7 :u k-1 )

[0060] Where u k Let f be the flow rate at time k. u This describes changes in traffic flow. UPF traffic anomalies are related to the operational status of network elements, and traffic time-series analysis can identify abnormal UPF traffic data.

[0061] Step A3: Determine the DPI change data based on the average uplink and downlink rates and / or packet loss rate of the user-side performance DPI in the statistical performance data.

[0062] By statistically analyzing data such as average uplink and downlink speeds and packet loss rates of 5G private networks at the slice granularity, and examining the changes in DPI performance indicators at various times, it is possible to identify sudden drops in DPI indicators when private network service anomalies occur. Figure 4 The data shown represents the changes in average downlink speed, average uplink speed, and client downlink packet loss rate from April 8, 2023 to April 13, 2023. A sudden drop occurred on April 10, which suggests that the corresponding private network service may have experienced an anomaly.

[0063] Step A4: Based on session change data, traffic change data, and DPI change data, extract the corresponding feature vectors to obtain the sample time-series feature vectors.

[0064] Based on the acquired session change data, traffic change data, and DPI change data, abnormal session data, abnormal traffic data, and abnormal DPI data can be identified. It is also possible to determine the data at the corresponding time points and extract the corresponding feature vectors. Based on the feature vectors, time-series analysis is performed to obtain sample time-series feature vectors with time order.

[0065] In this embodiment, time-series analysis of performance data in the original sample data is performed from multiple dimensions, including SMF, UPF, and DPI. Statistical features are calculated based on the trends of indicators in each dimension, and data changes within a preset time period are statistically analyzed. From the statistical changes in the multi-dimensional data, strongly correlated abnormal and normal data in each dimension are identified. Feature vectors are extracted for each dimension based on the abnormal and normal data, thus obtaining the sample time-series feature vector for each dimension. By deeply mining the changes in performance data in the original sample data from multiple dimensions, fine-grained analysis of the original sample data can be achieved, improving the accuracy of detection.

[0066] In one embodiment, the sample time-series feature vector is input into the neural network module of the anomaly detection model. The neural network module extracts the sample anomaly feature vector from the sample time-series feature vector and outputs the sample anomaly data based on the sample anomaly feature vector (i.e., S108). The following steps B1-B2 can be performed:

[0067] Step B1: Input the sample time-series feature vector and the identity ID class features corresponding to the obtained private network elements into the neural network module of the anomaly detection model, and extract the sample anomaly feature vector from the sample time-series feature vector according to the activation function in the neural network module.

[0068] ID-type features are specifically used to identify the campus and network element to which the current sample belongs. Some campus networks are frequently used, while others remain idle. Some UPFs have stable performance, while others experience frequent failures. ID-type features can incorporate inherent implicit characteristics of the private network to enhance feature expressiveness. For example, if a campus identified by an ID frequently experiences failures, the network element corresponding to that campus will always be abnormal, and the probability of anomalies occurring in that campus will be relatively high.

[0069] The ID class features corresponding to the private network elements and the sample time-series feature vectors from step A4 above are obtained and input into independent LSTM modules, respectively, and then connected to form a feature vector. The LSTM module is a special type of recurrent neural network that uses a series of gating mechanisms to control the input, output, and forgetting of information, thereby better capturing the features of time-series data. The main structure of the LSTM module includes an input gate, a forget gate, an output gate, and state information, effectively avoiding the problems of vanishing and exploding gradients, thus exhibiting significant advantages in time-series feature extraction.

[0070] The LSTM module encodes the temporal feature vectors of samples through optimization algorithms such as activation functions and loss functions, and extracts sample anomaly feature vectors from the temporal feature vectors. The sample anomaly feature vectors can be output by the concat function and the flatten parameter. The concat function can connect two or more arrays, and the flatten parameter can combine multidimensional data structures into one-dimensional arrays or lists. Using the LSTM module to extract sample anomaly feature vectors can improve the efficiency of data monitoring.

[0071] Step B2: Based on the sample anomaly feature vector, output the sample anomaly data through the classifier in the anomaly detection model.

