Abnormality detection method and apparatus, and electronic device

Abstract

According to the anomaly detection method and device and the electronic equipment provided by the invention, the sample data is input into the first detection network to be processed, and the first detection result is obtained; the sample data carries corresponding label data; inputting the sample data into a second detection network for local abstraction processing and / or global abstraction processing to obtain pseudo negative sample data, and processing the pseudo negative sample data to obtain a second detection result; calculating a first loss value according to the first detection result and the label data, and calculating a second loss value according to the second detection result and the label data; and carrying out model training processing on the first detection network and the second detection network until the first loss value and the second loss value are not greater than a preset loss threshold value, and taking the first detection network as a trained anomaly detection model. According to the embodiment of the invention, when the trained anomaly detection model performs data anomaly detection, the trained anomaly detection model has relatively high anomaly detection precision and relatively low false detection rate.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a method and device for abnormality detection, and an electronic device. Background Art

[0002] With the development of big data, data anomaly detection has important research significance. For example, anomaly detection under operation and maintenance can play a role in early warning. Existing anomaly detection methods include traditional mathematical methods and methods based on deep learning.

[0003] Traditional mathematical methods include: detection methods based on density, distance, and boundaries. Traditional mathematical methods use statistical operations to find samples with features distributed in a specific area and regard them as abnormal. Among the methods based on deep learning, the more representative method is the dual encoder method. The dual encoder method includes two encoders, one is an autoencoder. The autoencoder obtains the compressed bottleneck features during the encoding process, reconstructs the samples from the bottleneck features during the decoding process, and uses the score difference of the reconstruction restoration degree to distinguish abnormal and normal samples. The whole process is unsupervised learning. The other encoder is used to map normal samples into pseudo-negative samples through transformer transformation, which makes up for the fact that there are no negative samples involved in training.

[0004] However, the traditional dual encoder method is an unsupervised learning method, which has insufficient knowledge of anomaly detection and can easily lead to insufficient accuracy of anomaly detection. Traditional mathematical methods may have logical errors when performing data enhancement during the anomaly detection process. When transforming normal samples into abnormal samples, it does not take into account the rotation, translation or random noise of the normal samples themselves, resulting in false detection.

[0005] Therefore, how to solve the problem of insufficient accuracy and high false positive rate of anomaly detection in the existing technology is an urgent problem to be solved. Summary of the invention

[0006] The present invention provides a method and device for abnormality detection, and electronic equipment, the main purpose of which is to solve the problems of insufficient accuracy and high false positive rate of abnormality detection in the prior art.

[0007] According to a first aspect of the present disclosure, a method for training an anomaly detection model is provided, comprising:

[0008] Input a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data;

[0009] Input the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing, obtain pseudo negative sample data corresponding to each sample data, and perform data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network;

[0010] According to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function;

[0011] The first detection network and the second detection network are subjected to model training processing by a preset model optimization method until the first loss value and the second loss value are both no greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model.

[0012] Optionally, the step of inputting a preset number of sample data into a first detection network for data detection processing to obtain a first detection result includes:

[0013] Convolutionally processing the sample data through a first encoding structure in the first detection network to obtain convolved sample data; wherein the first detection network includes the first encoding structure and a first decoding structure, and the first encoding structure includes a plurality of convolutional layers for convolutionally processing the data;

[0014] The convolved sample data is deconvolved through the first decoding structure to obtain the first detection result, wherein the first decoding structure includes multiple deconvolution layers for deconvolution of data.

[0015] Optionally, the step of inputting the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data includes:

[0016] The order of data channels of the convolutional layer in the second encoding structure of the second detection network is shuffled, and the sample data is locally abstracted and / or globally abstracted through the shuffled convolutional layer to obtain pseudo negative sample data corresponding to each sample data, wherein the second detection network includes the second encoding structure, and the second encoding structure includes multiple convolutional layers.

[0017] Optionally, the step of inputting the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data includes:

[0018] The order of the data channels of the first convolutional layer in the second coding structure is disrupted, and the sample data is locally abstracted through the disrupted first convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the first convolutional layer is the convolutional layer closest to the input layer in the second coding structure; and / or,

[0019] The order of data channels of the second convolutional layer in the second encoding structure is shuffled, and the sample data is globally abstracted through the shuffled second convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the second convolutional layer is the convolutional layer farthest from the input layer in the second encoding structure.

[0020] Optionally, performing data detection processing on the pseudo negative sample data to obtain a second detection result includes:

[0021] The pseudo negative sample data is deconvolved through a second decoding structure in the second detection network to obtain the second detection result, wherein the second detection network includes the second decoding structure, and the second decoding structure includes multiple deconvolution layers for deconvolution processing of the data.

[0022] According to a second aspect of the present disclosure, a method for abnormality detection is provided, comprising:

[0023] The acquired data to be detected is input into the trained anomaly detection model for data inference processing to obtain the data inference value corresponding to each data to be detected;

[0024] Calculating a reconstruction error between each of the data inference values ​​and the corresponding data to be detected;

[0025] It is determined whether the reconstruction error is greater than a preset error threshold, and the data state of the data to be detected is determined according to the determination result to obtain an abnormality detection result.

