Abnormality detection method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an anomaly detection method and device, electronic equipment and a storage medium, and the method comprises the steps: obtaining abnormal events detected in a plurality of historical detection periods, carrying out the analysis of the obtained abnormal events, obtaining an abnormal object, and storing the abnormal object in a database; the method comprises the following steps: searching state data of a to-be-detected target object in a plurality of historical detection periods, then calculating a difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and an abnormal event of the abnormal object in each historical detection period, and performing anomaly detection processing on the target object according to the difference between the target object and the abnormal object corresponding to the plurality of historical detection periods. According to the technical scheme, the anomaly detection accuracy can be improved.

Description

Technical Field

[0001] The present application relates to the field of computers, and more specifically, to an anomaly detection method and device, an electronic device, a storage medium, and a program product. Background Art

[0002] In the related art, in order to detect whether objects such as accounts, IP (Internet Protocol) addresses, and devices are abnormal, the state data of the object is usually input into a prediction model to obtain an abnormal detection result of the detection object output by the prediction model. However, the detection accuracy of the prediction model is greatly affected by the training samples. If the difference between the training samples and the objects to be detected is large, the prediction accuracy is low. In addition, the stability of the prediction model is low, thereby reducing the accuracy of abnormality detection. Summary of the invention

[0003] The embodiments of the present application provide an anomaly detection method and device, an electronic device, a storage medium, and a program product, which can improve the accuracy of anomaly detection.

[0004] According to one aspect of an embodiment of the present application, a method for detecting anomalies is provided, the method comprising:

[0005] Acquire abnormal events detected in multiple historical detection cycles, and parse the acquired abnormal events to obtain abnormal objects;

[0006] Searching for status data of the target object to be detected in the plurality of historical detection cycles;

[0007] Calculate the difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period;

[0008] According to the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection periods, abnormality detection processing is performed on the target object.

[0009] According to one aspect of an embodiment of the present application, there is provided an abnormality detection device, the device comprising:

[0010] An acquisition module is configured to acquire abnormal events detected in multiple historical detection cycles, and parse the acquired abnormal events to obtain abnormal objects;

[0011] A search module configured to search for state data of a target object to be detected within the plurality of historical detection cycles;

[0012] a calculation module configured to calculate the difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period;

[0013] The detection module is configured to perform anomaly detection processing on the target object according to the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection cycles.

[0014] In an exemplary embodiment, based on the aforementioned scheme, the detection module is specifically configured as follows: summing the differences between the target object and the abnormal object corresponding to the multiple historical detection cycles respectively to obtain the total difference between the target object and the abnormal object; generating an abnormality value for describing the degree of abnormality of the target object based on the total difference; comparing the abnormality value of the target object with the set abnormality threshold, and determining the abnormality detection result of the target object based on the comparison result.

[0015] In an exemplary embodiment, based on the aforementioned scheme, the detection module is specifically configured as follows: if there are multiple abnormal objects, the total differences corresponding to the multiple abnormal objects are summed up to obtain the target difference between the target object and the multiple abnormal objects; the ratio between the target difference and the number of cycles of the multiple historical detection cycles is calculated to obtain the average difference; and based on the average difference, the abnormal value of the target object is generated.

[0016] In an exemplary embodiment, based on the aforementioned scheme, the detection module is specifically configured as follows: according to the time difference between each historical detection cycle and the current time, the weight value corresponding to each historical detection cycle is calculated; wherein the time difference is negatively correlated with the weight value; according to the weight values ​​corresponding to the multiple historical detection cycles, the differences between the target object and the abnormal object corresponding to the multiple historical detection cycles are weightedly summed to obtain the total difference.

[0017] In an exemplary embodiment, based on the aforementioned scheme, the calculation module is specifically configured as follows: from the status data of the target object in each historical detection cycle, filter out the status data associated with the abnormal object; calculate the abnormal feature parameters of the target object in each historical detection cycle based on the filtered status data, and calculate the abnormal feature parameters of the abnormal object in each historical detection cycle based on the abnormal events of the abnormal object in each historical detection cycle; calculate the difference between the abnormal feature parameters corresponding to the target object and the abnormal object in each historical detection cycle.

[0018] In an exemplary embodiment, based on the aforementioned scheme, under the condition that the number of abnormal objects is multiple, the calculation module is specifically configured as follows: according to the filtered status data, searching from multiple abnormal objects for associated abnormal objects that are associated with the target object in each historical detection cycle; calculating the number of abnormal events corresponding to each abnormal object in each historical detection cycle; and selecting, from the set multiple abnormal feature parameters, abnormal feature parameters that match the number of associated abnormal objects as the abnormal feature parameters of the target object in each historical detection cycle, and abnormal feature parameters that match the number of abnormal events as the abnormal feature parameters of each abnormal object in each historical detection cycle.

[0019] In an exemplary embodiment, based on the aforementioned scheme, under the condition that the set multiple abnormal feature parameters include a first parameter and a second parameter with different values, the calculation module is specifically configured as: if the number of associated abnormal objects is greater than or equal to the object number threshold, the first parameter is selected as the abnormal feature parameter of the target object in each historical detection cycle; if the number of associated abnormal objects is less than the object number threshold, the second parameter is selected as the abnormal feature parameter of the target object in each historical detection cycle; if the number of abnormal events is greater than or equal to the event number threshold, the first parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection cycle; if the number of abnormal events is less than the event number threshold, the second parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection cycle.

[0020] In an exemplary embodiment, based on the aforementioned scheme, under the condition that the abnormal event includes an abnormal transaction event, the calculation module is specifically configured as follows: according to the transaction data contained in the filtered status data, the transaction amount between the target object and the abnormal object in each historical detection period is calculated; according to the abnormal transaction events of the abnormal object in each historical detection period, the abnormal transaction amount of the abnormal object in each historical detection period is calculated; according to the transaction amount, the abnormal feature parameters of the target object in each historical detection period are calculated, and according to the abnormal transaction amount, the abnormal feature parameters of the abnormal object in each historical detection period are calculated.

[0021] In an exemplary embodiment, based on the aforementioned scheme, the calculation module is specifically configured as follows: according to the filtered status data, searching for abnormal events associated with the target object from the abnormal events detected in each historical detection cycle; according to the number of abnormal events found, calculating the abnormal feature parameters of the target object in each historical detection cycle; according to the number of abnormal events of the abnormal object in each historical detection cycle, calculating the abnormal feature parameters of the abnormal object in each historical detection cycle.

[0022] In an exemplary embodiment, based on the aforementioned scheme, the acquisition module is specifically configured to: parse the acquired abnormal event to obtain a set of abnormal objects corresponding to the abnormal event; and filter out abnormal objects that match the type of the target object from the multiple types of abnormal objects contained in the abnormal object set.

[0023] In an exemplary embodiment, based on the aforementioned scheme, the acquisition module is further configured to: train multiple anomaly detection models respectively according to the attribute data corresponding to the abnormal objects contained in the abnormal object set; wherein the types of the multiple anomaly detection models are not exactly the same; screen out the target anomaly detection model with the best performance from the trained multiple anomaly detection models; input the attribute data of the specified object into the target anomaly detection model to obtain the anomaly detection result of the specified object; if the anomaly detection result of the specified object indicates that the specified object is abnormal, add the specified object to the abnormal object set.

[0024] In an exemplary embodiment, based on the above solution, the acquisition module is further configured to: search for objects associated with abnormal objects included in the abnormal object set; and add the searched objects to the abnormal object set.

[0025] According to one aspect of an embodiment of the present application, there is provided an electronic device, including:

[0026] one or more processors;

[0027] A storage device is used to store one or more computer programs. When the one or more computer programs are executed by the one or more processors, the electronic device implements the anomaly detection method as described above.

[0028] According to one aspect of an embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor of an electronic device, the electronic device implements the anomaly detection method as described above.

[0029] According to one aspect of an embodiment of the present application, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the anomaly detection method as described above is implemented.

[0030] In the technical solution provided in the embodiments of the present application, abnormal events detected in multiple historical detection cycles are first obtained, and the obtained abnormal events are analyzed to obtain abnormal objects, and the status data of the target object to be detected in multiple historical detection cycles are found. Then, based on the status data of the target object in each historical detection cycle and the abnormal events of the abnormal object in each historical detection cycle, the difference between the target object and the abnormal object corresponding to each historical detection cycle is calculated, so as to perform abnormal detection processing on the target object according to the difference between the target object and the abnormal object corresponding to multiple historical detection cycles. In this way, in the abnormal detection process, the correlation between the target object and the abnormal event, the abnormal object, and the influence of the time factor on the abnormal detection are fully considered, thereby improving the accuracy of abnormal detection.

[0031] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 is a schematic diagram of an implementation environment shown in an exemplary embodiment of the present application;

[0033] Figure 2 is a flow chart of an abnormality detection method shown in an exemplary embodiment of the present application;

[0034] Figure 3 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0035] Figure 4 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0036] Figure 5 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0037] Figure 6 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0038] Figure 7 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0039] Figure 8 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0040] Fig. 9 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0041] Fig.10 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0042] Fig.11 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0043] Fig.12 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0044] Fig.13 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0045] Fig.14 is a flow chart of an abnormality detection method shown in another exemplary embodiment of the present application;

[0046] Fig.15 is a block diagram of calculating an abnormal characteristic parameter matrix shown in an exemplary embodiment of the present application;

[0047] Fig.16 is a block diagram of anomaly detection shown in an exemplary embodiment of the present application;

[0048] Fig.17 is a schematic diagram of an abnormality detection device shown in an exemplary embodiment of the present application;

[0049] Fig.18 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown. DETAILED DESCRIPTION

[0050] Here, exemplary embodiments will be described in detail, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application as detailed in the attached claims.

[0051] The block diagrams shown in the accompanying drawings are merely functional entities and do not necessarily correspond to physically independent entities. That is, these functional entities may be implemented in software form, or in one or more hardware modules or integrated circuits, or in different networks and / or processor devices and / or microcontroller devices.

[0052] The flowcharts shown in the accompanying drawings are only exemplary and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps can be decomposed, and some operations / steps can be combined or partially combined, so the actual execution order may change according to actual conditions.

[0053] It should also be noted that the "multiple" mentioned in this application refers to two or more than two. "And / or" describes the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previous and next associated objects are in an "or" relationship.