[0072] Based on B1 above, the extracted abnormal sample feature vectors can be determined and concatenated. These concatenated feature vectors are then processed through a two-layer fully connected neural network and a softmax classifier is used to output the probability values ​​of the abnormal feature vectors. If the probability value exceeds a preset threshold, the data corresponding to the abnormal feature vector is considered abnormal. Different thresholds have different levels of accuracy; the threshold should be set according to the actual situation, without specific limitations here. Based on the probability values, the anomaly detection result, i.e., the abnormal sample data, is output. The abnormal sample data may include the output probability values ​​and / or data showing performance anomalies at a certain moment, without specific limitations here.

[0073] It should be noted that the structure of the anomaly detection model is as follows: Figure 5 As shown, statistical features, ID features, and sample time-series feature vectors obtained in step A4 are obtained. The sample time-series feature vectors are then processed by the LSTM module in step B1, and the sample anomaly feature vectors are output through the concat function and the flatten parameter. Combining the statistical features, ID features, and sample anomaly feature vectors, the output sample anomaly data is generated by Relu(128) and Relu(128) and softmax classifiers. The parameter information in the anomaly detection model can also be adjusted through backpropagation to train the anomaly detection model. The trained anomaly detection model can automatically identify sample anomaly data with finer granularity based on time-series analysis.

[0074] In this embodiment, by combining sample time-series feature vectors and ID features from multiple dimensions, the neural network module automatically extracts features to determine sample anomaly feature vectors. The anomaly detection model can output sample anomaly data, which can improve the anomaly detection accuracy of the private network, reduce invalid dispatching and waste of installation and maintenance manpower, and empower front-line production.

[0075] In one embodiment, the original sample data is preprocessed to obtain a preprocessed original sample data vector (i.e., S102), which can be achieved by performing the following steps C1-C2:

[0076] Step C1: Clean the original sample data and normalize it to obtain the normalized original sample data.

[0077] Preprocessing of sample data includes data cleaning. Specifically, the original sample data often contains a large number of missing values ​​during the collection process, making it unsuitable for direct input into the anomaly detection model. Data inconsistencies need to be addressed by filling in missing values. For example, sequences with less than 30% missing values ​​are filled with the mean, median, and extreme values ​​of the data from the same point in the previous 7 days to fill in the corresponding network element's original sample data at the current moment. Sequences with more than 30% missing values ​​are deleted.

[0078] Preprocessing of sample data also includes data transformation. Specifically, the original sample data is transformed into a form more suitable for training anomaly detection models. This includes data normalization to unify the dimensions of the data, avoid numerical explosion, and speed up the training of anomaly detection models. Data aggregation is also performed to merge and aggregate data based on key fields, so that the indicators of each dimension are concentrated into a single dataset.

[0079] Step C2: Perform data augmentation on the normalized original sample data to obtain the original sample data vector.

[0080] Preprocessing of sample data includes data augmentation. Specifically, in private network anomaly identification scenarios, the number of anomaly samples in the original sample data is small, and the original sample data has an imbalance problem. Data augmentation is required for the original sample data of anomaly types, such as increasing the amount of data by upsampling based on the SMOTE algorithm, in order to improve the generalization of the anomaly detection model.

[0081] In this embodiment, the original sample data is cleaned, transformed, and augmented to obtain a sample original data vector, which makes the original sample data used as the training set more accurate and improves the accuracy and generalization of the anomaly detection model.

[0082] In one embodiment, training the data labeling model can be performed by the following steps D1-D3:

[0083] Step D1: Input the original sample data vector into the encoder of the data labeling model to obtain the intermediate encoding vector.

[0084] The performance data in the original sample data contains a large amount of time-series data. The preprocessed original sample data vector, i.e., the original time-series vector, is input into the encoder of the data labeling model. The encoder calculates and obtains the intermediate encoded vector. The encoder is a Transformer encoding module, which includes an input part, an attention mechanism, and a feedforward neural network. Its unique self-attention mechanism can automatically extract features from multivariate time-series data.

[0085] Step D2: Input the intermediate encoded vector into the decoder to obtain the reconstructed vector.

[0086] Specifically, the decoder has a structure symmetrical to the encoder, enabling the reconstruction of temporal input data to obtain a reconstructed vector.

[0087] Step D3: The difference between the reconstructed vector and the original sample data vector is identified as an outlier. Based on the alarm data and outliers in the original sample data, the data labeling model is trained.