[0026] Optionally, determining the abnormality detection result of the to-be-detected data according to the judgment result includes:

[0027] When the reconstruction error is greater than the preset error threshold, determining that the data to be detected corresponding to the reconstruction error is abnormal data;

[0028] When the reconstruction error is not greater than the preset error threshold, it is determined that the data to be detected corresponding to the reconstruction error is normal data.

[0029] According to a third aspect of the present disclosure, a training device for an anomaly detection model is provided, comprising:

[0030] An input unit, used to input a preset number of sample data into the first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data;

[0031] A first processing unit, configured to input the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data;

[0032] A second processing unit, configured to perform data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network;

[0033] a calculation unit, configured to calculate a first loss value corresponding to the first detection network by using a preset loss function according to the first detection result and the label data, and to calculate a second loss value corresponding to the second detection network by using the preset loss function according to the second detection result and the label data;

[0034] The optimization unit is used to perform model training processing on the first detection network and the second detection network by a preset model optimization method until the first loss value and the second loss value are both no greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model.

[0035] Optionally, the input unit includes:

[0036] A first processing module, configured to perform convolution processing on the sample data through a first encoding structure in the first detection network to obtain convolved sample data; wherein the first detection network includes the first encoding structure and a first decoding structure, and the first encoding structure includes a plurality of convolution layers for performing convolution processing on the data;

[0037] The second processing module is used to perform deconvolution processing on the convolved sample data through the first decoding structure to obtain the first detection result, wherein the first decoding structure includes multiple deconvolution layers for deconvolution processing on the data.

[0038] Optionally, the first processing unit is also used to shuffle the order of data channels of the convolution layer in the second encoding structure of the second detection network, and perform local abstract processing and / or global abstract processing on the sample data through the shuffled convolution layer to obtain pseudo negative sample data corresponding to each of the sample data, wherein the second detection network includes the second encoding structure, and the second encoding structure includes multiple convolution layers.

[0039] Optionally, the first processing unit includes:

[0040] A first processing module is used to disrupt the order of data channels of the first convolutional layer in the second encoding structure, and perform local abstract processing on the sample data through the disrupted first convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the first convolutional layer is the convolutional layer closest to the input layer in the second encoding structure;

[0041] The second processing module is used to disrupt the order of data channels of the second convolutional layer in the second encoding structure, and perform global abstract processing on the sample data through the disrupted second convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the second convolutional layer is the convolutional layer farthest from the input layer in the second encoding structure.

[0042] Optionally, the second processing unit is also used to perform deconvolution processing on the pseudo-negative sample data through a second decoding structure in the second detection network to obtain the second detection result, wherein the second detection network includes the second decoding structure, and the second decoding structure includes multiple deconvolution layers for deconvolution processing on the data.

[0043] According to a fourth aspect of the present disclosure, there is provided an apparatus for abnormality detection, comprising:

[0044] An input unit is used to input the acquired data to be detected into the trained anomaly detection model for data inference processing to obtain a data inference value corresponding to each data to be detected;

[0045] A calculation unit, used for calculating a reconstruction error between each of the data inference values ​​and the corresponding data to be detected;

[0046] The determination unit is used to determine whether the reconstruction error is greater than a preset error threshold, and determine the data state of the data to be detected according to the determination result to obtain an abnormality detection result.

[0047] Optionally, the determining unit is further configured to:

[0048] When the reconstruction error is greater than the preset error threshold, determining that the data to be detected corresponding to the reconstruction error is abnormal data;

[0049] When the reconstruction error is not greater than the preset error threshold, it is determined that the data to be detected corresponding to the reconstruction error is normal data.

[0050] According to a fifth aspect of the present disclosure, there is provided an electronic device, including:

[0051] at least one processor; and

[0052] a memory communicatively connected to the at least one processor; wherein,

[0053] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the method described in the first aspect or the method described in the second aspect.

[0054] According to a sixth aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable the computer to execute the method described in the first aspect or the method described in the second aspect.

[0055] According to a seventh aspect of the present disclosure, a computer program product is provided, comprising a computer program, wherein when the computer program is executed by a processor, the computer program implements the method described in the first aspect or the method described in the second aspect.

[0056] The method, device and electronic device for abnormality detection provided by the present disclosure input a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; the preset number of sample data is input into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each of the sample data, and data detection processing is performed on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; according to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function; through a preset model optimization method, the first detection network and the second detection network are model trained until the first loss value and the second loss value are both not greater than a preset loss threshold, and the first detection network is used as a trained abnormality detection model. Compared with the related art, the embodiment of the present disclosure trains an anomaly detection model through a twin network composed of a self-supervised learning network (first detection network) and a supervised learning auxiliary network (second detection network), and performs local abstract processing and / or global abstract processing during the training of the anomaly detection model. This can enable the trained anomaly detection model to have higher anomaly detection accuracy and lower false detection rate when performing anomaly detection in data.

[0057] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present application, nor is it intended to limit the scope of the present application. Other features of the present application will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] The accompanying drawings are used to better understand the present solution and do not constitute a limitation of the present disclosure.