[0054] The following is a detailed introduction to the technical solutions of the embodiments of the present application:

[0055] In the related art, a prediction model is used to detect whether an object is abnormal, but the accuracy of abnormality detection is low. Based on this, the embodiments of the present application provide an abnormality detection method and device, an electronic device, a storage medium, and a program product, which can improve the accuracy of abnormality detection.

[0056] See also Figure 1 , Figure 1 1 is a schematic diagram of an implementation environment involved in the present application, which includes a terminal device 110 and a server 120. The terminal device 110 and the server 120 communicate with each other through a wired or wireless network, and the terminal device 110 can upload its own data to the server 120 or obtain data from the server 120.

[0057] Among them, the terminal device 110 may include but is not limited to smart phones, tablets, laptops, computers, intelligent voice interaction devices, smart home appliances, vehicle-mounted terminals, aircraft, remote driving terminals, etc.; the server 120 may be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network) and big data and artificial intelligence platforms. The specific forms of terminal devices and servers are not restricted here.

[0058] It should be noted that Figure 1 The number of terminal devices 110 and servers 120 in the figure is only for illustration, and any number of terminal devices 110 and servers 120 may be provided according to actual needs.

[0059] In an exemplary embodiment, the anomaly detection method provided by the embodiment of the present application can be executed by the terminal device 110. Exemplarily, the terminal device 110 can first obtain abnormal events detected in multiple historical detection cycles, and parse the acquired abnormal events to obtain abnormal objects, find the state data of the target object to be detected in multiple historical detection cycles, and then, according to the state data of the target object in each historical detection cycle and the abnormal events of the abnormal object in each historical detection cycle, calculate the difference between the target object and the abnormal object corresponding to each historical detection cycle, so as to perform abnormal detection processing on the target object according to the difference between the target object and the abnormal object corresponding to multiple historical detection cycles. Compared with related technologies, the correlation between the target object and the abnormal event and the abnormal object, as well as the influence of the time factor on the abnormal detection, are fully considered, and the accuracy of the abnormal detection is improved.

[0060] In another exemplary embodiment, the server 120 may have functions similar to those of the terminal device 110, so as to execute the anomaly detection method provided in the embodiment of the present application. Exemplarily, the server 120 may first obtain abnormal events detected in multiple historical detection cycles, parse the obtained abnormal events, obtain abnormal objects, find the state data of the target object to be detected in multiple historical detection cycles, and then, based on the state data of the target object in each historical detection cycle and the abnormal events of the abnormal object in each historical detection cycle, calculate the difference between the target object and the abnormal object corresponding to each historical detection cycle, so as to perform abnormal detection processing on the target object according to the difference between the target object and the abnormal object corresponding to multiple historical detection cycles.

[0061] In another exemplary embodiment, the terminal device 110 and the server 120 may also jointly execute the anomaly detection method provided by the embodiment of the present application. Exemplarily, the terminal device 110 may search for the state data of the target object to be detected in multiple historical detection cycles, and send the state data to the server 120; the server 120 obtains the abnormal events detected in multiple historical detection cycles, and parses the obtained abnormal events to obtain the abnormal object, and then, according to the state data of the target object in each historical detection cycle, and the abnormal events of the abnormal object in each historical detection cycle, calculate the difference between the target object and the abnormal object corresponding to each historical detection cycle, so as to perform abnormal detection processing on the target object according to the difference between the target object and the abnormal object corresponding to multiple historical detection cycles.

[0062] The embodiments of the present application involve abnormal events, status data, and other user-related data. When the methods of the present application are applied to specific products or technologies, the user's permission or consent is obtained, and the extraction, use, and processing of the relevant data comply with local safety standards and local laws and regulations.

[0063] See also Figure 2 , Figure 2 is a flowchart of an abnormality detection method shown in an exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0064] like Figure 2 As shown, in an exemplary embodiment, the abnormality detection method may include steps S210 to S240, which are described in detail as follows:

[0065] Step S210, obtaining abnormal events detected in multiple historical detection cycles, and parsing the obtained abnormal events to obtain abnormal objects.

[0066] It should be noted that the historical detection cycle refers to a cycle earlier than the current time, and the duration corresponding to each cycle can be flexibly set according to actual needs, for example, it can be set to 1 day, 1 week, 1 month, etc.

[0067] Abnormal events refer to non-normal events that occur in the network, and their types include but are not limited to at least one of abnormal transactions, abnormal communications, abnormal data access, and equipment failures.

[0068] Abnormal objects refer to entities or virtual objects involved in abnormal events, including but not limited to at least one of the actor, account, account, network channel, IP address, URL (Universal Resource Locator) address, device, etc. corresponding to the abnormal event, wherein the actor refers to the party that generates the abnormal behavior, for example, for abnormal transaction events, the actor refers to the transaction party (for example, merchants, companies, individuals, etc.), and for abnormal communication events, the actor refers to the communication party (for example, data sender, data receiver), etc. The network channel refers to the platform, channel, scenario, etc. where the event occurs, and its types include but are not limited to application software, applets, browsers, web applications, etc. For example, if the abnormal event is an abnormal transaction event, the abnormal transaction event usually involves the transaction party (for example, merchants, companies, individuals, etc.), transaction account, transaction account, transaction channel, IP address corresponding to the transaction (IP address where the transaction occurs), URL address corresponding to the transaction (for example, URL address browsed by the transaction account), and the device to which the transaction belongs (for example, mobile phone, computer, etc. that logs in to the transaction account).

[0069] In order to improve the accuracy of anomaly detection, the abnormal events detected in multiple historical detection cycles can be obtained, and the abnormal objects involved in the abnormal events can be parsed from the abnormal events detected in multiple historical detection cycles. The number of cycles corresponding to the multiple historical detection cycles can be flexibly set according to actual needs. For example, the abnormal events detected in 3, 4, or 5 historical detection cycles can be obtained.

[0070] The method of obtaining abnormal events detected in multiple historical detection cycles includes but is not limited to at least one of the following methods:

[0071] The first method is to search for events that occurred within multiple historical detection cycles and detect whether the found events are abnormal, thereby obtaining abnormal events. Among them, the specific method of detecting abnormal events includes but is not limited to at least one of the following methods: 1. Determine whether the event is an abnormal event based on manual identification information, wherein the manual identification information includes at least one of information on whether the event is abnormal, customer feedback information on the event (for example, complaints, good reviews, etc.), etc.; 2. Perform statistical analysis on events that occurred in multiple historical detection cycles to determine whether the event is abnormal, wherein the frequency of occurrence, location of occurrence, etc. of the event can be statistically analyzed to determine whether the event is abnormal. For example, the login location of an account is usually a, and the location where the account last logged in is b, which indicates that the login is abnormal; for another example, the number of transactions per month of a trading account is usually less than 10 times. If the number of transactions of the trading account in a certain month is 40 times, it indicates that the transaction of the trading account in that month is abnormal; 3. For the events detected in each historical detection cycle, calculate the abnormality degree corresponding to each event, and regard the events with abnormality degrees higher than the set threshold as abnormal events, or sort the events detected in the historical detection cycle in descending order of abnormality degrees, and select a specified number of events with the highest ranking as abnormal events.

[0072] Second, in order to enrich abnormal events, abnormal events that occurred in multiple historical detection cycles can be searched from the network.

[0073] Step S220, searching for status data of the target object to be detected in multiple historical detection cycles.

[0074] The target object refers to the object to be detected for abnormality, and its types include but are not limited to account number, IP address, URL, device, network channel, etc. The state data of the target object refers to the data related to the target object, such as the transaction data, operation status data, communication data, etc. of the target object.

[0075] Step S230, calculating the difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period.

[0076] The difference between the target object and the abnormal object corresponding to each historical detection cycle refers to the difference between the target object and the abnormal object within the historical detection cycle.

[0077] The difference between the target object and the abnormal object can reflect the probability that the target object is abnormal, wherein the greater the difference between the target object and the abnormal object, the higher the probability that the target object is abnormal, and the smaller the difference, the smaller the probability that the target object is abnormal. In order to improve the accuracy of the difference calculation, for each historical detection cycle, the difference between the target object and the abnormal object in the historical detection cycle can be calculated based on the state data of the target object in the historical detection cycle and the abnormal events of the abnormal object in the historical detection cycle. In other words, the difference between the target object and the abnormal object in the same detection cycle is calculated based on the state data of the target object and the abnormal events of the abnormal object in the same detection cycle.

[0078] Step S240: performing anomaly detection processing on the target object according to the differences between the target object and the abnormal object corresponding to the multiple historical detection cycles.

[0079] In order to improve the accuracy of anomaly detection, the differences between the target object and the abnormal object corresponding to multiple historical detection cycles are combined to detect whether the target object has an abnormality.

[0080] exist Figure 2 In the illustrated embodiment, based on the state data of the target object in each historical detection cycle and the abnormal events of the abnormal object in each historical detection cycle, the difference between the target object and the abnormal object corresponding to each historical detection cycle is calculated, and based on the difference between the target object and the abnormal object corresponding to multiple historical detection cycles, the target object is detected for abnormality. On the one hand, in the process of abnormality detection, the correlation between the target object and the abnormal events and the abnormal object is fully considered, thereby improving the accuracy of abnormality detection. In addition, the target object is detected for abnormality in combination with the abnormal events and abnormal objects of multiple historical detection cycles, thereby fully referring to the influence of the time factor on abnormality detection, thereby further improving the accuracy of abnormality detection. On the other hand, whether the target object is abnormal is detected by associating it with the abnormal events and the abnormal objects, which facilitates the explanation and determination of the cause of the abnormality and improves the efficiency of abnormality handling.

[0081] In an exemplary embodiment, see Figure 3 , Figure 3 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0082] like Figure 3 As shown, the method includes steps S210 to S230, and steps S310 to S330, wherein steps S310 to S330 are described in detail as follows:

[0083] Step S310 , performing a sum operation on the differences between the target object and the abnormal object corresponding to a plurality of historical detection cycles, to obtain a total difference between the target object and the abnormal object.

[0084] The differences between the target object and the abnormal object corresponding to multiple historical detection cycles are summed up to obtain the differences between the target object and the abnormal object in the multiple historical detection cycles, that is, the total difference between the target object and the abnormal object.