[0088] Outliers are the differences between the reconstructed vector and the original sample data vector. Specifically, the loss function in the data labeling model typically includes a reconstruction loss, which evaluates the similarity between the reconstructed data and the original sample data. Specifically, the cosine similarity between the reconstructed vector and the original sample data vector can be calculated. The difference between the corresponding reconstructed vector and the original sample data vector is taken as the outlier value, and this outlier value is labeled. Using the outliers and the alarm data in the original sample data, the parameters of the data labeling model are adjusted, and the data labeling model is trained. It should be noted that the data labeling model uses coarse-grained labeling; it only filters a large number of original sample data and labels the selected outlier values ​​to obtain outliers.

[0089] In this embodiment, the codec can fully utilize the original sample data information for data annotation. It trains a data annotation model by combining the temporal characteristics of the private network performance data with the codec's principles. The trained data annotation model is used to automatically filter out abnormal data values ​​before further annotation, achieving efficient and automatic data annotation, reducing the difficulty of obtaining data labels, and improving annotation reliability. It eliminates the need for manual annotation of every single data point in the original sample data, improving the efficiency of data annotation and reducing labor costs.

[0090] Figure 6 This is a schematic flowchart illustrating a training method for an anomaly detection model according to another embodiment of this application, such as... Figure 6 As shown, the method includes the following steps:

[0091] S601, obtain the original sample data within a preset time period on the private network.

[0092] The original sample data includes performance data and / or alarm data of network elements in the private network.

[0093] S602 performs data cleaning, data transformation, and data augmentation on the original sample data to obtain the preprocessed original sample data vector.

[0094] S603 pre-trains the transAE model and performs outlier annotation on the original sample data vector to obtain outliers.

[0095] S604 performs time series analysis on the original data vector of the sample from multiple dimensions and extracts feature vectors to obtain the sample time series feature vector.

[0096] Multiple dimensions include: SMF network element session change data, UPF traffic change data, and DPI change data.

[0097] S605 inputs the sample time-series feature vector and the ID-type features corresponding to the private network element into the neural network module in the anomaly detection model to extract the sample anomaly feature vector.

[0098] S606, based on the sample anomaly feature vector, outputs sample anomaly data through a classifier.

[0099] S607 trains the anomaly detection model by adjusting the parameters in the anomaly detection model based on sample abnormal data and outliers.

[0100] The specific processes from S601 to S607 described above have been explained in detail in the above embodiments and will not be repeated here.

[0101] The technical solution of this application embodiment acquires sample raw data within a preset time period of the private network, and preprocesses the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data related to the operating status of network elements in the private network. Based on a pre-trained unsupervised learning data annotation model, the sample raw data vector is annotated to obtain anomalies. Temporal analysis and feature vector extraction are performed on the performance data to obtain sample temporal feature vectors. The sample temporal feature vectors are input into the neural network module of the anomaly detection model. The neural network module extracts sample anomaly feature vectors from the sample temporal feature vectors and outputs sample anomaly data based on these vectors. The anomaly detection model is trained based on the sample anomaly data and anomalies. It is evident that a pre-trained unsupervised learning data labeling model can automatically label and process the original sample data to obtain outliers without the need for manual labeling of large amounts of data. By performing time-series analysis on performance data and extracting sample anomaly feature vectors using a neural network module, sample anomaly data is output based on the sample anomaly feature vectors. An anomaly detection model is then trained based on the sample anomaly data and outliers. The trained anomaly detection model can mine the anomaly features of the original sample data from multiple dimensions through time-series analysis and identify sample anomalies through detailed analysis of the performance data in the original sample data. This can solve the problems of difficult labeling of the data to be detected and insufficient detection accuracy.

[0102] Figure 7 This is a schematic flowchart illustrating a method for monitoring private network anomalies according to another embodiment of this application, such as... Figure 7 As shown, the method includes the following steps:

[0103] S701, retrieve alarm data from the private network.

[0104] S702, based on alarm data, obtains the performance data of the corresponding network element of the private network during the alarm period.

[0105] The performance data includes information on the operating status of network elements in the private network.

[0106] S703 inputs performance data into the anomaly detection model and outputs anomaly data.

[0107] The anomaly detection model is obtained through any of the above anomaly detection training methods.

[0108] S704 filters abnormal data through alarm level rules to obtain filtered private network abnormal data.

[0109] Currently, the scope of anomaly monitoring on the private network is too large, and the detection results output by the anomaly detection model contain a large number of false anomalies, resulting in invalid work order dispatch. In order to improve the effectiveness of work orders and reduce the waste of installation and maintenance manpower, it is necessary to improve the accuracy of anomaly identification.