[0059] Figure 1 A flowchart of a method for training an anomaly detection model provided by an embodiment of the present disclosure;

[0060] Figure 2 A schematic diagram of a network structure for model training provided in an embodiment of the present disclosure;

[0061] Figure 3 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure;

[0062] Figure 4 A schematic diagram of the structure of a training device for an anomaly detection model provided in an embodiment of the present disclosure;

[0063] Figure 5 A schematic diagram of the structure of another anomaly detection model training device provided by an embodiment of the present disclosure;

[0064] Figure 6 A schematic diagram of the structure of an abnormality detection device provided by an embodiment of the present disclosure;

[0065] Figure 7 A schematic block diagram of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0066] The following is a description of exemplary embodiments of the present disclosure in conjunction with the accompanying drawings, including various details of the embodiments of the present disclosure to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present disclosure. Similarly, for the sake of clarity and conciseness, descriptions of well-known functions and structures are omitted in the following description.

[0067] The following describes the method and device for abnormality detection and the electronic device according to the embodiments of the present disclosure with reference to the accompanying drawings.

[0068] Figure 1 A flowchart of a method for training an anomaly detection model provided in an embodiment of the present disclosure.

[0069] like Figure 1 As shown, the method comprises the following steps:

[0070] Step 101: input a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data.

[0071] In the disclosed embodiment, the first detection network is a network that can be used as an anomaly detection model after training, and is a network based on self-supervised learning, wherein the input and output of the first detection network are matrix representations of normal samples, and it first obtains a high-dimensional feature representation through a typical downsampling method based on continuous maximum pooling in the industry, and then upsamples to restore the original image through a typical deconvolution method in the industry. Therefore, after the training converges, it can obtain a better reconstruction capability for normal samples, while the reconstruction capability for abnormal samples is weak, so it can distinguish normal and abnormal samples through the size of the reconstruction error.

[0072] Step 102: input the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data, and perform data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network.

[0073] In the disclosed embodiment, since simply training the first detection network will lack accuracy and cannot accurately perceive the abnormal form, it is necessary to set up an auxiliary network, the second detection network, which has the same structure as the first detection network, but the difference is that the second detection network will use abnormal samples during the training process. For normal samples, the input and output of the second detection network are the same as those of the first detection network, and for abnormal samples, the output of the second detection network is represented by an all-0 matrix. Therefore, abnormal samples can be better identified through supervision.

[0074] In order to facilitate understanding of the relationship between the first detection network and the second detection network, the present disclosure provides a network structure diagram for model training, such as Figure 2 As shown, it is a twin network structure, A is the first detection network, and B is the second detection network.

[0075] like Figure 2 As shown, the structures of the first detection network and the second detection network are consistent, both of which include: an input layer, a coding structure, an abstraction layer, a decoding structure and an output layer, wherein block 1 in network A is the input layer of the first detection network, and block 6 in network B is the input layer of the second detection network; block 2 in network A is the coding structure of the first detection network, and block 7 in network B is the coding structure of the second detection network, and the coding structure includes several convolutional layers; block 4 in network A is the decoding structure of the first detection network, and block 8 in network B is the decoding structure of the second detection network, and the decoding structure includes several deconvolutional layers; block 5 in network A is the output layer of the first detection network, and block 9 in network B is the output layer of the second detection network.

[0076] It should be noted that Figure 2 Block 3 in the figure is an abstract layer shared by the first detection network and the second detection network. Since B (the second detection network) has weak scene migration when there are very few abnormal samples, A (the first detection network) and B share some abstract layers. Through joint training, A can obtain more discriminative feature capabilities with the help of B to improve the accuracy of anomaly detection in a specific cognitive space.

[0077] Step 103: Calculate a first loss value corresponding to the first detection network through a preset loss function according to the first detection result and the label data, and calculate a second loss value corresponding to the second detection network through the preset loss function according to the second detection result and the label data.

[0078] In the disclosed embodiment, the first loss value and the second loss value are the differences between the predicted value (the first detection result and the second detection result) and the label data during the model training process. Specifically, the loss value is the result of the loss function evaluation, which measures the prediction performance of the first detection network and the second detection network under given input data. The loss value is a scalar. The smaller the loss value, the closer the predicted result is to the true value, that is, the smaller the model error is.

[0079] The preset loss function is a custom-set function used to evaluate the first detection network and the second detection network during the training process, such as: mean square error loss function, cross entropy loss function, Hinge loss function, etc. Specifically, the preset loss function is not limited in the embodiments of the present disclosure.

[0080] Step 104: Perform model training on the first detection network and the second detection network through a preset model optimization method until the first loss value and the second loss value are both no greater than a preset loss threshold, and then use the first detection network as a trained anomaly detection model.

[0081] In the embodiment of the present disclosure, the preset model optimization algorithm is a custom-selected algorithm used to perform model training processing on the first detection network and the second detection network, such as: gradient method, momentum method, adaptive learning rate algorithm, etc. Specifically, the embodiment of the present disclosure does not limit the preset model optimization algorithm.

[0082] The preset loss threshold is a custom-set threshold used to determine whether the first detection network and the second detection network have converged, for example: 0, 0.001, etc. Specifically, the preset loss threshold is not limited in the embodiment of the present disclosure.

[0083] It should be noted that when the model training process of the first detection network and the second detection network is performed, it is carried out through alternating training. For example, based on the gradient method training, the first detection network and the second detection network are jointly or alternately trained until convergence, that is, the first loss value and the second loss value are close to 0. Since the second detection network is an auxiliary training network, after convergence, the first detection network can be used as a trained anomaly detection model.

