Adaptive processing method and device for abnormal region of clustering map and medium

Abstract

The embodiment of the invention discloses a self-adaptive processing method and device for an abnormal region of a clustering map and a medium, and relates to the technical field of data visualization. The method comprises the steps that information, in a clustering map, of each data class in a plurality of data classes is acquired, and the information comprises intra-class data points, normal areas and abnormal areas; determining at least one first region which is adjacent to a target normal region of the abnormal class and belongs to other classes for the abnormal class with the abnormal region; determining a second region closest to the abnormal region of the abnormal class in the at least one first region; and combining the data points in the abnormal region to the target normal region by using the second region. The embodiment of the invention provides a self-adaptive processing method suitable for clustering maps of various data magnitudes, and the method has very high robustness.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of data visualization technology, and in particular to a method, device and medium for adaptively processing abnormal areas of a cluster map. Background Art

[0002] With the continuous improvement of computer processing power and the expansion of application fields, the demand for data visualization is also growing. As an important branch of data visualization, cluster visualization has also developed rapidly. With the rapid development of Internet technology and the advent of the big data era, cluster visualization faces new challenges and opportunities. The scale, diversity and speed of big data have put forward new requirements for visualization technology.

[0003] In the field of cluster map visualization, each category of the cluster map is unique. When the visualization area of ​​a class is not unique, it means that there are abnormal areas in this class, and this abnormal area can be one or more.

[0004] The traditional method for dealing with abnormal areas in cluster maps is manual editing, which is inefficient, and there are different editing methods for maps with different data volumes. In addition to traditional methods, abnormal areas can also be processed through some automation, such as point movement, clustering algorithms, or anomaly detection, which all involve the setting of multiple thresholds, and in the case of different data volumes, the thresholds need to be modified depending on the situation. Therefore, these methods are simply automated and lack robustness and adaptability.

[0005] In view of this, the present invention provides an abnormal area adaptive processing method for cluster maps applicable to various data magnitudes. Summary of the invention

[0006] The embodiments of the present invention provide a method, device and medium for adaptively processing abnormal areas of a cluster map to solve the above technical problems.

[0007] In a first aspect, an embodiment of the present invention provides a method for adaptively processing abnormal areas of a cluster map, comprising:

[0008] S10, obtaining information of each class in a cluster map of a plurality of data classes, wherein the information includes data points within the class, normal areas, and abnormal areas;

[0009] S20, for an abnormal class with an abnormal area, determining at least one first area that is adjacent to a target normal area of ​​the abnormal class and belongs to another class;

[0010] S30, determining a second area in the at least one first area that is closest to the abnormal area of ​​the abnormal class;

[0011] S40: Utilize the second area to merge the data points in the abnormal area into the target normal area.

[0012] In a second aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:

[0013] one or more processors;

[0014] a memory for storing one or more programs,

[0015] When the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal area adaptive processing method of the cluster map described in any embodiment.

[0016] In a third aspect, an embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method for adaptively processing abnormal areas of a cluster map as described in any one of the embodiments.

[0017] The embodiment of the present invention provides an abnormal area adaptive processing method for a cluster map. Since the abnormal area and the normal area essentially belong to the same class, the abnormal area will be near the normal area. Based on this, the embodiment first obtains the adjacent area of ​​the normal area (i.e., the first area), and then determines the area closest to the abnormal area in the adjacent area (i.e., the second area) according to the relationship between the polygons. Finally, the abnormal area is processed according to different situations with the help of the second area. This method does not need to set specific parameters and thresholds, nor is it limited to the position of the point. Instead, it processes through the regional boundary of the abnormal point, which can be applied to different data levels and one or more abnormal area problems, and has high robustness. At the same time, this embodiment, starting from the overall visualization effect, gives priority to filling the normal area with convex polygons, and then calculates the closest distance between the consideration point and the area after completion, so that the boundary of the area will not be very abrupt, and the visualization effect is optimized; replacing data points instead of moving them can minimize the change of the visualization boundary and avoid uncontrollable adjustments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0019] Figure 1 It is a flow chart of a method for adaptively processing abnormal areas of a cluster map provided by an embodiment of the present invention;