[0110]

[0111] Table 1 Confusion Matrix

[0112]

[0113] The confusion matrix and precision are defined in Table 1 above, where TP indicates that the model's positive prediction is accurate; TN indicates that the model's negative prediction is correct; FP indicates that the model's positive prediction is incorrect; and FN indicates that the model's negative prediction is incorrect. Precision is the proportion of samples predicted as positive that are actually positive. Anomaly detection scenarios on private networks place greater emphasis on classification accuracy because misclassified anomalies can lead to invalid dispatch orders. To improve classification accuracy, the following two aspects should be considered:

[0114] 1. Filtering Prediction Results from Private Network Anomaly Detection Model. The anomaly prediction values ​​output by the private network anomaly detection model differ; these prediction values ​​can be considered probability values ​​of anomalous data. Selecting the top K predicted samples, sorted in descending order of prediction values, as the filtered anomaly results can improve the accuracy of the prediction results.

[0115] 2. Filtering based on alarm level rules. Device alarm information is shown in Table 2 below. The alarm level rules include, but are not limited to, the situations listed in Table 2. When a device experiences a severe alarm, it indicates a high probability of a private network anomaly. Filtering the anomaly detection model's output based on the device alarm level and time point yields anomalies strongly correlated with the device alarm, effectively improving the reliability of the identification results. Specifically, if the anomaly detection model outputs an issue related to interface status failure, the corresponding alarm level is level two, indicating significant importance, then timely action is required. If the importance level of level two is defined as moderate, even if the anomaly detection model outputs an anomaly, no action is necessary. The definition of importance can be based on experience.

[0116]

[0117]

[0118] Table 2 Equipment Alarm Level Rules

[0119] S705: Based on the filtered private network anomaly data, installation and maintenance personnel obtain anomaly indicators, and support personnel dispatch orders based on the private network anomaly data.

[0120] The specific processes from S701 to S705 have been described in detail in the above embodiments and will not be repeated here.

[0121] In summary, this method involves acquiring dedicated network alarm data, determining the corresponding time period for the alarmed dedicated network, obtaining the performance data for that time period, inputting the performance data into a trained anomaly detection model, outputting anomaly data, and filtering the anomaly data according to alarm level rules to obtain the dedicated network anomaly data. It should be understood that a large amount of dedicated network alarm data contains many false alarms; therefore, it is necessary to combine information from other dimensions to determine whether it is a genuine anomaly. The pre-trained anomaly detection model can accurately analyze and determine whether alarm data is anomaly data, and further determine the importance of the anomaly data based on alarm level rules, whether the dedicated network anomaly data requires dispatching a work order. Therefore, this dedicated network anomaly monitoring method can reduce false detection results, improve the accuracy of anomaly data detection, accurately discover business anomalies, improve the proactive fault discovery rate, and enhance the intelligent operation and maintenance level of the dedicated network.

[0122] In summary, specific embodiments of this subject matter have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing can be advantageous.

[0123] The above is a training method for an anomaly detection model provided by an embodiment of this application. Based on the same idea, an embodiment of this application also provides a training device for an anomaly detection model.

[0124] Figure 8 This is a schematic diagram of the structure of a training device for an anomaly detection model according to an embodiment of the present invention. Figure 8 As shown, the training device for the anomaly detection model includes: an acquisition module 81, an annotation module 82, a time series analysis module 83, an output module 84, and a training module 85.

[0125] The acquisition module 81 is used to acquire sample raw data within a preset time period of the private network, and preprocess the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data of the network element operating status in the private network.

[0126] The annotation module 82 is used for a data annotation model based on pre-trained unsupervised learning to perform data annotation processing on the original sample data vectors to obtain anomalies after annotation processing.

[0127] The time series analysis module 83 is used to perform time series analysis and feature vector extraction on performance data to obtain sample time series feature vectors;

[0128] The output module 84 is used to input the sample time-series feature vector into the neural network module in the anomaly detection model, extract the sample anomaly feature vector from the sample time-series feature vector through the neural network module, and output the sample anomaly data based on the sample anomaly feature vector.

[0129] Training module 85 is used to train the anomaly detection model based on sample abnormal data and outliers.