[0084] The method for anomaly detection provided by the present disclosure includes inputting a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; inputting the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each of the sample data, and performing data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; according to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function; and by a preset model optimization method, model training processing is performed on the first detection network and the second detection network until the first loss value and the second loss value are both not greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model. Compared with the related art, the embodiment of the present disclosure trains an anomaly detection model through a twin network composed of a self-supervised learning network (first detection network) and a supervised learning auxiliary network (second detection network), and performs local abstract processing and / or global abstract processing during the training of the anomaly detection model. This can enable the trained anomaly detection model to have higher anomaly detection accuracy and lower false detection rate when performing anomaly detection in data.

[0085] In one implementable manner of the disclosed embodiment, the first detection network includes a coding structure and a decoding structure. When performing model training, for the first detection network, both the input and the output are matrix representations of normal samples, that is, the sample data is first convolved through the coding structure and then deconvolved through the decoding structure to obtain a first detection result. Specifically, the processing of the sample data can also be implemented in but not limited to the following manner: convolving the sample data through the first coding structure in the first detection network to obtain convolved sample data; wherein the first detection network includes the first coding structure and the first decoding structure, and the first coding structure includes multiple convolutional layers for convolving data; deconvolving the convolved sample data through the first decoding structure to obtain the first detection result, wherein the first decoding structure includes multiple deconvolution layers for deconvolving data.

[0086] In one implementable method of the disclosed embodiment, when training an anomaly detection model, in addition to normal training of the first detection network, the first detection network needs to be assisted in training through a second detection network. During the auxiliary training, the second detection network generates pseudo-negative samples based on normal samples to increase the reconstruction distinction between the two samples. Different from the existing method of mapping normal data to a farther space, the second detection network adopts both global sensitivity and local sensitivity to generate pseudo-negative samples for different potential anomalies. Specifically, regarding the generation of pseudo-negative samples, it can also be implemented in but not limited to the following method: in the second encoding structure of the second detection network, the order of data channels of the convolution layer is shuffled, and the sample data is locally abstracted and / or globally abstracted through the shuffled convolution layer to obtain pseudo-negative sample data corresponding to each sample data, wherein the second detection network includes the second encoding structure, and the second encoding structure includes multiple convolution layers.

[0087] In the embodiment of the present disclosure, considering that the shallow features of the neural network are more detailed and the high-level features are more abstract, during the training process, the channels of the shallow or deep features in the second detection network are randomly shuffled to generate pseudo-negative samples with different sensitivities to increase the discrimination of similar samples.

[0088] The local abstract processing and / or global abstract processing is to perform local anomaly detection and / or global anomaly detection on the sample data. Regarding local anomalies and global anomalies, for example: there are a bunch of bills with numbers 0 to 9. If the number 9 is defined as normal, then the numbers 0 to 8 are globally sensitive anomalies, and the number 9 with partial damage is a local anomaly.

[0089] In one implementable manner of the disclosed embodiment, as a refinement of the above-mentioned embodiment, when scrambling the order of data channels of the convolutional layer, it can also be implemented in but not limited to the following manner: scrambling the order of data channels of the first convolutional layer in the second coding structure, and performing local abstract processing on the sample data through the scrambled first convolutional layer to obtain the pseudo-negative sample data corresponding to each sample data; wherein the first convolutional layer is the convolutional layer closest to the input layer in the second coding structure; and / or scrambling the order of data channels of the second convolutional layer in the second coding structure, and performing global abstract processing on the sample data through the scrambled second convolutional layer to obtain the pseudo-negative sample data corresponding to each sample data; wherein the second convolutional layer is the convolutional layer farthest from the input layer in the second coding structure.

[0090] In the disclosed embodiment, during the training process, the intermediate features in the forward propagation of normal samples are transformed to generate pseudo-negative samples, and the output remains unchanged and is still a positive sample. Since the positive sample is still a positive sample after reconstruction, the reconstruction error is small, and the pseudo-negative sample is reconstructed into a positive sample, thereby increasing the network's reconstruction error for potential negative samples, which can increase the detection accuracy of the trained anomaly detection model.

[0091] It should be noted that the data channel of the first convolutional layer represents the convolution kernel of the first convolutional layer. Similarly, the data channel of the second convolutional layer represents the convolution kernel of the second convolutional layer.

[0092] In order to facilitate understanding of the implementation process of the embodiment of the present disclosure, an example is provided for illustration: Figure 2 As shown, Figure 2 Taking the block labeled 7 as an example, it contains 2 convolutional layers. The first convolutional layer is a shallow layer, that is, the layer closer to the input layer is recorded as layer 1, and the second convolutional layer is a deep layer, that is, the layer farther from the input layer is recorded as layer 2.

[0093] The transformation method is:

[0094] 1) For global abstract processing, the channels (convolution kernels) of the feature data in layer 2 are randomly swapped to generate pseudo-negative samples that simulate global anomalies. For example, layer 2 contains 5 channels, two channels are randomly selected to be swapped to disrupt the order, and this process is repeated a preset number of times. The reconstruction error of similar samples can be increased through learning.

[0095] 2) For local abstract processing, the channels (convolution kernels) of the feature data of layer 1 in block 2 are shuffled to generate pseudo-negative samples that simulate local anomalies. Similarly, the reconstruction error of similar samples can be increased through learning.