[0020] Figure 2 is a regional schematic diagram of an inclusion relationship provided by an embodiment of the present invention;

[0021] Figure 3 is a regional schematic diagram of an intersection relationship provided by an embodiment of the present invention;

[0022] Figure 4 is a schematic diagram of a region with a shared boundary line provided by an embodiment of the present invention;

[0023] Figure 5 is a schematic diagram of the outermost area of ​​a map provided by an embodiment of the present invention;

[0024] Figure 6 is a schematic diagram of a convex polygon of a normal area provided by an embodiment of the present invention;

[0025] Figure 7 is a schematic diagram of processing an abnormal area provided by an embodiment of the present invention;

[0026] Figure 8 is a schematic diagram of another method for processing an abnormal area provided by an embodiment of the present invention;

[0027] Fig. 9 This is a comparison diagram before and after an exception class is processed using the method of this embodiment provided by an embodiment of the present invention;

[0028] Fig.10 This is another comparison diagram before and after the abnormality class is processed using the method of this embodiment provided by the embodiment of the present invention;

[0029] Fig.11 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be described clearly and completely below. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work belong to the scope of protection of the present invention.

[0031] In the description of the present invention, it should be noted that the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc., indicating the orientation or positional relationship, are based on the orientation or positional relationship shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as limiting the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only, and cannot be understood as indicating or implying relative importance.

[0032] In the description of the present invention, it is also necessary to explain that, unless otherwise clearly specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it can be a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0033] As described in the background technology, a cluster map can display multiple data classes as multiple regions. Ideally, each data class corresponds to each region one by one, and the data point in each region represents a data in the corresponding class. However, in actual applications, in a cluster map directly generated by visualization software, a data class may correspond to multiple regions, which include a normal region and at least one abnormal region. Among them, the normal region and the abnormal region are defined as follows: if 95% or more of the data points in a data class are in one region, then this region is called the normal region of the data class; the remaining regions where less than or equal to 5% of the data points are located are all abnormal regions of the data class. This embodiment will process these abnormal regions so that each class in the processed cluster map corresponds to only one normal region.

[0034] Figure 1 1 is a flow chart of a method for adaptively processing abnormal areas of a cluster map provided by an embodiment of the present invention. The method is applicable to the case where abnormal areas exist in a data cluster map and is executed by an electronic device. Figure 1 As shown, the method specifically includes:

[0035] S110, obtaining information of each of the multiple data classes in a cluster map, wherein the information includes data points within the class, normal areas, and abnormal areas.

[0036] The multiple data classes refer to multiple types of data that have been pre-clustered, and the specific content of the data is not limited. For example, in the field of network security, the data may be an ASN number, and each data point of the data class in the cluster map represents an ASN number. This step first obtains the data point coordinates, normal area boundary coordinates, and abnormal area boundary coordinates of each data class in the cluster map as the data source of the entire method.

[0037] In a specific implementation, all normal region boundary coordinates can be labeled as normal_boundary, all abnormal region classes can be labeled as abnormal_boundary, and all class data point coordinates can be labeled as cluster_position. All three can be stored in the form of a dictionary, with the key being the class id and the value being the region boundary coordinate. In normal_boundary, its value corresponds to only one normal region boundary coordinate, which is a one-dimensional list; in abnormal_boundary, its value may contain multiple abnormal region boundary coordinates, which is a two-dimensional list; in cluster_positionion, its value is the two-dimensional coordinate points of multiple points, which is also a two-dimensional list.

[0038] S120: Select any data class with an abnormal area, and determine at least one area that is adjacent to the normal area of ​​the data class and belongs to another class.

[0039] In this embodiment, the data class with abnormal area is called abnormal class. In this step, one abnormal class is selected as the object to be processed. In subsequent operations, the abnormal class is called current abnormal class. Optionally, when using the above data body abnormal_boundary, the abnormal class at the front of abnormal_boundary can be selected as the current abnormal class.