[0130] In one embodiment, the time series analysis module 83 specifically includes:

[0131] The SMF unit is used to perform aggregation analysis on the session data in the SMF network element in the performance data to determine the session change data in the session data;

[0132] The UPF unit is used to determine the UPF flow change data based on the flow change data of the UPF flow data in the statistical performance data.

[0133] The DPI unit is used to determine DPI change data based on the average uplink and downlink rates and / or packet loss rate data of DPI in the statistical performance data.

[0134] The extraction unit is used to extract the corresponding feature vectors based on session change data, traffic change data, and DPI change data to obtain the sample time-series feature vector.

[0135] In one embodiment, the output module 84 is specifically used for:

[0136] The sample time-series feature vector and the ID class features corresponding to the obtained private network elements are input into the neural network module in the anomaly detection model. The sample anomaly feature vector is extracted from the sample time-series feature vector according to the activation function in the neural network module.

[0137] Based on the sample anomaly feature vector, the anomaly data of the sample is output by the classifier in the anomaly detection model.

[0138] In one embodiment, the acquisition module 81 is specifically used for:

[0139] The original sample data is cleaned and normalized to obtain the normalized original sample data.

[0140] The normalized original sample data is then subjected to data augmentation to obtain the original sample data vector.

[0141] In one embodiment, the apparatus includes a training device for a data labeling model, specifically used for:

[0142] The original sample data vector is input into the encoder of the data labeling model to obtain the intermediate encoded vector;

[0143] The intermediate encoded vector is input into the decoder to obtain the reconstructed vector;

[0144] The difference between the reconstructed vector and the original sample data vector is identified as an outlier. Based on the alarm data and outliers in the original sample data, the data labeling model is trained.

[0145] The technical solution of this application embodiment acquires sample raw data within a preset time period of the private network, and preprocesses the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data related to the operating status of network elements in the private network. Based on a pre-trained unsupervised learning data annotation model, the sample raw data vector is annotated to obtain anomalies. Temporal analysis and feature vector extraction are performed on the performance data to obtain sample temporal feature vectors. The sample temporal feature vectors are input into the neural network module of the anomaly detection model. The neural network module extracts sample anomaly feature vectors from the sample temporal feature vectors and outputs sample anomaly data based on these vectors. The anomaly detection model is trained based on the sample anomaly data and anomalies. It is evident that a pre-trained unsupervised learning data labeling model can automatically label and process the original sample data to obtain outliers without the need for manual labeling of large amounts of data. By performing time-series analysis on performance data and extracting sample anomaly feature vectors using a neural network module, sample anomaly data is output based on the sample anomaly feature vectors. An anomaly detection model is then trained based on the sample anomaly data and outliers. The trained anomaly detection model can mine the anomaly features of the original sample data from multiple dimensions through time-series analysis and identify sample anomalies through detailed analysis of the performance data in the original sample data. This can solve the problems of difficult labeling of the data to be detected and insufficient detection accuracy.

[0146] Those skilled in the art will understand that Figure 8 The training device for the anomaly detection model can be used to implement the training method for the anomaly detection model described above. The details should be similar to those described in the method section above, and will not be repeated here to avoid being cumbersome.

[0147] Based on the same technical concept, embodiments of this application also provide an electronic device for executing the above-described training method for the anomaly detection model. Figure 9This is a schematic diagram of the structure of an electronic device to implement various embodiments of this application. The electronic device can vary significantly due to differences in configuration or performance, and may include a processor 910, a communication interface 920, a memory 930, and a communication bus 940. The processor 910, communication interface 920, and memory 930 communicate with each other via the communication bus 940. The processor 910 can call a computer program stored in the memory 930 and executable on the processor 910 to perform the following steps:

[0148] Obtain sample raw data within a preset time period of the private network, and preprocess the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data of the network element operating status in the private network.

[0149] A pre-trained unsupervised learning data labeling model is used to label the original sample data vectors to obtain the labeled outliers.

[0150] Time series analysis and feature vector extraction are performed on the performance data to obtain the sample time series feature vector;

[0151] The sample time-series feature vector is input into the neural network module in the anomaly detection model. The neural network module extracts the sample anomaly feature vector from the sample time-series feature vector and outputs the sample anomaly data based on the sample anomaly feature vector.

[0152] An anomaly detection model is trained based on sample abnormal data and outliers.