[0096] In one implementable manner of the embodiment of the present disclosure, after the second detection network obtains the pseudo-negative sample, deconvolution processing is required to obtain a second detection result. The deconvolution processing of the pseudo-negative sample can also be implemented in but not limited to the following manner: the pseudo-negative sample data is deconvolved through a second decoding structure in the second detection network to obtain the second detection result, wherein the second detection network includes the second decoding structure, and the second decoding structure includes multiple deconvolution layers for deconvolution processing of the data.

[0097] In summary, the training of anomaly detection models can be illustrated by, but not limited to, the following examples: Step 1: Figure 2 Network model. The input and output of A (first detection network) and B (second detection network) are defined as 3*n*n matrices. Each block in the middle is designed based on convolution and maximum pooling in the industry. For example: Figure 2In block 2 and block 7, the number of convolution layers is 2, each layer contains one convolution and one maximum pooling, the size of the convolution kernel is 3*3, the number is 5, the maximum pooling is based on a 4*4 receptive field, and non-overlapping sliding is used.

[0098] The second step is to load data and labels. The input and output of network A are the same. For example, the image can be operated and normalized based on the opencv library (or the data can be convolved and deconvolved) to obtain a 3*n*n matrix representation. The difference between network B and network A is that network B will generate pseudo-negative samples based on the abnormal sensitivity of global or local features (local abstract processing and / or global abstract processing), and output pseudo-negative samples or abnormal data as a matrix of all zeros.

[0099] The third step is model training. Based on the gradient method (existing in the industry) and the mean square error loss function, network A and network B are trained jointly or alternately until convergence.

[0100] Corresponding to the training method of the above anomaly detection model, Figure 3 A flowchart of an abnormality detection method provided by an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the method comprises the following steps:

[0101] Step 301: input the acquired data to be detected into the trained anomaly detection model for data inference processing to obtain the data inference value corresponding to each data to be detected.

[0102] In the disclosed embodiment, the trained anomaly detection model will perform data inference processing on the received data to be detected to obtain an inference value. The inference value is the output of simulating and interpreting the data to be detected after learning the normal data features in the trained anomaly detection model. The inference value reflects how the trained anomaly detection model understands and reconstructs the data to be detected.

[0103] Step 302: Calculate the reconstruction error between each of the data inference values ​​and the corresponding data to be detected.

[0104] In the embodiment of the present disclosure, the reconstruction error is an indicator used to evaluate whether the data to be detected is abnormal data, which represents the difference between the inference value and the data to be detected. The calculation of the reconstruction error can be implemented by, but not limited to, formula (1):

[0105]

[0106] in, represents the inference data, y i represents the data to be detected, and n represents the number of the data to be detected.

[0107] Step 303, judging whether the reconstruction error is greater than a preset error threshold, and determining the data state of the to-be-detected data according to the judgment result, to obtain an abnormality detection result.

[0108] In the embodiment of the present disclosure, the preset error threshold is a value set according to the actual situation, for example: 0.001, 0.002, etc. In practical applications, a variety of methods can be used, for example: the center values ​​of positive and negative samples are obtained based on the industry's k-nearest neighbor method, and then the average is taken as the preset error threshold, and then fine-tuning can be considered. Specifically, the preset error threshold is not limited in the embodiment of the present disclosure.

[0109] The data status of the data to be detected includes but is not limited to: normal data, abnormal data, etc. According to the judgment result, it can be determined whether the data to be detected is abnormal data to obtain an abnormal detection result, for example: the reconstruction error is greater than the preset error threshold, the data to be detected is abnormal data; the reconstruction error is less than the preset error threshold, the data to be detected is normal data.

[0110] The method for anomaly detection provided by the present disclosure includes inputting a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; inputting the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each of the sample data, and performing data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; according to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function; and by a preset model optimization method, model training processing is performed on the first detection network and the second detection network until the first loss value and the second loss value are both not greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model. Compared with the related art, the embodiment of the present disclosure trains an anomaly detection model through a twin network composed of a self-supervised learning network (first detection network) and a supervised learning auxiliary network (second detection network), and performs local abstract processing and / or global abstract processing during the training of the anomaly detection model. This can enable the trained anomaly detection model to have higher anomaly detection accuracy and lower false detection rate when performing anomaly detection in data.

[0111] In one implementable manner of the embodiment of the present disclosure, as a refinement of step 303, it can also be implemented in the following manner but is not limited to: when the reconstruction error is greater than the preset error threshold, determine that the data to be detected corresponding to the reconstruction error is abnormal data; when the reconstruction error is not greater than the preset error threshold, determine that the data to be detected corresponding to the reconstruction error is normal data.

[0112] To facilitate understanding of the implementation process of the disclosed embodiment, an example is provided for illustration: based on a trained anomaly detection model, several pieces of data to be detected are inferred, and the reconstruction error is calculated. The result is recorded as Z, and the reconstruction error is the mean square error loss. However, unlike model training, the error of model training expresses the difference between the detection result and the label data, while the reconstruction error expresses the difference between the inference value and the data to be detected. Therefore, the reconstruction error of the positive sample is smaller, while the reconstruction error of the negative sample is larger. Then, a threshold C is set to maximize the distinction between normal samples and abnormal samples.