[0040] For the same abnormal class, although the abnormal area is separated from the normal area, it must exist near the normal area, that is, it must be in contact with a certain adjacent area of ​​the normal area. The adjacent area may be a normal area of ​​other classes or an abnormal area of ​​other classes. Therefore, for the current abnormal class, this embodiment first determines the area of ​​other classes adjacent to the normal area of ​​the abnormal class as an auxiliary area for processing the abnormal area.

[0041] In order to distinguish it from the normal areas in other classes, this embodiment refers to the normal area in the current abnormal class as the target normal area. This step can traverse all areas of other classes and determine whether the area has an adjacent relationship with the target normal area in turn. Optionally, the area boundary can be converted into a Polygon object, and the intersects function can be used to determine whether the two areas are adjacent. Exemplarily, for the two objects polygon1 and polygon2, if the result of polygon1.intersects(polygon2) is True, it means that polygon1 and polygon2 areas have an adjacent relationship; otherwise, polygon1 and polygon2 areas do not have an adjacent relationship.

[0042] S130: Select any abnormal region from the abnormal class, and determine a region closest to the abnormal region among the at least one region.

[0043] There may be one or more abnormal regions in the current abnormal class. In this step, one abnormal region is selected as the object to be processed. In subsequent operations, the abnormal region is referred to as the current abnormal region. Optionally, when using the above data body abnormal_boundary, the first abnormal region of the current abnormal class in abnormal_boundary can be selected as the current abnormal region.

[0044] For the current abnormal region, this step selects an adjacent region closest to the abnormal region from at least one adjacent region determined in S120 as an auxiliary region for processing the abnormal region. For the convenience of distinction and description, in this embodiment, each adjacent region determined in S120 is referred to as a first region; and the first region closest to the current abnormal region determined in all first regions is referred to as a second region.

[0045] In a specific implementation, a first region including the abnormal region may be firstly searched as the second region. Figure 2 As shown, the inclusion relationship means that all the data points in the abnormal area are inside the second area. Figure 2 In the case shown in FIG. 1 , the first region intersecting with the abnormal region is continuously searched as the second region, such as Figure 3 If it does not exist Figure 3 In the case shown in FIG. 1 , the first region having a common boundary with the abnormal region is continuously searched as the second region, such as Figure 4 As shown in the figure, there are two second areas that meet this situation, and you can choose any one to participate in the subsequent operations.

[0046] Optionally, the above three situations can also be judged based on the Polygon object. First, find the first area that intersects with the abnormal area and all the data points in the abnormal area belong to the intersection. This area is the second area that contains the abnormal area. If the second area that contains the abnormal area is not found, continue to find the first area that intersects with the abnormal area and does not have a common border with the second area in the intersection. This area is the second area that intersects with the abnormal area. If the second area that intersects with the abnormal area is not found, continue to find the first area that intersects with the abnormal area. The intersection is the first area that shares a common border with the second area. This area is the last second area.

[0047] It is worth mentioning that Figure 3 The intersection shown cannot be directly seen in the visualized cluster map, because the cluster map also only fills the overlapping areas with one color, so the intersection cannot be seen, but this situation can be judged from the data points and boundary information of the data class behind the cluster map. For this embodiment, there will be no area overlap in the cluster map finally processed by the method of this embodiment, but there may be area overlap in the updated data points and area boundaries after a certain cycle, so this situation also needs to be considered.

[0048] Of course, there is another situation: none of the above three second areas exist, such as when the normal area of ​​the current abnormal class is the outermost area of ​​the map, such as Figure 5 As shown. At this time, there is no other area between the abnormal area and the target normal area, so the second area closest to the abnormal area is no longer determined. At this time, the second area is empty. Optionally, the second area can be recorded as nearest_region, which is also in dictionary form. The key represents the class id and the value represents the nearest adjacent class area boundary. When there is no second area, nearest_region is empty.

[0049] S140: Utilize the second area to merge the data points in the abnormal area into the target normal area.

[0050] In this step, the data points in the current abnormal area are replaced with the position adjacent to the target normal area by means of the second area, and together with the target normal area, a new normal area is formed, thereby eliminating the abnormal area. Optionally, depending on whether the second area is empty, this embodiment provides the following optional implementations:

[0051] In a first optional implementation, if the second area is empty, data points are randomly generated in the target normal area to replace the data points in the abnormal area. Optionally, the number of data points in the abnormal area can be counted, and the same number of points can be randomly generated into the target normal area according to the counted number.