[0085] Step S320: generating an abnormality value for describing the degree of abnormality of the target object according to the total difference.

[0086] According to the total difference between the target object and the abnormal object, the abnormal value of the target object can be calculated, and the abnormal value is used to characterize the abnormal degree of the target object, that is, the probability that the target object is abnormal. The total difference and the abnormal value of the target object can be positively correlated, that is, the greater the total difference between the target object and the abnormal object, the greater the abnormal value of the target object; or the total difference and the abnormal value of the target object can be negatively correlated, that is, the greater the total difference between the target object and the abnormal object, the smaller the abnormal value of the target object.

[0087] It should be noted that Figure 3 In the embodiment shown, the total difference between the target object and the abnormal object is used to generate the abnormal value of the target object. In other embodiments, one of the maximum value, minimum value, median value, average value, mode, etc. can be found from the differences between the target object and the abnormal object corresponding to multiple historical detection periods, and the abnormal value of the target object is generated according to the found value. The generation method is similar to the method of generating the abnormal value of the target object according to the total difference, and will not be repeated here.

[0088] Step S330, comparing the abnormal value of the target object with the set abnormal threshold, and determining the abnormal detection result of the target object according to the comparison result.

[0089] The abnormality threshold is a value used to determine whether the target object is abnormal. By comparing the abnormal value of the target object with the set threshold, it can be determined whether the target object is abnormal. The abnormality detection result is used to indicate whether the target object is abnormal.

[0090] Among them, if the abnormal value of the target object is positively correlated with the total difference, it means that the larger the abnormal value of the target object, the lower the probability that the target object is abnormal. Therefore, under the condition that the abnormal value of the target object is greater than the set abnormal threshold, it is determined that there is no abnormality in the target object; under the condition that the abnormal value of the target object is less than or equal to the set abnormal threshold, it is determined that the target object is abnormal.

[0091] If the abnormal value of the target object is negatively correlated with the total difference, it means that the larger the abnormal value of the target object is, the higher the probability that the target object is abnormal. Therefore, under the condition that the abnormal value of the target object is greater than the set abnormal threshold, it is determined that the target object is abnormal; under the condition that the abnormal value of the target object is less than or equal to the set abnormal threshold, it is determined that the target object is not abnormal.

[0092] It should be noted that Figure 3 The specific implementation details of steps S210 to S230 shown in FIG. Figure 2 Steps S210 to S230 shown are not repeated here.

[0093] exist Figure 3 In the illustrated embodiment, the differences between the target object and the abnormal object corresponding to a plurality of historical detection periods are summed to obtain a total difference between the target object and the abnormal object, and an abnormal value of the target object is generated based on the total difference, thereby determining the abnormal detection result of the target object based on a comparison result between the abnormal value of the target object and a set abnormal threshold value, so that in the abnormal detection process, not only the differences between the target object and the abnormal object corresponding to a plurality of historical detection periods are comprehensively considered, thereby improving the accuracy of abnormal detection, but also the abnormal detection method is simple, thereby improving the efficiency of abnormal detection.

[0094] In an exemplary embodiment, see Figure 4 , Figure 4 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0095] like Figure 4 As shown, the method includes steps S210-step S230, step S310, step S410-step S430, and step S330, wherein steps S410-step S430 are described in detail as follows:

[0096] Step S410: If there are multiple abnormal objects, summing up the total differences corresponding to the multiple abnormal objects to obtain the target difference between the target object and the multiple abnormal objects.

[0097] The total difference corresponding to the abnormal object refers to the total difference between the target object and the abnormal object.

[0098] When there are multiple abnormal objects, in step S310, the total difference between the target object and each abnormal object, that is, the total difference corresponding to each abnormal object, is calculated. Therefore, the sum of the total differences corresponding to the multiple abnormal objects can be used as the target difference between the target object and the multiple abnormal objects.

[0099] Optionally, if the number of abnormal objects is 1, the total difference corresponding to the abnormal object can be directly used as the target difference.

[0100] It should be noted that in Figure 4 In the illustrated embodiment, the sum of the total differences corresponding to the multiple abnormal objects is used as the target difference. In other embodiments, one of the maximum value, minimum value, median value, average value, mode, etc. can be found from the total differences corresponding to the multiple abnormal objects, and the found value can be used as the target difference.

[0101] Step S420, calculating the ratio between the target difference and the number of cycles of multiple historical detection cycles to obtain an average difference.

[0102] The number of cycles refers to the number of historical detection cycles included in multiple historical detection cycles. For example, assuming that 3 historical detection cycles are included, the number of cycles is 3.

[0103] The ratio between the target difference and the number of cycles in multiple historical detection cycles is calculated to obtain the average difference between the target object and the abnormal object in multiple historical detection cycles, that is, the average difference = target difference ÷ number of cycles.

[0104] Step S430: Generate an abnormal value of the target object according to the average difference.

[0105] Optionally, the average difference and the abnormal value of the target object may be positively correlated, that is, the larger the average difference, the larger the abnormal value of the target object; or the average difference and the abnormal value of the target object may be negatively correlated, that is, the smaller the average difference, the larger the abnormal value of the target object.

[0106] The specific method of generating the abnormal value of the target object can be flexibly set according to actual needs. In an optional example, under the condition that the average difference is negatively correlated with the abnormal value of the target object, the abnormal value of the target object can be the difference between the set value and the average difference, that is, the abnormal value of the target object = the set value - the average difference. For example, the set value can be 0, 1, 2, etc. In an optional example, if the set value is 1, the abnormal value of the target object can be calculated by the following formula:

[0107]

[0108] Among them, RISK represents the abnormal value of the target object, N represents the number of cycles, M represents the number of abnormal objects, and Y i represents the total difference corresponding to the i-th abnormal object, that is, the total difference between the target object and the i-th abnormal object, represents the mean difference, Represents the target difference.

[0109] It should be noted that Figure 4 The specific implementation details of steps S210 to S230 shown in FIG. Figure 2 Steps S210 to S230 are shown. Figure 4 The specific implementation details of step S310 and step S330 shown in FIG. Figure 3 Step S310 and step S330 shown are not repeated here.

[0110] exist Figure 4 In the illustrated embodiment, when there are multiple abnormal objects, the total differences corresponding to the multiple abnormal objects are summed to obtain the target difference between the target object and the multiple abnormal objects, and the ratio between the target difference and the number of cycles of multiple historical detection cycles is calculated to obtain the average difference. Based on the average difference, an abnormality value of the target object is generated, so that the target object is detected for abnormality in combination with the multiple abnormal objects, thereby improving the detection accuracy. Moreover, the abnormality value of the target object is generated based on the average difference, which reduces the calculation difficulty and improves the abnormality detection efficiency.

[0111] In an exemplary embodiment, see Figure 5 , Figure 5 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0112] like Figure 5 As shown, the method includes steps S210-step S230, steps S510-step S520, and steps S320-step S330, wherein steps S510-step S520 are described in detail as follows:

[0113] Step S510, calculating the weight value corresponding to each historical detection period according to the time difference between each historical detection period and the current time; wherein the time difference is negatively correlated with the weight value.

[0114] The further away the data is from the current time, the lower its value and the lower its reference value. Therefore, we can first calculate the time difference between each historical detection cycle and the current time, and then calculate the weight value corresponding to the historical detection cycle based on the time difference between each historical detection cycle and the current time. The longer the time difference between the historical detection cycle and the current time, the lower the weight value corresponding to the historical detection cycle.

[0115] Step S520, according to the weight values ​​corresponding to the multiple historical detection periods, respectively, weighted sum is performed on the differences between the target object and the abnormal object corresponding to the multiple historical detection periods, to obtain a total difference.

[0116] According to the calculated weight value, the differences between the target object and the abnormal object corresponding to multiple historical detection cycles are weighted and summed, and the obtained value is the total difference between the target object and the abnormal object. In other words, the total difference between the target object and the abnormal object can be calculated by the following formula:

[0117]

[0118] Among them, y i , j represents the difference between the target object corresponding to the jth historical detection cycle and the ith abnormal object, w j Represents the weight value corresponding to the j-th historical detection cycle.

[0119] It should be noted that Figure 5 The specific implementation details of steps S210 to S230 shown in FIG. Figure 2 Steps S210 to S230 are shown. Figure 5 The specific implementation details of steps S320 to S330 shown in FIG. Figure 3 Steps S320 to S330 shown are not repeated here.

[0120] exist Figure 5In the illustrated embodiment, based on the weight values ​​corresponding to multiple historical detection periods, the differences between the target objects and the abnormal objects corresponding to the multiple historical detection periods are weighted and summed to obtain the total difference, wherein the weight value corresponding to each historical detection period is negatively correlated with the time difference between the historical detection period and the current time, thereby fully considering the impact of the time factor on the data value, thereby improving the accuracy of anomaly detection.

[0121] In an exemplary embodiment, see Figure 6 , Figure 6 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0122] like Figure 6 As shown, the method includes steps S210 to S220, steps S610 to S630, and step S240, wherein steps S610 to S630 are described in detail as follows:

[0123] Step S610: Filter out the status data associated with the abnormal object from the status data of the target object in each historical detection cycle.

[0124] The correlation between the target object and the abnormal object can reflect whether the target object is abnormal. Therefore, the status data associated with the abnormal object can be filtered out from the status data of the target object in each historical detection cycle. In other words, the filtered status data belongs to the historical detection cycle and is related to both the target object and the abnormal object. For example, the filtered status data can be the transaction data, communication data, etc. between the target object and the abnormal object in the historical detection cycle.

[0125] Step S620, calculating the abnormal feature parameters of the target object in each historical detection cycle according to the filtered status data, and calculating the abnormal feature parameters of the abnormal object in each historical detection cycle according to the abnormal events of the abnormal object in each historical detection cycle.

[0126] Abnormal characteristic parameters refer to parameters used to describe abnormal characteristics such as whether it is abnormal and the degree of abnormality, which can be expressed in the form of numbers, arrays, etc.

[0127] The abnormal characteristic parameters of the target object in each historical detection cycle are determined based on the state data of the target object in the historical detection cycle and associated with the abnormal object.

[0128] The abnormal characteristic parameters of the abnormal object in each historical detection cycle are determined according to the abnormal events that occurred in the abnormal object in the historical detection cycle.