[0113] If Z is not greater than C, it indicates that the sample to be detected is a normal sample. If Z is greater than C, it indicates that the sample to be detected is an abnormal sample. Here, Z represents the reconstruction error and C represents the preset error threshold.

[0114] Regarding the setting of C, for example, among the four samples, the reconstruction errors of the two positive samples are 0.1 and 0.2 respectively, and the errors of the two negative samples are 0.4 and 0.5 respectively, then C is set to 0.3 to maximize the distinction between positive and negative samples. In practical applications, a variety of methods can be used: for example, the center values ​​of positive and negative samples can be obtained based on the industry's k-nearest neighbor method, and then the average is taken as the threshold c; then fine-tuning can be considered.

[0115] In summary, the embodiments of the present disclosure can achieve the following effects:

[0116] 1. The embodiment of the present disclosure trains an anomaly detection model through a twin network consisting of a self-supervised learning network (first detection network) and a supervised learning auxiliary network (second detection network), and performs local abstract processing and / or global abstract processing during the training of the anomaly detection model. This can enable the trained anomaly detection model to have higher anomaly detection accuracy and lower false detection rate when performing anomaly detection in data.

[0117] 2. The disclosed embodiment, through the proposed anomaly detection method based on a twin network assisted by self-supervised learning and supervised learning, can achieve a certain degree of versatility through self-supervised learning when there is a lack of abnormal samples or the understanding of anomalies is not complete, and can also perform assisted supervised learning based on a small number of labeled samples to improve accuracy. Anomaly detection sets up dual encoders A and B, A is used for self-supervised learning, and B is used for assisted supervised learning. The two encoders share part of the abstract layer for joint training. The combination of the dual encoders can improve the recognition rate of anomaly detection in the case of few samples.

[0118] 3. The disclosed embodiment can improve the ability to distinguish corresponding anomalies for some typical application scenarios through two preset schemes of global and local abnormal sensitivity, that is, divide and conquer. Globally sensitive and locally sensitive training is proposed for the sample data of the dual encoder, and the shallow and deep channels are disrupted to increase the reconstruction error of the sample. The dual encoders are trained jointly and alternately until the error function approaches 0.

[0119] Corresponding to the above-mentioned anomaly detection model training method and anomaly detection method, the present invention also provides an anomaly detection model training device and an anomaly detection device. Since the device embodiment of the present invention corresponds to the above-mentioned method embodiment, the details not disclosed in the device embodiment can be referred to the above-mentioned method embodiment, and will not be repeated in the present invention.

[0120] Figure 4 A structural diagram of a training device for an anomaly detection model provided in an embodiment of the present disclosure, such as Figure 4 As shown, including:

[0121] An input unit 41 is used to input a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data;

[0122] A first processing unit 42 is used to input the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data;

[0123] A second processing unit 43 is used to perform data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network;

[0124] A calculation unit 44 is used to calculate a first loss value corresponding to the first detection network by a preset loss function according to the first detection result and the label data, and to calculate a second loss value corresponding to the second detection network by the preset loss function according to the second detection result and the label data;

[0125] The optimization unit 45 is used to perform model training processing on the first detection network and the second detection network through a preset model optimization method until the first loss value and the second loss value are both no greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model.

[0126] The device for abnormality detection provided by the present disclosure inputs a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; the preset number of sample data is input into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each of the sample data, and data detection processing is performed on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; according to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function; through a preset model optimization method, the first detection network and the second detection network are model trained until the first loss value and the second loss value are both not greater than a preset loss threshold, and the first detection network is used as a trained abnormality detection model. Compared with the related art, the embodiment of the present disclosure trains an anomaly detection model through a twin network composed of a self-supervised learning network (first detection network) and a supervised learning auxiliary network (second detection network), and performs local abstract processing and / or global abstract processing during the training of the anomaly detection model. This can enable the trained anomaly detection model to have higher anomaly detection accuracy and lower false detection rate when performing anomaly detection in data.

[0127] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Figure 5 As shown, the input unit 41 includes:

[0128] A first processing module 411, configured to perform convolution processing on the sample data through a first encoding structure in the first detection network to obtain convolved sample data; wherein the first detection network includes the first encoding structure and a first decoding structure, and the first encoding structure includes a plurality of convolution layers for performing convolution processing on the data;

[0129] The second processing module 412 is used to perform deconvolution processing on the convolved sample data through the first decoding structure to obtain the first detection result, wherein the first decoding structure includes multiple deconvolution layers for performing deconvolution processing on the data.

[0130] Furthermore, in a possible implementation of the embodiment of the present disclosure, the first processing unit 42 is also used to shuffle the order of data channels of the convolutional layer in the second encoding structure of the second detection network, and perform local abstract processing and / or global abstract processing on the sample data through the shuffled convolutional layer to obtain pseudo negative sample data corresponding to each of the sample data, wherein the second detection network includes the second encoding structure, and the second encoding structure includes multiple convolutional layers.

[0131] Furthermore, in a possible implementation of the embodiment of the present disclosure, as Figure 5 As shown, the first processing unit 42 includes:

[0132] The first processing module 421 is used to disrupt the order of the data channels of the first convolution layer in the second coding structure, and perform local abstract processing on the sample data through the disrupted first convolution layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the first convolution layer is the convolution layer closest to the input layer in the second coding structure;

[0133] The second processing module 422 is used to disrupt the order of data channels of the second convolutional layer in the second encoding structure, and perform global abstract processing on the sample data through the disrupted second convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the second convolutional layer is the convolutional layer farthest from the input layer in the second encoding structure.