[0052] In a second optional implementation, if the second region is not empty, first, the region where the second region intersects with the convex polygon of the target normal region is extracted, and the points of the region are preferentially used to replace the points in the current target region. Optionally, a convex polygon function can be used to generate a convex polygon of the target normal region, such as Figure 6 As shown, the convex polygon ABCDED is the convex polygon of the target normal area. This convex polygon is not the real boundary in the cluster map, and can be understood as a virtual area. The area where this virtual area intersects with the second area can fill the target normal area with a convex polygon. Optionally, the virtual convex polygon can be recorded as current_convex, the boundary of the target normal area can be recorded as current_boundary, and the number and coordinate points of all coordinate points in the second area nearest_region in the convex polygon current_convex are counted, and the number is recorded as replace_num, and the set of coordinate points is assigned to the data point set replace_point that can be replaced with the abnormal area.

[0053] Then, at least one data point closest to the target normal area is selected from the intersecting area, and the at least one data point is replaced with the data point of the abnormal area. Optionally, according to the number of data points in the intersecting area and the abnormal area, the replacement process may include the following cases:

[0054] In the first case, the number of data points replace_num in the intersecting area is equal to the number of data points in the abnormal area, and the data points in the intersecting area are all replaced with the data points in the abnormal area. Optionally, the number of abnormal points and the coordinates of the abnormal points in the abnormal area are pre-counted and recorded as current_num and current_point, respectively. In this case, replace_num=current_num, then replace_point and current_point are all replaced, and the coordinates of the abnormal area are replaced into the convex polygon of the normal area.

[0055] In the second case, if the number of data points replace_num in the intersecting area is greater than the number of data points current_num in the abnormal area, then select the current_num data points closest to the target normal area and replace the current_num data points with all the data points in the abnormal area. Figure 7 , first calculate replace_point( Figure 7The point closest to the target normal area boundary current_boundary in the array (shown by the red and green points in the figure) is recorded as near_point; then, the distance between the nearest point near_point and all the points in replace_point is calculated, and the points in the intersecting area are sorted from small to large according to the distance; the coordinates of the first current_num points in the ordered sequence are taken as the new replace_point; then, the coordinates of the new replace_point are replaced with the coordinates of the current_point, and the coordinates of the abnormal area are replaced into the convex polygon of the normal area.

[0056] In the third case, the number of data points replace_num in the intersecting area is less than the number of data points current_num in the abnormal area. In this case, all the data points in the intersecting area are first replaced with replace_num data points in the abnormal area. For the remaining unreplaced data points in the abnormal area, another data point closest to the unreplaced data point in the target normal area may be first determined, and then another data point closest to the another data point in the second area may be determined, and finally the another data point may be replaced with the unreplaced data point. For ease of distinction and description, in this embodiment, the unreplaced data point is referred to as the first data point, the other data point is referred to as the second data point, and the yet another data point is referred to as the third data point. Optionally, in combination Figure 8 , the number of data points that have not been replaced and the area formed by these data points are recorded as rest_num and rest_point respectively; the coordinate point closest to the normal boundary area current_boundary in the coordinates of rest_point is calculated, recorded as normal_point; then, the distance between normal_point and all coordinate points in the second area nearest_region is calculated, and these coordinate points are sorted according to the distance from small to large, the first rest_num data are taken as the new replace_point, and the new replace_point is replaced with rest_point, so as to complete the processing of an abnormal area.

[0057] After the replacement is completed according to the above three situations, it is necessary to update the information of each area and each category in the cluster map. Optionally, the updated content includes: expanding the boundary of the target normal area and shrinking the boundary of the second area according to the at least one data point closest to the target normal area; deleting the abnormal area; updating the data points of the class where the target normal area and the second area are located. In a specific embodiment, the boundary of the abnormal area can be set to empty, and the outer polygon boundary created by the replace_point point (now the point coordinates in the abnormal area) can be merged into the target normal area current_boundary to update the normal area boundary of the current class; at the same time, the difference set of the outer polygon created by the second area and the replace_point point is taken, and the circumscribed polygon created by the current_point point (that is, the abnormal area before replacement) is merged into the boundary of the second area to update the boundary of the second area.