[0129] Step S630, calculating the difference between the abnormal feature parameters corresponding to the target object and the abnormal object in each historical detection cycle.

[0130] The abnormal feature parameters of the target object in each historical detection cycle are compared with the abnormal feature parameters of the abnormal object in the historical detection cycle, so as to obtain the difference between the target object and the abnormal object corresponding to the historical detection cycle.

[0131] Optionally, the difference between the abnormal feature parameters of the target object in each historical detection period and the abnormal feature parameters of the abnormal object in the historical detection period can be calculated first, and the difference, the absolute value of the difference, or the square of the difference can be used as the difference between the target object and the abnormal object corresponding to the historical detection period.

[0132] It should be noted that Figure 6 The specific implementation details of steps S210-S220 and step S240 shown in FIG. Figure 2 Steps S210 to S220 and step S240 are shown and will not be described in detail here.

[0133] exist Figure 6 In the illustrated embodiment, status data associated with an abnormal object is screened out from the status data of the target object in each historical detection cycle, and anomaly detection is performed on the target object based on the screened status data, which can reduce the amount of data processing and improve the accuracy of anomaly detection; and, after the status data of the target object is converted into abnormal feature parameters, and the abnormal events of the abnormal object are also converted into abnormal feature parameters, the difference between the target object and the abnormal object is calculated based on the obtained abnormal feature parameters, thereby improving the comparability between the target object and the abnormal object, and further improving the accuracy of anomaly detection.

[0134] In an exemplary embodiment, see Figure 7 , Figure 7 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0135] like Figure 7 As shown, under the condition that the number of abnormal objects is multiple, the method includes steps S210-step S220, step S610, step S710-step S730, step S630, and step S240, wherein the detailed description of steps S710-step S730 is as follows:

[0136] Step S710: searching, from among the plurality of abnormal objects, for an associated abnormal object that is associated with the target object in each historical detection cycle, according to the filtered state data.

[0137] The associated abnormal object refers to an abnormal object that is associated with the target object, for example, an abnormal object that has conducted transactions or communications with the target object.

[0138] The more abnormal objects the target object is associated with, the higher the probability of abnormality. Therefore, under the condition of multiple abnormal objects, for each historical detection cycle, we can first find the abnormal objects associated with the target object in the historical detection cycle from the multiple abnormal objects based on the filtered status data, that is, the associated abnormal objects of the target object in the historical detection cycle.

[0139] Step S720, calculating the number of abnormal events corresponding to each abnormal object in each historical detection cycle.

[0140] The more abnormal events corresponding to an abnormal object, the higher the abnormal degree thereof. Therefore, for each historical detection period, the number of abnormal events occurring for each abnormal object in the historical detection period can be calculated.

[0141] Step S730, from the set multiple abnormal feature parameters, select the abnormal feature parameters that match the number of associated abnormal objects as the abnormal feature parameters of the target object in each historical detection cycle, and the abnormal feature parameters that match the number of abnormal events as the abnormal feature parameters of each abnormal object in each historical detection cycle.

[0142] In order to improve the comparability between the abnormal feature parameters of the target object and the associated feature parameters of the abnormal object, a plurality of abnormal feature parameters may be preset. For example, a plurality of numbers may be set as the abnormal feature parameters.

[0143] In the process of determining the abnormal feature parameters of the target object in each detection cycle, the abnormal feature parameters that match the number of associated abnormal objects found in the historical detection cycle are selected from the set multiple abnormal feature parameters, and the selected abnormal feature parameters are used as the abnormal feature parameters of the target object in the detection cycle. Optionally, a mapping relationship between the set multiple abnormal feature parameters and the number of objects can be pre-set, and the abnormal feature parameters corresponding to the number of associated abnormal objects can be found from the mapping relationship as the abnormal feature parameters of the target object. For example, assuming that in the mapping relationship, the set multiple abnormal feature parameters include 0, 1, and 2, where 0, 1, and 2 correspond to the number of abnormal features [0-10], [11-40], and [41-100], respectively, if the number of associated abnormal objects of the target object in a certain historical detection cycle is 18, then the abnormal feature parameter of the target object in the historical detection cycle is 1.

[0144] In the process of determining the abnormal characteristic parameters of each abnormal object in each detection cycle, the abnormal characteristic parameters that match the number of abnormal events that occurred in the abnormal object in the historical detection cycle are selected from the set multiple abnormal characteristic parameters, and the selected abnormal characteristic parameters are used as the abnormal characteristic parameters of the abnormal object in the historical detection cycle. Optionally, a mapping relationship between the set multiple abnormal characteristic parameters and the number of events can be pre-set, and the abnormal characteristic parameters corresponding to the number of abnormal events of each abnormal object in each historical detection cycle can be found from the mapping relationship, and the found abnormal characteristic parameters can be used as the abnormal characteristic parameters of the abnormal object. For example, assuming that in the mapping relationship, the set multiple abnormal characteristic parameters include 0, 1, and 2, wherein the event numbers corresponding to 0, 1, and 2 are [0-15], [16-50], and [51-200], respectively, if a certain abnormal object has 10 abnormal events in a certain historical detection cycle, the abnormal characteristic parameter of the abnormal object in the historical detection cycle is 0.

[0145] It should be noted that Figure 7 The specific implementation details of steps S210-S220 and step S240 shown in FIG. Figure 2 Steps S210 to S220, and step S240 are shown. Figure 7 The specific implementation details of step S610 and step S630 shown in FIG. Figure 6 Step S610 and step S630 shown are not repeated here.

[0146] exist Figure 7In the illustrated embodiment, abnormal feature parameters of the target object are determined based on the number of abnormal objects associated with the target object, and the abnormal feature parameters of the abnormal object are determined based on the number of abnormal events corresponding to the abnormal object, so that the accuracy of the abnormal feature parameters can be improved, thereby improving the accuracy of abnormality detection; and, abnormal feature parameters corresponding to the target object and the abnormal object are selected from the set multiple abnormal feature parameters, thereby improving the comparability between the abnormal feature parameters of the target object and the abnormal feature parameters of the abnormal object, and further improving the accuracy of abnormality detection.

[0147] In an exemplary embodiment, see Figure 8 , Figure 8 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0148] like Figure 8 As shown, under the condition that the set multiple abnormal characteristic parameters include a first parameter and a second parameter with different values, the method includes steps S210-step S220, step S610, step S710-step S720, step S810-step S840, step S630, and step S240, wherein the detailed description of steps S810-step S840 is as follows:

[0149] Step S810: If the number of associated abnormal objects is greater than or equal to the object number threshold, a first parameter is selected as an abnormal feature parameter of the target object in each historical detection cycle.

[0150] In order to reduce the computational complexity, the multiple abnormal characteristic parameters that are set include a first parameter and a second parameter, wherein the first parameter and the second parameter correspond to different values. For example, 0 and 1 can be used as the first parameter and the second parameter, respectively.

[0151] The object quantity threshold refers to the value of the abnormal feature parameter corresponding to the target object, and its specific value can be flexibly set according to actual needs.

[0152] The number of associated abnormal objects of the target object in each historical detection cycle is compared with the object number threshold. If the number of associated objects is greater than or equal to the object number threshold, the first parameter is selected from the first parameter and the second parameter as the abnormal feature parameter of the target object in the historical detection cycle.

[0153] Step S820: If the number of associated abnormal objects is less than the object number threshold, a second parameter is selected as the abnormal feature parameter of the target object in each historical detection cycle.

[0154] If the number of abnormal objects associated with the target object in each historical detection period is less than the object number threshold, the second parameter is selected from the first parameter and the second parameter as the abnormal feature parameter of the target object in the historical detection period.

[0155] Step S830: If the number of abnormal events is greater than or equal to the event number threshold, the first parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection cycle.

[0156] The event quantity threshold refers to the numerical value of the abnormal feature parameter corresponding to the abnormal object used to select the abnormal object, and its specific value can be flexibly set according to actual needs.

[0157] The number of abnormal events of each abnormal object in each historical detection cycle is compared with the event number threshold. If the number of abnormal events is greater than or equal to the event number threshold, the first parameter is selected from the first parameter and the second parameter as the abnormal feature parameter of the abnormal object in the historical detection cycle.

[0158] Step S840: If the number of abnormal events is less than the event number threshold, a second parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection cycle.

[0159] If the number of abnormal events of each abnormal object in each historical detection period is less than the event number threshold, the second parameter is selected from the first parameter and the second parameter as the abnormal feature parameter of the abnormal object in the historical detection period.

[0160] That is to say, for each historical detection cycle, if the number of abnormal objects associated with the target object in the historical detection cycle is greater than or equal to the object number threshold, and the number of abnormal events of the abnormal object in the historical detection cycle is greater than or equal to the object number threshold; or, if the number of abnormal objects associated with the target object in the historical detection cycle is less than the object number threshold, and the number of abnormal events of the abnormal object in the historical detection cycle is less than the object number threshold, then the abnormal feature parameters of the target object in the historical detection cycle are the same as the abnormal feature parameters of the abnormal object in the historical detection cycle. If the number of abnormal objects associated with the target object in the historical detection cycle is greater than or equal to the object number threshold, and the number of abnormal events of the abnormal object in the historical detection cycle is less than the object number threshold; or, if the number of abnormal objects associated with the target object in the historical detection cycle is less than the object number threshold, and the number of abnormal events of the abnormal object in the historical detection cycle is greater than or equal to the object number threshold, then the abnormal feature parameters of the target object in the historical detection cycle are different from the abnormal feature parameters of the abnormal object in the historical detection cycle.

[0161] It should be noted that Figure 8 The specific implementation details of steps S210-S220 and step S240 shown in FIG. Figure 2 Steps S210 to S220, and step S240 are shown. Figure 8 The specific implementation details of step S610 and step S630 shown in FIG. Figure 6 Step S610 and step S630 shown in FIG. Figure 8 The specific implementation details of steps S710 to S720 shown in FIG. Figure 7 Steps S710 to S720 shown are not repeated here.