[0153] The technical solution of this application embodiment acquires sample raw data within a preset time period of the private network, and preprocesses the sample raw data to obtain a preprocessed sample raw data vector. The sample raw data includes performance data and / or alarm data related to the operating status of network elements in the private network. Based on a pre-trained unsupervised learning data annotation model, the sample raw data vector is annotated to obtain anomalies. Temporal analysis and feature vector extraction are performed on the performance data to obtain sample temporal feature vectors. The sample temporal feature vectors are input into the neural network module of the anomaly detection model. The neural network module extracts sample anomaly feature vectors from the sample temporal feature vectors and outputs sample anomaly data based on these vectors. The anomaly detection model is trained based on the sample anomaly data and anomalies. It is evident that a pre-trained unsupervised learning data labeling model can automatically label and process the original sample data to obtain outliers without the need for manual labeling of large amounts of data. By performing time-series analysis on performance data and extracting sample anomaly feature vectors using a neural network module, sample anomaly data is output based on the sample anomaly feature vectors. An anomaly detection model is then trained based on the sample anomaly data and outliers. The trained anomaly detection model can mine the anomaly features of the original sample data from multiple dimensions through time-series analysis and identify sample anomalies through detailed analysis of the performance data in the original sample data. This can solve the problems of difficult labeling of the data to be detected and insufficient detection accuracy.

[0154] The specific execution steps can be found in the various steps of the above-described training method embodiment for the anomaly detection model, and can achieve the same technical effect. To avoid repetition, they will not be repeated here.

[0155] It should be noted that the electronic devices in the embodiments of this application include: servers, terminals, or other devices besides terminals.

[0156] The above electronic device structure does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or arrange them differently. For example, an input unit may include a Graphics Processing Unit (GPU) and a microphone, and a display unit may use a liquid crystal display (LCD), organic light-emitting diode (OLED), or other similar display panels. User input units include at least one of a touch panel and other input devices. A touch panel is also called a touchscreen. Other input devices may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, and joysticks, which will not be elaborated further here.

[0157] Memory can be used to store software programs and various data. Memory can primarily include a first storage area for storing programs or instructions and a second storage area for storing data. The first storage area can store the operating system, application programs or instructions required for at least one function (such as sound playback, image playback, etc.). Furthermore, memory can include volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (Synchlink DRAM, SLDRAM), and direct memory bus RAM (DRRAM).

[0158] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly handles operations related to the operating system, user interface, and applications, while the modem processor mainly handles wireless communication signals, such as a baseband processor. It is understood that the aforementioned modem processor may also not be integrated into the processor.

[0159] This application also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described training method embodiment based on the anomaly detection model and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0160] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0161] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described training method embodiment based on the anomaly detection model, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0162] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0163] This application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the processor is used to run the program or instructions to implement the various processes of the above-mentioned product recommended method embodiments and achieve the same technical effect. To avoid repetition, it will not be described again here.

[0164] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0165] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0166] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

Claims

1. A training method for an anomaly detection model, characterized in that, The method includes: Obtain sample raw data within a preset time period of the private network, and preprocess the sample raw data to obtain a preprocessed sample raw data vector, wherein the sample raw data includes performance data and / or alarm data of the network element operating status in the private network. Based on a pre-trained unsupervised learning data labeling model, the original data vector of the sample is labeled to obtain outliers. The performance data is subjected to time series analysis and feature vector extraction to obtain sample time series feature vectors; The sample time-series feature vector is input into the neural network module in the anomaly detection model. The neural network module extracts the sample anomaly feature vector from the sample time-series feature vector and outputs sample anomaly data based on the sample anomaly feature vector. The neural network module includes an LSTM module. The anomaly detection model is trained based on the abnormal sample data and the abnormal values. The step of performing time-series analysis and feature vector extraction on the performance data to obtain sample time-series feature vectors includes: Based on the aggregation analysis of the session data in the SMF network element of the session management function in the performance data, the session change data in the session data is determined; Based on the traffic changes in the User Plane Function (UPF) traffic data in the statistical performance data, the traffic change data of the UPF is determined; Based on the average uplink and downlink speeds and / or packet loss rate of the user-side performance DPI in the statistical performance data, determine the DPI change data; Based on the session change data, the traffic change data, and the DPI change data, the corresponding feature vectors are extracted to obtain the sample time-series feature vector; The training of the data annotation model includes: The original sample data vector is input into the encoder of the data annotation model to obtain an intermediate encoded vector. The encoder is a Transformer encoding module. The intermediate encoded vector is input into the decoder to obtain the reconstructed vector; The difference between the reconstructed vector and the original sample data vector is identified as an outlier. The data labeling model is then trained based on the alarm data in the original sample data and the outlier. The structure of the decoder is symmetrical to that of the encoder.