[0058] At this point, the originally existing abnormal area is integrated with the target normal area, and the processing of the current abnormal area in the current abnormal class is completed.

[0059] S150, re-execute S130-S150 according to the new information of each category in the cluster map after replacement, until the latest abnormal area of ​​the abnormal category is processed.

[0060] This step returns to S130 based on the updated data points, normal areas and abnormal areas of each type, and selects an abnormal area from the latest abnormal area of ​​the current abnormal class again as the new current abnormal area; and executes S140 for the new current abnormal area to complete the processing of the abnormal area; then executes S150 to select another abnormal area from the abnormal area updated again for processing, ... This cycle is repeated until there is no abnormal area in the current abnormal class, and the class is no longer an abnormal class.

[0061] S160 . Re-execute S120 - S160 according to the information updated in S150 for the last time, until the latest exception classes are processed.

[0062] This step returns to S120 based on the data points, normal areas, and abnormal areas of each category updated for the last time in S150, and selects another abnormal class from the latest data class as the new current abnormal class; and executes S130-S150 for the new current abnormal class to make the new current abnormal class a normal class; then executes S160 again, and selects another abnormal class from the updated data class for processing, ... This cycle repeats until all abnormal classes in the cluster map are processed.

[0063] Fig. 9 and Fig.10 The comparison diagrams of two abnormal classes before and after processing using the method of this embodiment are respectively shown. The ellipse in the figure is used to mark the abnormal area of ​​the abnormal class, and the rectangle is used to mark the normal area of ​​the abnormal class. Fig. 9 The exception class in includes an exception area, Fig.10 The abnormal class in includes 3 abnormal regions. After processing, the abnormal regions and normal regions in the two images are integrated.

[0064] In summary, this embodiment provides an adaptive processing method for abnormal areas of cluster maps. Since the abnormal area and the normal area essentially belong to the same class, the abnormal area will be near the normal area. Based on this, this embodiment first obtains the adjacent area of ​​the normal area (i.e., the first area), and then determines the area closest to the abnormal area in the adjacent area (i.e., the second area) according to the relationship between the polygons. Finally, the abnormal area is processed according to different situations with the help of the second area. This method does not need to set specific parameters and thresholds, nor is it limited to the position of the point. Instead, it processes through the regional boundary of the abnormal point. It can be applied to different data levels and one or more abnormal area problems, and has high robustness. At the same time, this embodiment starts from the overall visualization effect, gives priority to filling the normal area with convex polygons, and then calculates the closest distance between the consideration point and the area after completion, so that the boundary of the area will not be very abrupt, and the visualization effect is optimized; replacing data points instead of moving them can minimize the change of the visualization boundary and avoid uncontrollable adjustments.

[0065] Fig.11 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention is shown in FIG. Fig.11 As shown, the device includes a processor 60, a memory 61, an input device 62 and an output device 63; the number of processors 60 in the device can be one or more. Fig.11 A processor 60 is taken as an example; the processor 60, the memory 61, the input device 62 and the output device 63 in the device can be connected by a bus or other means. Fig.11 The example of connecting through bus is taken in the following.

[0066] The memory 61 is a computer-readable storage medium that can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the abnormal area adaptive processing method of the cluster map in the embodiment of the present invention. The processor 60 executes various functional applications and data processing of the device by running the software programs, instructions and modules stored in the memory 61, that is, realizing the above-mentioned abnormal area adaptive processing method of the cluster map.

[0067] The memory 61 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system and at least one application required for a function; the data storage area may store data created according to the use of the terminal, etc. In addition, the memory 61 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some instances, the memory 61 may further include a memory remotely arranged relative to the processor 60, and these remote memories may be connected to the device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0068] The input device 62 may be used to receive input digital or character information and generate key signal input related to user settings and function control of the device. The output device 63 may include a display device such as a display screen.