[0162] exist Figure 8 In the illustrated embodiment, the abnormal feature parameters of the target object are determined based on the comparison result between the number of abnormal objects associated with the target object and the object number threshold, and the abnormal feature parameters of the abnormal object are determined based on the comparison result between the number of abnormal events corresponding to the abnormal object and the event number threshold, which can improve the efficiency of determining the abnormal feature parameters and thus improve the efficiency of abnormal detection; and, if the number of abnormal objects associated with the target object is greater than or equal to the object number threshold, and the number of abnormal events corresponding to the abnormal object is greater than or equal to the event number threshold, it indicates that the abnormality levels of the target object and the abnormal object are both low; if the number of abnormal objects associated with the target object is less than the object number threshold, and the number of abnormal events corresponding to the abnormal object is less than the event number threshold, it indicates that the abnormality levels of the target object and the abnormal object are both high. Therefore, under this condition, the abnormal feature parameters of the target object are set to be the same as the abnormal feature parameters of the abnormal object, so as to improve the accuracy of abnormal detection.

[0163] In an exemplary embodiment, see Fig. 9 , Fig. 9 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0164] like Fig. 9 As shown, under the condition that the abnormal event includes an abnormal transaction event, the method includes steps S210-step S220, step S610, step S910-step S930, step S630, and step S240, wherein the detailed description of steps S910-step S930 is as follows:

[0165] Step S910, calculating the transaction amount between the target object and the abnormal object in each historical detection cycle according to the transaction data included in the filtered status data.

[0166] Under the condition that abnormal events include abnormal transaction events, the higher the transaction amount between the target object and the abnormal object, the greater the probability of an abnormality. Therefore, for each historical detection period, the transaction amount between the target object and the abnormal object in the historical detection period can be calculated based on the transaction data of the target object and the abnormal object in the historical detection period.

[0167] Step S920, calculating the abnormal transaction amount of the abnormal object in each historical detection period according to the abnormal transaction events of the abnormal object in each historical detection period.

[0168] The higher the transaction amount of the abnormal object, the higher the abnormal degree of the abnormal object. Therefore, for each historical detection period, the transaction amount of the abnormal object in the historical detection period can be determined based on the abnormal transaction events that occurred in the historical detection period, that is, the abnormal transaction amount of the abnormal object in the historical detection period.

[0169] It should be noted that, if multiple abnormal transaction events occur in an abnormal object within a certain historical detection period, the abnormal transaction amount of the abnormal object within the historical detection period may be the total transaction amount corresponding to these multiple abnormal transaction events.

[0170] Step S930, calculating the abnormal feature parameters of the target object in each historical detection period according to the transaction amount, and calculating the abnormal feature parameters of the abnormal object in each historical detection period according to the abnormal transaction amount.

[0171] According to the transaction amount between the target object and the abnormal object in each historical detection cycle, the abnormal feature parameters of the target object in the historical detection cycle can be calculated; according to the abnormal transaction amount of the abnormal object in each historical detection cycle, the abnormal feature parameters of the abnormal object in the historical detection cycle are calculated.

[0172] Among them, the method of calculating the abnormal characteristic parameters of the target object based on the transaction amount can be similar to the method of calculating the abnormal characteristic parameters of the abnormal object based on the abnormal amount. For example, in an optional embodiment, the abnormal characteristic parameters and the corresponding transaction amount can be positively correlated, that is, the higher the transaction amount between the target object and the abnormal object in each historical detection period, the higher the value corresponding to the abnormal characteristic parameters of the target object in the historical detection period, the higher the abnormal transaction amount of the abnormal object in the historical detection period, the higher the value corresponding to the abnormal characteristic parameters of the abnormal object in the historical detection period. Or, in another optional embodiment, the abnormal characteristic parameters and the corresponding transaction amount can be negatively correlated, that is, the higher the transaction amount between the target object and the abnormal object in each historical detection period, the lower the value corresponding to the abnormal characteristic parameters of the target object in the historical detection period, the higher the abnormal transaction amount of the abnormal object in the historical detection period, the lower the value corresponding to the abnormal characteristic parameters of the abnormal object in the historical detection period.

[0173] It should be noted that Fig. 9 The specific implementation details of steps S210-S220 and step S240 shown in FIG. Figure 2 Steps S210 to S220, and step S240 are shown. Fig. 9 The specific implementation details of step S610 and step S630 shown in FIG. Figure 6 Step S610 and step S630 shown are not repeated here.

[0174] exist Fig. 9 In the illustrated embodiment, abnormal feature parameters of the target object and the abnormal object are respectively determined based on the transaction amount corresponding to the target object and the abnormal transaction corresponding to the abnormal object. This can not only improve the comparability between the abnormal feature parameters of the target object and the abnormal feature parameters of the abnormal object, but also improve the accuracy of the abnormal feature parameters, thereby improving the accuracy of anomaly detection.

[0175] In an exemplary embodiment, see Fig.10 , Fig.10is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0176] like Fig.10 As shown, the method includes steps S210 to S220, step S610, step S1010 to S1030, step S630, and step S240, wherein steps S1010 to S1030 are described in detail as follows:

[0177] Step S1010: searching for abnormal events associated with the target object from abnormal events detected in each historical detection cycle according to the filtered status data.

[0178] The more abnormal events the target object is associated with, the higher the probability that the target object is abnormal. Therefore, for each historical detection cycle, the abnormal events associated with the target object can be found from the abnormal events detected in the historical detection cycle based on the state data of the filtered target object in the historical detection cycle.

[0179] The specific method of searching for abnormal events associated with the target object can be flexibly set according to actual needs. In an optional example, the abnormal events corresponding to the abnormal objects associated with the target object can be used as the abnormal events associated with the target object, or the abnormal events in which the target object participates can be screened out from the abnormal events corresponding to the abnormal objects associated with the target object, and the screened abnormal events can be used as the abnormal events associated with the target object.

[0180] Step S1020, calculating the abnormal feature parameters of the target object in each historical detection cycle according to the number of abnormal events found.

[0181] According to the number of abnormal events associated with the target object in each historical detection period, the abnormal feature parameters of the target object in the historical detection period are calculated.

[0182] Optionally, the number of associated abnormal events may be positively correlated with the value of the abnormal characteristic parameter, that is, the more the number of associated abnormal events is, the higher the value of the corresponding abnormal characteristic parameter is. Alternatively, the number of associated abnormal events may be negatively correlated with the value of the abnormal characteristic parameter, that is, the more the number of associated abnormal events is, the lower the value of the corresponding abnormal characteristic parameter is.

[0183] Step S1030, calculating the abnormal feature parameters of the abnormal object in each historical detection period according to the number of abnormal events of the abnormal object in each historical detection period.

[0184] According to the number of abnormal events that occurred in each historical detection period of the abnormal object, the abnormal feature parameters of the abnormal object in the historical detection period are calculated.

[0185] Among them, the calculation method of the abnormal characteristic parameters of the abnormal object is similar to the calculation method of the abnormal characteristic parameters of the target object. For example, if the number of abnormal events associated with the target object is positively correlated with the numerical value of the abnormal characteristic parameter corresponding to it, then the number of abnormal events corresponding to the abnormal object is positively correlated with the numerical value of the abnormal characteristic parameter corresponding to it; if the number of abnormal events associated with the target object is negatively correlated with the numerical value of the abnormal characteristic parameter corresponding to it, then the number of abnormal events corresponding to the abnormal object is negatively correlated with the numerical value of the abnormal characteristic parameter corresponding to it.

[0186] It should be noted that Fig.10 The specific implementation details of steps S210-S220 and step S240 shown in FIG. Figure 2 Steps S210 to S220, and step S240 are shown. Fig.10 The specific implementation details of step S610 and step S630 shown in FIG. Figure 6 Step S610 and step S630 shown are not repeated here.

[0187] exist Fig.10 In the illustrated embodiment, abnormal feature parameters of the target object and the abnormal object are respectively determined based on the number of abnormal events associated with the target object and the number of abnormal events corresponding to the abnormal object. This can not only improve the comparability between the abnormal feature parameters of the target object and the abnormal feature parameters of the abnormal object, but also improve the accuracy of the abnormal feature parameters, thereby improving the accuracy of abnormality detection.

[0188] In an exemplary embodiment, see Fig.11 , Fig.11 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0189] like Fig.11As shown, the method includes steps S1110 to S1120, and steps S220 to S240, wherein steps S1110 to S1120 are described in detail as follows:

[0190] Step S1110, obtaining abnormal events detected in multiple historical detection cycles, parsing the obtained abnormal events, and obtaining a set of abnormal objects corresponding to the abnormal events.

[0191] After obtaining abnormal events detected in multiple historical detection cycles, the obtained abnormal events can be parsed to obtain abnormal objects corresponding to the abnormal events, and an abnormal object set can be constructed based on the obtained abnormal objects.

[0192] Step S1120 , screening out abnormal objects that match the type of the target object from the multiple types of abnormal objects included in the abnormal object set.

[0193] The abnormal object set contains abnormal objects of different types. In order to improve the accuracy of abnormal detection, abnormal objects that match the type of the target object can be screened out from the abnormal object set, so as to perform abnormal detection processing on the target object based on the difference between the target object and the screened abnormal objects. In other words, in the process of performing abnormal detection processing on the target object, the reference is the abnormal object that matches the type of the target object. The type of the abnormal object matches the type of the target object, which means that the type of the abnormal object is the same as or similar to the type of the target object. For example, if the type of the target object is a trading account, the abnormal trading account is screened out.

[0194] It should be noted that Fig.11 The specific implementation details of steps S220 to S240 shown in FIG. Figure 2 Steps S220 to S240 shown are not repeated here.

[0195] exist Fig.11 In the illustrated embodiment, whether the target object is abnormal is detected based on abnormal objects that match the type of the target object, which can improve the accuracy of abnormality detection.

[0196] In an exemplary embodiment, see Fig.12 , Fig.12 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0197] like Fig.12 As shown, the method includes step S1110, step S1210-step S1240, step S1120, and step S220-step S240, wherein the detailed description of step S1210-step S1240 is as follows:

[0198] Step S1210: training multiple anomaly detection models respectively according to the attribute data corresponding to the abnormal objects included in the abnormal object set; wherein the types of the multiple anomaly detection models are not completely the same.

[0199] Anomaly detection model is a machine learning model used to detect whether an object is abnormal. Its types include but are not limited to KNN (K-NearestNeighbor, k nearest neighbor classification algorithm), logistic regression model, decision tree model, CNN (Convolutional Neural Network, Convolutional Neural Network), etc. Among them, machine learning (ML) is a multi-disciplinary cross-disciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all fields of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and inductive learning.