[0134] Furthermore, in a possible implementation of the embodiment of the present disclosure, the second processing unit 43 is also used to perform deconvolution processing on the pseudo-negative sample data through a second decoding structure in the second detection network to obtain the second detection result, wherein the second detection network includes the second decoding structure, and the second decoding structure includes multiple deconvolution layers for deconvolution processing of the data.

[0135] Figure 6A schematic diagram of the structure of an abnormality detection device provided in an embodiment of the present disclosure is shown in FIG. Figure 6 As shown, including:

[0136] An input unit 61 is used to input the acquired data to be detected into the trained anomaly detection model for data inference processing to obtain a data inference value corresponding to each data to be detected;

[0137] A calculation unit 62, configured to calculate a reconstruction error between each of the data inference values ​​and the corresponding data to be detected;

[0138] The determination unit 63 is used to determine whether the reconstruction error is greater than a preset error threshold, and determine the data state of the data to be detected according to the determination result to obtain an abnormality detection result.

[0139] The device for abnormality detection provided by the present disclosure inputs a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; the preset number of sample data is input into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each of the sample data, and data detection processing is performed on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; according to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function; through a preset model optimization method, the first detection network and the second detection network are model trained until the first loss value and the second loss value are both not greater than a preset loss threshold, and the first detection network is used as a trained abnormality detection model. Compared with the related art, the embodiment of the present disclosure trains an anomaly detection model through a twin network composed of a self-supervised learning network (first detection network) and a supervised learning auxiliary network (second detection network), and performs local abstract processing and / or global abstract processing during the training of the anomaly detection model. This can enable the trained anomaly detection model to have higher anomaly detection accuracy and lower false detection rate when performing anomaly detection in data.

[0140] Furthermore, in a possible implementation of the embodiment of the present disclosure, the determining unit 63 is further configured to:

[0141] When the reconstruction error is greater than the preset error threshold, determining that the data to be detected corresponding to the reconstruction error is abnormal data;

[0142] When the reconstruction error is not greater than the preset error threshold, it is determined that the data to be detected corresponding to the reconstruction error is normal data.

[0143] It should be noted that the above explanation of the method embodiment is also applicable to the device of the embodiment of the present disclosure, and the principle is the same, which is no longer limited in the embodiment of the present disclosure.

[0144] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium and a computer program product.

[0145] Figure 7 A schematic block diagram of an example electronic device 700 that can be used to implement an embodiment of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present disclosure described and / or required herein.

[0146] like Figure 7 As shown, the device 700 includes a computing unit 701, which can perform various appropriate actions and processes according to a computer program stored in a ROM (Read-Only Memory) 702 or a computer program loaded from a storage unit 708 to a RAM (Random Access Memory) 703. In the RAM 703, various programs and data required for the operation of the device 700 can also be stored. The computing unit 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An I / O (Input / Output) interface 705 is also connected to the bus 704.

[0147] A number of components in the device 700 are connected to the I / O interface 705, including: an input unit 706, such as a keyboard, a mouse, etc.; an output unit 707, such as various types of displays, speakers, etc.; a storage unit 708, such as a disk, an optical disk, etc.; and a communication unit 709, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 709 allows the device 700 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0148] The computing unit 701 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the computing unit 701 include, but are not limited to, a CPU (Central Processing Unit), a GPU (Graphic Processing Units), various dedicated AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, a DSP (Digital Signal Processor), and any appropriate processor, controller, microcontroller, etc. The computing unit 701 performs the various methods and processes described above, such as a training method for an anomaly detection model or a method for anomaly detection. For example, in some embodiments, the training method for an anomaly detection model or a method for anomaly detection may be implemented as a computer software program, which is tangibly contained in a machine-readable medium, such as a storage unit 708. In some embodiments, part or all of the computer program may be loaded and / or installed on the device 700 via the ROM 702 and / or the communication unit 709. When the computer program is loaded into the RAM 703 and executed by the computing unit 701, one or more steps of the method described above may be performed. Alternatively, in other embodiments, the computing unit 701 may be configured to execute the aforementioned anomaly detection model training method or anomaly detection method in any other appropriate manner (for example, by means of firmware).

[0149] Various embodiments of the systems and techniques described above herein may be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application Specific Standard Products), SOCs (System On Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include: being implemented in one or more computer programs that may be executed and / or interpreted on a programmable system including at least one programmable processor that may be a special purpose or general purpose programmable processor that may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0150] The program code for implementing the method of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that the program code, when executed by the processor or controller, enables the functions / operations specified in the flow chart and / or block diagram to be implemented. The program code may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0151] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing. More specific examples of machine-readable storage media may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an EPROM (Electrically Programmable Read-Only-Memory) or a flash memory, an optical fiber, a CD-ROM (Compact Dis sc Read-Only Memory), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0152] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball), through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0153] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: LAN (Local Area Network), WAN (Wide Area Network), the Internet, and blockchain networks.