[0069] An embodiment of the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method for adaptively processing abnormal areas of a cluster map of any embodiment is implemented.

[0070] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, a system, device or device of electricity, magnetism, light, electromagnetic, infrared, or semiconductor, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, a device or a device or used in combination with it.

[0071] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0072] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0073] Computer program code for performing the operations of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as C or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0074] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the technical solutions of the embodiments of the present invention.

Claims

1. A method for adaptively processing abnormal areas of cluster maps, It is characterized in that include: S10, obtaining information of each class in a cluster map of a plurality of data classes, wherein the information includes data points within the class, normal areas, and abnormal areas; S20, for an abnormal class with an abnormal area, determining at least one first area that is adjacent to a target normal area of ​​the abnormal class and belongs to another class; S30, determining a second area in the at least one first area that is closest to the abnormal area of ​​the abnormal class; S40: Utilize the second area to merge the data points in the abnormal area into the target normal area.

2. The method according to claim 1, It is characterized in that S30 includes: in the at least one first region: Determine a first region including an abnormal region of the abnormal class as a second region closest to the abnormal region; If there is no first region including the abnormal region, determining the first region intersecting with the abnormal region as the second region closest to the abnormal region; If there is no first region intersecting with the abnormal region, the first region having a common border with the abnormal region is determined to be the second region closest to the abnormal region.

3. The method according to claim 1, It is characterized in that S40 includes: If the second area is empty, randomly generate data points in the target normal area to replace the data points in the abnormal area; If the second area is not empty, in the area where the second area intersects the convex polygon of the target normal area, select at least one data point closest to the target normal area, and replace the at least one data point with the data points of the abnormal area.

4. The method according to claim 3, It is characterized in that The step of selecting at least one data point closest to the target normal area in the area where the second area intersects the convex polygon of the target normal area, and replacing the at least one data point with the data point of the abnormal area comprises: Determine an area where the second area intersects with a convex polygon of the target normal area; If the number a of data points in the intersecting region is equal to the number b of data points in the abnormal region, all data points in the intersecting region and data points in the abnormal region are replaced with each other; If the number of data points a in the intersecting area is greater than the number of data points b in the abnormal area, b data points closest to the target normal area are selected from the intersecting area, and the b data points are replaced with all the data points in the abnormal area; If the number a of data points in the intersecting region is less than the number b of data points in the abnormal region, all data points in the intersecting region are replaced with a data points in the abnormal region.

5. The method according to claim 3, after replacing the at least one data point with the data point of the abnormal area, further comprising: include: If after all the data points in the intersecting area are replaced, there are still first data points in the abnormal area that have not been replaced, determine the second data point in the target normal area that is closest to the first data point, and replace the first data point with the data point in the second area that is closest to the second data point.

6. The method according to claim 1, It is characterized in that In the case where there are multiple abnormal regions in the abnormal class, S30 includes: selecting an abnormal region from the abnormal class, and determining a second region in the at least one first region that is closest to the abnormal region; Correspondingly, after S40, it also includes: S50, re-execute S30-S50 according to the new information of each category in the cluster map after replacement, until the latest abnormal areas in the abnormal category are processed.

7. The method according to claim 6, It is characterized in that Prior to S50, it also included: According to the at least one data point closest to the target normal area, expanding the boundary of the target normal area and shrinking the boundary of the second area; Deleting the abnormal area; Update the data points of the class where the target normal area and the second area are located.

8. The method according to claim 1, It is characterized in that In the case where there are multiple abnormal classes, S20 includes: selecting an abnormal class having an abnormal area, and determining at least one first area adjacent to a target normal area of ​​the abnormal class and belonging to another class; Correspondingly, after S40, it also includes: S60, re-execute S20-S60 according to the new information of each class in the cluster map after replacement, until the latest abnormal classes are processed.

9. An electronic device, It is characterized in that include: one or more processors; a memory for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the abnormal area adaptive processing method of the cluster map according to any one of claims 1-8.

10. A computer-readable storage medium, It is characterized in that A computer program is stored thereon, and when the program is executed by a processor, the abnormal area adaptive processing method of the cluster map described in any one of claims 1-8 is implemented.

Images