[0200] The attribute data of an abnormal object refers to data used to describe the attributes of the abnormal object, such as but not limited to the transaction data, communication data, operation status data, etc. of the abnormal object; data types include but are not limited to pictures, texts, time series, etc.

[0201] In order to improve the accuracy of anomaly detection, multiple anomaly detection models of different types can be created in advance, and these multiple anomaly detection models can be trained separately using the attribute data of the abnormal objects.

[0202] Optionally, in order to improve the training speed, feature data of the abnormal object may be extracted from the attribute data of the abnormal object, and the anomaly detection model may be trained based on the feature data.

[0203] In an optional implementation, if the abnormal event includes an abnormal transaction event and the abnormal object is an abnormal transaction object, the feature data of the abnormal object can be extracted from the attribute data of the abnormal object through the RFM model. Among them, the RFM model is an important tool and means to measure customer value and customer's ability to create benefits, and is used to extract the time (recency), transaction frequency (frequency), and transaction amount (monetary) of the most recent transaction.

[0204] In another optional implementation, the attribute data of the abnormal object is usually unstructured information, and therefore, the attribute data of the abnormal object can be digitized through embedding (embedding layer) to obtain feature data of the abnormal object.

[0205] Step S1220, selecting a target anomaly detection model with the best performance from the multiple trained anomaly detection models.

[0206] After training multiple anomaly detection models, the multiple anomaly detection models can be tested to screen out an anomaly detection model with the best performance, that is, a target anomaly detection model.

[0207] In an optional embodiment, the target anomaly detection model with the best performance can be screened out from multiple anomaly detection models according to the accuracy and recall rate. For example, the anomaly detection model with the highest accuracy or the highest recall rate can be selected as the target detection model, or the first score of each anomaly detection model can be calculated according to the recall rate of the anomaly detection model, and the second score of the anomaly detection model can be calculated according to the accuracy of each anomaly detection model, and the first score and the second score corresponding to each anomaly detection model can be weighted and summed to obtain the total score of the anomaly detection model, and the anomaly detection model with the highest total score can be screened out from multiple anomaly detection models as the target anomaly detection model, thereby selecting an anomaly detection model with high recall rate and accuracy rate as the target anomaly detection model, wherein the first score is positively correlated with the recall rate, that is, the higher the recall rate, the higher the first score; the second score is positively correlated with the accuracy rate, that is, the higher the accuracy rate, the higher the second score.

[0208] Step S1230, inputting the attribute data of the specified object into the target anomaly detection model to obtain the anomaly detection result of the specified object.

[0209] The specified object refers to the object that needs to be detected for abnormality. The attribute data of the specified object is numerically input to the target anomaly detection model, and the target anomaly detection model processes the attribute data of the specified object to obtain the anomaly detection result of the specified object output by the target anomaly detection model.

[0210] Among them, the anomaly detection result at the output of the target anomaly detection model is used to describe whether the object is abnormal, which can be expressed in the form of probability, text description, etc.

[0211] Step S1240: If the abnormality detection result of the designated object indicates that the designated object is abnormal, the designated object is added to the abnormal object set.

[0212] According to the abnormality detection result of the specified object, it can be determined whether the specified object has an abnormality. If the specified object has an abnormality, the specified object is added to the abnormal object set, thereby expanding the abnormal object.

[0213] Optionally, if the abnormality detection result of the specified object is the probability that the specified object has an abnormality, it can be determined that the specified object has an abnormality when the probability is higher than a set probability threshold.

[0214] In an optional implementation, before step S1210, it can also be determined whether the number of abnormal objects included in the abnormal object set is greater than a set threshold. If so, it indicates that the number of abnormal objects included in the abnormal object set is large and there is no need to expand it. Therefore, step S1210 can be skipped. If not, it indicates that the number of abnormal objects included in the abnormal object set is small and it is necessary to expand it. Therefore, step S1210 can be executed.

[0215] It should be noted that Fig.12 The specific implementation details of steps S220 to S240 shown in FIG. Figure 2 Steps S220 to S240 are shown. Fig.12 The specific implementation details of steps S1110 to S1120 shown in FIG. Fig.11 Steps S1110 to S1120 shown are not repeated here.

[0216] exist Fig.12 In the illustrated embodiment, a target anomaly detection model is used to detect whether an object is abnormal, and the detected abnormal object is added to a set of abnormal objects, thereby expanding the abnormal objects and avoiding a situation where there are fewer abnormal objects and low accuracy in abnormal detection. Furthermore, the target anomaly detection model has the best performance among multiple abnormal detection models after training, which can improve detection accuracy.

[0217] In an exemplary embodiment, see Fig.13 , Fig.13 is a flowchart of an abnormality detection method shown in another exemplary embodiment of the present application. The method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0218] like Fig.13 As shown, the method includes step S1110, step S1310-step S1320, step S1120, and step S220-step S240, wherein the detailed description of step S1310-step S1320 is as follows:

[0219] Step S1310, searching for objects associated with the abnormal objects included in the abnormal object set.

[0220] An object associated with an abnormal object has a higher probability of being abnormal, so the object can be added to the abnormal object set to expand the abnormal object.

[0221] In an optional embodiment, objects associated with the abnormal object include but are not limited to objects with the same attribute information as the abnormal object. For example, for account-type abnormal objects, an account that is the same as at least one of the ID (Identity document) and corresponding login device of the abnormal object can be searched; for merchant-type abnormal objects, a merchant that is the same as at least one of the company, legal person, administrator, contact person, customer, etc. to which the abnormal object belongs can be searched.

[0222] In another optional implementation, the object associated with the abnormal object may include an object having transactions, communications, social activities, etc. with the abnormal object.

[0223] Step S1320, adding the found object to the abnormal object set.

[0224] An object associated with the exception object is taken as the exception object and added to the exception object collection to expand the exception object.

[0225] In an optional implementation, before step S1310, it can also be determined whether the number of abnormal objects included in the abnormal object set is greater than a set threshold. If so, it indicates that the number of abnormal objects included in the abnormal object set is large and there is no need to expand it. Therefore, step S1310 can be skipped. If not, it indicates that the number of abnormal objects included in the abnormal object set is small and it is necessary to expand it. Therefore, step S1310 can be executed.

[0226] It should be noted that Fig.12 , 13In the illustrated embodiment, the abnormal object is expanded before the abnormal object matching the type of the target object is screened. In other embodiments, the abnormal object may be expanded after the abnormal object matching the type of the target object is screened. In the present application, the time for expanding the abnormal object is not limited. Fig.13 The specific implementation details of steps S220 to S240 shown in FIG. Figure 2 Steps S220 to S240 are shown. Fig.13 The specific implementation details of steps S1110 to S1120 shown in FIG. Fig.11 Steps S1110 to S1120 shown are not repeated here.

[0227] exist Fig.13 In the illustrated embodiment, objects associated with the abnormal object are added to the abnormal object set, thereby expanding the abnormal objects and avoiding the situation where there are few abnormal objects and low accuracy of abnormal detection.

[0228] In an exemplary embodiment, see Fig.14 As shown, Fig.14 This is a specific example of anomaly detection method. This method can be applied to Figure 1 The implementation environment shown, which can be Figure 1 The terminal device 110 in the implementation environment shown in the figure may also be executed by Figure 1 The server 120 in the implementation environment shown in the figure may also execute the command. Figure 1 The terminal device 110 and the server 120 in the illustrated implementation environment execute together.

[0229] like Fig.14 As shown, the anomaly detection method includes steps S1401 to S1408, which are described in detail as follows:

[0230] Step S1401, searching for abnormal events detected in multiple historical detection cycles to obtain an abnormal event sequence.

[0231] Optionally, abnormal events detected in multiple historical detection cycles can be searched in different ways to obtain abnormal event sets corresponding to multiple historical detection cycles, and the abnormal event sets can be sorted in order from the front to the back of the historical detection cycles to obtain an abnormal event sequence.

[0232] For example, abnormal transaction events that occurred within N historical detection cycles can be detected through abnormal event detection models, manual investigation, customer complaint analysis, etc., and the abnormal event sequence E = [E1, E2...E N ], where N represents the number of cycles corresponding to multiple historical detection cycles, E1, E2, E NThey represent the abnormal event sets corresponding to the 1st historical detection cycle, the 2nd historical detection cycle, and the Nth historical detection cycle, respectively. Each abnormal event set may include the time and abnormal object of the abnormal event, and the abnormal event set may be in the form of an array. For example, the abnormal event set E corresponding to the Nth historical detection cycle N =[e 1N , e 2N , e 3N ,…,e mN ] T , where m refers to the number of abnormal events detected in the Nth historical detection cycle, and e 1N , e 2N , e mN They represent the first abnormal event, the second abnormal event, and the mth abnormal event in the Nth historical detection cycle respectively.

[0233] Step S1402, parse the found abnormal events to obtain a set of abnormal objects.

[0234] By parsing the abnormal event sequence, an abnormal object set containing abnormal objects of different types can be obtained.

[0235] Step S1403: classify the abnormal objects included in the abnormal object set to obtain multiple abnormal object subsets.

[0236] The specific introduction of the types of abnormal objects can be found in the records of the above embodiments, which will not be repeated here. The abnormal object set includes multiple types of abnormal objects, which are classified according to the type to obtain multiple abnormal object subsets.

[0237] Step S1404, generating an abnormal feature parameter matrix corresponding to each abnormal object subset according to the abnormal events corresponding to each abnormal object subset; wherein the abnormal feature parameter matrix contains abnormal feature parameters of each abnormal object in the corresponding abnormal object subset in each historical detection cycle.