[0154] A computer system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The relationship between the client and the server is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services ("Virtual Private Server", or "VPS" for short). The server may also be a server of a distributed system, or a server combined with a blockchain.

[0155] It should be noted that artificial intelligence is a discipline that studies how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, planning, etc.), and includes both hardware-level and software-level technologies. Artificial intelligence hardware technologies generally include technologies such as sensors, dedicated artificial intelligence chips, cloud computing, distributed storage, and big data processing; artificial intelligence software technologies mainly include computer vision technology, speech recognition technology, natural language processing technology, as well as machine learning / deep learning, big data processing technology, knowledge graph technology, and other major directions.

[0156] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0157] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A training method for an anomaly detection model, characterized in that: include: Input a preset number of sample data into a first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; Input the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing, obtain pseudo negative sample data corresponding to each sample data, and perform data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; According to the first detection result and the label data, a first loss value corresponding to the first detection network is calculated by a preset loss function, and according to the second detection result and the label data, a second loss value corresponding to the second detection network is calculated by the preset loss function; The first detection network and the second detection network are subjected to model training processing by a preset model optimization method until the first loss value and the second loss value are both no greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model.

2. The method according to claim 1, characterized in that The step of inputting a preset number of sample data into the first detection network for data detection processing to obtain a first detection result includes: Convolutionally processing the sample data through a first encoding structure in the first detection network to obtain convolved sample data; wherein the first detection network includes the first encoding structure and a first decoding structure, and the first encoding structure includes a plurality of convolutional layers for convolutionally processing the data; The convolved sample data is deconvolved through the first decoding structure to obtain the first detection result, wherein the first decoding structure includes multiple deconvolution layers for deconvolution of data.

3. The method according to claim 1, characterized in that The inputting the preset number of sample data into the second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data comprises: The order of data channels of the convolutional layer in the second encoding structure of the second detection network is shuffled, and the sample data is locally abstracted and / or globally abstracted through the shuffled convolutional layer to obtain pseudo negative sample data corresponding to each sample data, wherein the second detection network includes the second encoding structure, and the second encoding structure includes multiple convolutional layers.

4. The method according to claim 3, characterized in that The inputting the preset number of sample data into the second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data comprises: The order of the data channels of the first convolutional layer in the second coding structure is disrupted, and the sample data is locally abstracted through the disrupted first convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the first convolutional layer is the convolutional layer closest to the input layer in the second coding structure; and / or, The order of data channels of the second convolutional layer in the second encoding structure is shuffled, and the sample data is globally abstracted through the shuffled second convolutional layer to obtain the pseudo negative sample data corresponding to each sample data; wherein the second convolutional layer is the convolutional layer farthest from the input layer in the second encoding structure.

5. The method according to claim 1, characterized in that The performing data detection processing on the pseudo negative sample data to obtain a second detection result includes: The pseudo negative sample data is deconvolved through a second decoding structure in the second detection network to obtain the second detection result, wherein the second detection network includes the second decoding structure, and the second decoding structure includes multiple deconvolution layers for deconvolution processing of the data.

6. A method for anomaly detection, characterized in that: include: The acquired data to be detected is input into the trained anomaly detection model for data inference processing to obtain the data inference value corresponding to each data to be detected; Calculating a reconstruction error between each of the data inference values ​​and the corresponding data to be detected; It is determined whether the reconstruction error is greater than a preset error threshold, and the data state of the data to be detected is determined according to the determination result to obtain an abnormality detection result.

7. The method according to claim 6, characterized in that Determining the abnormality detection result of the to-be-detected data according to the judgment result includes: When the reconstruction error is greater than the preset error threshold, determining that the data to be detected corresponding to the reconstruction error is abnormal data; When the reconstruction error is not greater than the preset error threshold, it is determined that the data to be detected corresponding to the reconstruction error is normal data.

8. A training device for an anomaly detection model, characterized in that: include: An input unit, used to input a preset number of sample data into the first detection network for data detection processing to obtain a first detection result; wherein each of the sample data carries corresponding label data; A first processing unit, configured to input the preset number of sample data into a second detection network for local abstract processing and / or global abstract processing to obtain pseudo negative sample data corresponding to each sample data; A second processing unit, configured to perform data detection processing on the pseudo negative sample data to obtain a second detection result; wherein the structure of the second detection network is the same as that of the first detection network, and shares an abstract layer structure with the first detection network; a calculation unit, configured to calculate a first loss value corresponding to the first detection network by using a preset loss function according to the first detection result and the label data, and to calculate a second loss value corresponding to the second detection network by using the preset loss function according to the second detection result and the label data; The optimization unit is used to perform model training processing on the first detection network and the second detection network by a preset model optimization method until the first loss value and the second loss value are both no greater than a preset loss threshold, and the first detection network is used as a trained anomaly detection model.

9. An abnormality detection device, characterized in that: include: An input unit is used to input the acquired data to be detected into the trained anomaly detection model for data inference processing to obtain a data inference value corresponding to each data to be detected; A calculation unit, used for calculating a reconstruction error between each of the data inference values ​​and the corresponding data to be detected; The determination unit is used to determine whether the reconstruction error is greater than a preset error threshold, and determine the data state of the data to be detected according to the determination result to obtain an abnormality detection result.

10. An electronic device, characterized in that: include: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-5 or the method of any one of claims 6-7.

Images