2. The method according to claim 1, characterized in that, The step of inputting the sample time-series feature vector into the neural network module of the anomaly detection model, extracting the sample anomaly feature vector from the sample time-series feature vector through the neural network module, and outputting sample anomaly data based on the sample anomaly feature vector includes: The sample time-series feature vector and the identity ID class features corresponding to the network elements in the private network are input into the neural network module in the anomaly detection model, and the sample anomaly feature vector is extracted from the sample time-series feature vector according to the activation function in the neural network module; Based on the sample anomaly feature vector, the anomaly data of the sample is output by the classifier in the anomaly detection model.

3. The method according to claim 1, characterized in that, The preprocessing of the original sample data to obtain a preprocessed original sample data vector includes: The original sample data is cleaned and normalized to obtain the normalized original sample data. The normalized original sample data is subjected to data augmentation processing to obtain the original sample data vector.

4. A method for monitoring anomalies in a private network, characterized in that, The method includes: Obtain alarm data from the private network; Based on the alarm data, the performance data of the corresponding network element of the private network during the alarm time period is obtained, and the performance data includes information on the operating status of the network element in the private network. The performance data is input into the anomaly detection model, and the anomaly data is output. The anomaly detection model is obtained by the anomaly detection training method according to any one of claims 1 to 3. The abnormal data is filtered using alarm level rules to obtain filtered private network abnormal data.

5. A training device for an anomaly detection model, characterized in that, The device includes: The acquisition module is used to acquire sample raw data within a preset time period of the private network, and preprocess the sample raw data to obtain a preprocessed sample raw data vector, wherein the sample raw data includes performance data and / or alarm data of the network element operating status in the private network. The annotation module is used to perform data annotation processing on the original data vector of the sample based on a pre-trained unsupervised learning data annotation model to obtain anomalies after annotation processing. The time series analysis module is used to perform time series analysis and feature vector extraction on the performance data to obtain sample time series feature vectors; The output module is used to input the sample time-series feature vector into the neural network module in the anomaly detection model, extract the sample anomaly feature vector from the sample time-series feature vector through the neural network module, and output sample anomaly data based on the sample anomaly feature vector. The neural network module includes an LSTM module. The training module is used to train the anomaly detection model based on the sample anomaly data and the anomaly values. The time series analysis module includes: The SMF unit is used to perform aggregate analysis on the session data in the session management function SMF network element in the performance data to determine the session change data in the session data. The UPF unit is used to determine the traffic change data of the UPF based on the traffic change of the User Plane Function UPF traffic data in the statistical performance data. The DPI unit is used to determine DPI change data based on the average uplink and downlink speeds and / or packet loss rate data of the user-side performance DPI in the statistical performance data. The extraction unit is used to extract the corresponding feature vectors based on the session change data, the traffic change data and the DPI change data to obtain the sample time-series feature vector; The device further includes: a training device for a data labeling model, used to input the original sample data vector into the encoder of the data labeling model to obtain an intermediate encoded vector, wherein the encoder is a Transformer encoding module; The intermediate encoded vector is input into the decoder to obtain the reconstructed vector; The difference between the reconstructed vector and the original sample data vector is identified as an outlier. The data labeling model is then trained based on the alarm data in the original sample data and the outlier. The structure of the decoder is symmetrical to that of the encoder.

6. An electronic device, characterized in that, The device includes a processor and a memory electrically connected to the processor, the memory storing a computer program, and the processor being configured to call and execute the computer program from the memory to implement a training method for an anomaly detection model as described in any one of claims 1 to 3.

7. A computer-readable storage medium, characterized in that, The storage medium is used to store a computer program that can be executed by a processor to implement a training method for an anomaly detection model as described in any one of claims 1 to 3.

8. A computer program product, characterized in that, The system includes a computer program that, when executed by a processor, implements a training method for an anomaly detection model as described in any one of claims 1 to 3.

Images