[0238] Optionally, for each abnormal object in each abnormal object subset, determine whether an abnormal event occurs for the abnormal object in each abnormal detection cycle. If so, determine that the abnormal feature parameter of the abnormal object in the historical detection cycle is 1; if not, determine that the abnormal feature parameter of the abnormal object in the historical detection cycle is 0, that is, the object quantity threshold is 1; after obtaining the abnormal feature parameters corresponding to the multiple abnormal objects contained in the abnormal object subset in multiple historical detection cycles, construct the abnormal feature parameter matrix corresponding to the abnormal object subset according to the obtained abnormal feature parameters. Among them, the abnormal feature parameter matrix corresponding to each abnormal object subset is an M*N dimensional matrix, where M is the number of abnormal objects contained in the abnormal object set, for example, see Fig.15 As shown in the figure, suppose a subset of abnormal objects contains M abnormal objects. According to the M abnormal objects in the historical detection period t1-t N The corresponding abnormal event sets D1-D N , generate an M*N dimensional abnormal feature parameter matrix corresponding to the abnormal object set, and the element E in the abnormal feature parameter matrix ij Represents the abnormal characteristic parameters of the i-th abnormal object in the abnormal object subset in the j-th historical detection cycle, for example, E 12 Represents the abnormal feature parameters of the first abnormal object in the abnormal object subset in the second historical detection cycle.

[0239] Step S1405 : selecting a target abnormal object subset that matches the type of the target object to be detected from the multiple abnormal object subsets.

[0240] In order to improve the accuracy of anomaly detection, a subset of abnormal objects that matches the type of the target object to be detected is selected as the target abnormal object subset. For example, assuming that multiple abnormal object subsets include subsets corresponding to abnormal IP addresses, abnormal URL addresses, and abnormal accounts, if the target object is an IP address, the subset corresponding to the abnormal IP address (i.e., the set consisting of abnormal IP addresses) is selected as the target abnormal object subset.

[0241] Step S1406, calculating an abnormal feature parameter sequence corresponding to the target object according to the correlation between the target object and the abnormal objects in the target abnormal object subset in each historical detection cycle; wherein the abnormal feature parameter sequence includes abnormal feature parameters of the target object in multiple historical detection cycles.

[0242] Among them, for each historical detection cycle, it is determined whether the target object is associated with the abnormal objects in the target abnormal object subset within the historical detection cycle. If the target object is associated with at least one abnormal object in the target abnormal object subset, the abnormal feature parameter of the target object in the historical detection cycle is 1; if the target object is not associated with all abnormal objects included in the target abnormal object subset, the abnormal feature parameter of the target object in the historical detection cycle is 0; thereby obtaining the abnormal feature parameter sequence corresponding to the target object.

[0243] Optionally, the correlation between the target object and the abnormal object may be calculated, and if the correlation is greater than a corresponding threshold, it is determined that there is a correlation between the target object and the abnormal object.

[0244] Step S1407, calculating the abnormal value corresponding to the target object according to the abnormal feature parameter matrix corresponding to the target abnormal object subset and the abnormal feature parameter sequence corresponding to the target object.

[0245] Among them, the abnormal value corresponding to the target object can be calculated by the following formula:

[0246]

[0247] Where M represents the number of abnormal objects contained in the target abnormal feature parameter matrix, and the abnormal feature parameter sequence X corresponding to the target object is [X1, X2, ..., X N ], X j represents the abnormal characteristic parameters of the target object in the jth historical detection cycle, E ij Represents the abnormal feature parameters of the i-th abnormal object in the target abnormal feature parameter matrix in the j-th historical detection cycle.

[0248] Step S1408: If the abnormal value of the target object is greater than the set abnormal threshold, it is determined that the target object is abnormal.

[0249] The abnormal value of the target object is compared with the set abnormal threshold. If the abnormal value is greater than the set abnormal threshold, it is determined that the target object is abnormal, that is, the target object is an abnormal object.

[0250] See also Fig.16 As shown in Figure 1, anomaly detection includes three stages: detecting abnormal events, calculating abnormal feature parameters, and performing anomaly detection on target objects. In the process of detecting abnormal events, the abnormal event sequence E = [E1, E2...E N]; in the process of calculating the abnormal feature parameters, the abnormal feature parameter matrix corresponding to each subset of abnormal objects and the abnormal feature parameter sequence of the target object are calculated; in the process of detecting the abnormality of the target object, if the target object is abnormal, the similarity between the abnormal feature parameter sequence and the corresponding abnormal feature parameter matrix is ​​high; if the target object is not abnormal, the similarity between the abnormal feature parameter sequence and the corresponding abnormal feature parameter matrix is ​​low; therefore, the abnormal value of the target object is calculated according to the abnormal feature parameter sequence of the target object and the corresponding abnormal feature parameter matrix, and whether the target object is abnormal is determined according to whether the abnormal value is greater than the set abnormal threshold.

[0251] It should be noted that Fig.14 The specific process of steps S1401 to S1408 shown has been described in detail in the above embodiments and will not be repeated here.

[0252] based on Fig.14 The provided anomaly detection method fully considers the impact of abnormal events, abnormal objects and time factors on anomaly detection during the anomaly detection process, thereby improving the accuracy and stability of anomaly detection.

[0253] See also Fig.17 , Fig.17 FIG. 1 is a block diagram of an abnormality detection device shown in an exemplary embodiment of the present application. Fig.17 As shown, the device comprises:

[0254] The acquisition module 1701 is configured to acquire abnormal events detected in multiple historical detection cycles, and parse the acquired abnormal events to obtain abnormal objects;

[0255] A search module 1702 is configured to search for state data of a target object to be detected in multiple historical detection cycles;

[0256] A calculation module 1703 is configured to calculate the difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period;

[0257] The detection module 1704 is configured to perform anomaly detection processing on the target object according to the differences between the target object and the abnormal object corresponding to multiple historical detection cycles.

[0258] In an exemplary embodiment, based on the aforementioned scheme, the detection module 1704 is specifically configured as follows: summing the differences between the target object and the abnormal object corresponding to multiple historical detection cycles to obtain the total difference between the target object and the abnormal object; based on the total difference, generating an abnormality value for describing the degree of abnormality of the target object; comparing the abnormality value of the target object with the set abnormality threshold, and determining the abnormality detection result of the target object based on the comparison result.

[0259] In an exemplary embodiment, based on the aforementioned scheme, the detection module 1704 is specifically configured as follows: if there are multiple abnormal objects, the total differences corresponding to the multiple abnormal objects are summed up to obtain the target difference between the target object and the multiple abnormal objects; the ratio between the target difference and the number of cycles of multiple historical detection cycles is calculated to obtain the average difference; and based on the average difference, the abnormal value of the target object is generated.

[0260] In an exemplary embodiment, based on the aforementioned scheme, the detection module 1704 is specifically configured as follows: according to the time difference between each historical detection cycle and the current time, the weight value corresponding to each historical detection cycle is calculated; wherein the time difference is negatively correlated with the weight value; according to the weight values ​​corresponding to multiple historical detection cycles, the differences between the target objects and the abnormal objects corresponding to the multiple historical detection cycles are weightedly summed to obtain the total difference.

[0261] In an exemplary embodiment, based on the aforementioned scheme, the calculation module 1703 is specifically configured as follows: from the state data of the target object in each historical detection cycle, filter out the state data associated with the abnormal object; calculate the abnormal feature parameters of the target object in each historical detection cycle based on the filtered state data, and calculate the abnormal feature parameters of the abnormal object in each historical detection cycle based on the abnormal events of the abnormal object in each historical detection cycle; calculate the difference between the abnormal feature parameters corresponding to the target object and the abnormal object in each historical detection cycle.

[0262] In an exemplary embodiment, based on the aforementioned scheme, under the condition that the number of abnormal objects is multiple, the calculation module 1703 is specifically configured as follows: according to the filtered status data, searching from multiple abnormal objects for associated abnormal objects that are associated with the target object in each historical detection cycle; calculating the number of abnormal events corresponding to each abnormal object in each historical detection cycle; and selecting, from the set multiple abnormal feature parameters, abnormal feature parameters that match the number of associated abnormal objects as the abnormal feature parameters of the target object in each historical detection cycle, and abnormal feature parameters that match the number of abnormal events as the abnormal feature parameters of each abnormal object in each historical detection cycle.

[0263] In an exemplary embodiment, based on the aforementioned scheme, under the condition that the set multiple abnormal feature parameters include a first parameter and a second parameter with different values, the calculation module 1703 is specifically configured as: if the number of associated abnormal objects is greater than or equal to the object number threshold, the first parameter is selected as the abnormal feature parameter of the target object in each historical detection cycle; if the number of associated abnormal objects is less than the object number threshold, the second parameter is selected as the abnormal feature parameter of the target object in each historical detection cycle; if the number of abnormal events is greater than or equal to the event number threshold, the first parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection cycle; if the number of abnormal events is less than the event number threshold, the second parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection cycle.

[0264] In an exemplary embodiment, based on the aforementioned scheme, under the condition that the abnormal event includes an abnormal transaction event, the calculation module 1703 is configured to: calculate the transaction amount between the target object and the abnormal object in each historical detection cycle based on the transaction data contained in the filtered status data; calculate the abnormal transaction amount of the abnormal object in each historical detection cycle based on the abnormal transaction events of the abnormal object in each historical detection cycle; calculate the abnormal feature parameters of the target object in each historical detection cycle based on the transaction amount, and calculate the abnormal feature parameters of the abnormal object in each historical detection cycle based on the abnormal transaction amount.

[0265] In an exemplary embodiment, based on the aforementioned scheme, the calculation module 1703 is specifically configured as follows: according to the filtered status data, search for abnormal events associated with the target object from the abnormal events detected in each historical detection cycle; according to the number of abnormal events found, calculate the abnormal feature parameters of the target object in each historical detection cycle; according to the number of abnormal events of the abnormal object in each historical detection cycle, calculate the abnormal feature parameters of the abnormal object in each historical detection cycle.

[0266] In an exemplary embodiment, based on the above-mentioned scheme, the acquisition module 1701 is specifically configured as follows: parsing the acquired abnormal event to obtain a set of abnormal objects corresponding to the abnormal event; and filtering out abnormal objects that match the type of the target object from the multiple types of abnormal objects contained in the abnormal object set.

[0267] In an exemplary embodiment, based on the aforementioned scheme, the acquisition module 1701 is further configured to: train multiple anomaly detection models respectively according to the attribute data corresponding to the abnormal objects contained in the abnormal object set; wherein the types of the multiple anomaly detection models are not exactly the same; screen out the target anomaly detection model with the best performance from the multiple anomaly detection models after training; input the attribute data of the specified object into the target anomaly detection model to obtain the anomaly detection result of the specified object; if the anomaly detection result of the specified object indicates that the specified object is abnormal, add the specified object to the abnormal object set.

[0268] In an exemplary embodiment, based on the above solution, the acquisition module 1701 is further configured to: search for objects associated with the abnormal objects included in the abnormal object set; and add the found objects to the abnormal object set.

[0269] It should be noted that the anomaly detection device provided in the above embodiment and the anomaly detection method provided in the above embodiment belong to the same concept, wherein the specific manner in which each module and unit performs operations has been described in detail in the method embodiment and will not be repeated here.

[0270] An embodiment of the present application also provides an electronic device, comprising: one or more processors; a storage device for storing one or more computer programs, when the one or more computer programs are executed by one or more processors, the electronic device implements the anomaly detection method provided in the above-mentioned embodiments.

[0271] Fig.18 A schematic diagram of the structure of a computer system suitable for implementing an electronic device of an embodiment of the present application is shown.

[0272] It should be noted that Fig.18 The computer system 1800 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0273] like Fig.18As shown, the computer system 1800 includes a central processing unit (CPU) 1801, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 1802 or a computer program loaded from a storage part 1808 to a random access memory (RAM) 1803, such as executing the abnormality detection method in the above embodiment. In RAM 1803, various computer programs and data required for system operation are also stored. CPU 1801, ROM 1802 and RAM 1803 are connected to each other via a bus 1804. An input / output (I / O) interface 1803 is also connected to the bus 1804.

[0274] In some embodiments, the following components are connected to the I / O interface 1803: an input section 1806 including a keyboard, a mouse, etc.; an output section 1807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 1808 including a hard disk, etc.; and a communication section 1809 including a network interface card such as a LAN (Local Area Network) card, a modem, etc. The communication section 1809 performs communication processing via a network such as the Internet. A drive 1810 is also connected to the I / O interface 1803 as needed. A removable medium 1811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 1810 as needed, so that a computer program read therefrom is installed into the storage section 1808 as needed.

[0275] In particular, according to an embodiment of the present application, a computer program for implementing the anomaly detection method may be carried on a computer-readable medium, and the computer program may be downloaded and installed from a network through the communication part 1809 , and / or installed from a removable medium 1811 .

[0276] It should be noted that the computer-readable medium shown in the embodiment of the present application may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM), a flash memory, an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium may be any tangible medium containing or storing a computer program, which may be used by an instruction execution system, device or device or used in combination with it. The computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, wherein a computer-readable computer program is carried, and the propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer program contained in the computer-readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, etc., or any suitable combination of the foregoing.

[0277] The flowchart and block diagram in the accompanying drawings illustrate the possible architecture, functions and operations of the system, method and computer program product according to various embodiments of the present application. Wherein, each box in the flowchart or block diagram can represent a module, a program segment, or a part of the code, and the above-mentioned module, program segment, or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and a computer program.

[0278] The units involved in the embodiments described in this application may be implemented by software or hardware, and the units described may also be set in a processor. The names of these units do not, in some cases, constitute limitations on the units themselves.

[0279] Another aspect of the present application further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor of an electronic device, enables the electronic device to implement the above-mentioned abnormality detection method. The computer-readable storage medium may be included in the electronic device described in the above embodiment, or may exist independently without being assembled into the electronic device.

[0280] Another aspect of the present application further provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the anomaly detection method provided in each of the above embodiments is implemented. The computer program can be stored in a computer-readable storage medium.

[0281] The above content is only a preferred exemplary embodiment of the present application and is not intended to limit the implementation scheme of the present application. A person skilled in the art can easily make corresponding changes or modifications based on the main concept and spirit of the present application. Therefore, the scope of protection of the present application shall be based on the scope of protection required by the claims.

Claims

1. An anomaly detection method, characterized in that: The method comprises: Acquire abnormal events detected in multiple historical detection cycles, and parse the acquired abnormal events to obtain abnormal objects; Searching for status data of the target object to be detected in the plurality of historical detection cycles; Calculate the difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period; According to the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection periods, abnormality detection processing is performed on the target object.

2. The method according to claim 1, characterized in that The performing anomaly detection processing on the target object according to the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection cycles includes: Performing a sum operation on the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection periods to obtain a total difference between the target object and the abnormal object; generating an abnormality value for describing the abnormality degree of the target object according to the total difference; The abnormal value of the target object is compared with the set abnormal threshold, and the abnormal detection result of the target object is determined according to the comparison result.

3. The method according to claim 2, characterized in that Generating an abnormality value for describing the abnormality degree of the target object according to the total difference includes: If there are multiple abnormal objects, summing up the total differences corresponding to the multiple abnormal objects to obtain the target difference between the target object and the multiple abnormal objects; Calculating a ratio between the target difference and the number of cycles of the plurality of historical detection cycles to obtain an average difference; An anomaly value of the target object is generated according to the average difference.

4. The method according to claim 2, characterized in that The summing up the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection periods to obtain the total difference between the target object and the abnormal object includes: Calculate the weight value corresponding to each historical detection period according to the time difference between each historical detection period and the current time; wherein the time difference is negatively correlated with the weight value; According to the weight values ​​respectively corresponding to the multiple historical detection periods, the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection periods are weighted summed to obtain the total difference.

5. The method according to claim 1, characterized in that The calculating, based on the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period, the difference between the target object and the abnormal object corresponding to each historical detection period includes: Filtering out the state data associated with the abnormal object from the state data of the target object in each historical detection cycle; Calculate the abnormal feature parameters of the target object in each historical detection period according to the filtered status data, and calculate the abnormal feature parameters of the abnormal object in each historical detection period according to the abnormal events of the abnormal object in each historical detection period; The difference between the abnormal feature parameters respectively corresponding to the target object and the abnormal object in each historical detection cycle is calculated.

6. The method according to claim 5, characterized in that The number of the abnormal objects is multiple; The step of calculating the abnormal feature parameters of the target object in each historical detection period according to the filtered status data, and calculating the abnormal feature parameters of the abnormal object in each historical detection period according to the abnormal events of the abnormal object in each historical detection period, includes: According to the filtered state data, searching, from a plurality of abnormal objects, for an associated abnormal object that is associated with the target object in each of the historical detection cycles; Calculate the number of abnormal events corresponding to each abnormal object in each historical detection cycle; From the set multiple abnormal feature parameters, the abnormal feature parameters that match the number of associated abnormal objects are selected as the abnormal feature parameters of the target object in each historical detection cycle, and the abnormal feature parameters that match the number of abnormal events are selected as the abnormal feature parameters of each abnormal object in each historical detection cycle.

7. The method according to claim 6, characterized in that The set multiple abnormal characteristic parameters include a first parameter and a second parameter with different values; The selecting, from the set multiple abnormal feature parameters, the abnormal feature parameters matching the number of the associated abnormal objects as the abnormal feature parameters of the target object in each historical detection period, and the abnormal feature parameters matching the number of abnormal events as the abnormal feature parameters of each abnormal object in each historical detection period, includes: If the number of the associated abnormal objects is greater than or equal to the object number threshold, selecting the first parameter as the abnormal feature parameter of the target object in each historical detection cycle; If the number of the associated abnormal objects is less than the object number threshold, selecting the second parameter as the abnormal feature parameter of the target object in each historical detection cycle; If the number of abnormal events is greater than or equal to the event number threshold, selecting the first parameter as the abnormal feature parameter of each abnormal object in each historical detection period; If the number of abnormal events is less than the event number threshold, the second parameter is selected as the abnormal feature parameter of each abnormal object in each historical detection period.

8. The method according to claim 5, characterized in that The abnormal events include abnormal transaction events; The step of calculating the abnormal feature parameters of the target object in each historical detection period according to the filtered status data, and calculating the abnormal feature parameters of the abnormal object in each historical detection period according to the abnormal events of the abnormal object in each historical detection period, includes: Calculate the transaction amount between the target object and the abnormal object in each historical detection period according to the transaction data included in the filtered status data; Calculate the abnormal transaction amount of the abnormal object in each historical detection period according to the abnormal transaction events of the abnormal object in each historical detection period; According to the transaction amount, the abnormal feature parameters of the target object in each historical detection period are calculated, and according to the abnormal transaction amount, the abnormal feature parameters of the abnormal object in each historical detection period are calculated.

9. The method according to claim 5, characterized in that The step of calculating the abnormal feature parameters of the target object in each historical detection period according to the filtered status data, and calculating the abnormal feature parameters of the abnormal object in each historical detection period according to the abnormal events of the abnormal object in each historical detection period, includes: According to the filtered status data, searching for abnormal events associated with the target object from abnormal events detected in each historical detection cycle; Calculate the abnormal characteristic parameters of the target object in each historical detection period according to the number of abnormal events found; According to the number of abnormal events of the abnormal object in each historical detection period, the abnormal feature parameters of the abnormal object in each historical detection period are calculated.

10. The method according to claim 1, characterized in that The acquired abnormal event is parsed to obtain an abnormal object, including: Parse the acquired abnormal events to obtain a set of abnormal objects corresponding to the abnormal events; From the multiple types of abnormal objects included in the abnormal object set, an abnormal object matching the type of the target object is screened out.

11. The method according to claim 10, characterized in that The method further comprises: According to the attribute data corresponding to the abnormal objects contained in the abnormal object set, multiple abnormality detection models are trained respectively; wherein the types of the multiple abnormality detection models are not completely the same; Select the target anomaly detection model with the best performance from multiple trained anomaly detection models; Inputting the attribute data of the specified object into the target anomaly detection model to obtain an anomaly detection result of the specified object; If the abnormality detection result of the designated object indicates that the designated object is abnormal, the designated object is added to the abnormal object set.

12. The method according to claim 10, characterized in that The method further comprises: Finding an object associated with an abnormal object included in the abnormal object set; The found object is added to the abnormal object set.

13. An abnormality detection device, characterized in that: The device comprises: An acquisition module is configured to acquire abnormal events detected in multiple historical detection cycles, and parse the acquired abnormal events to obtain abnormal objects; A search module configured to search for state data of a target object to be detected within the plurality of historical detection cycles; a calculation module configured to calculate the difference between the target object and the abnormal object corresponding to each historical detection period according to the state data of the target object in each historical detection period and the abnormal events of the abnormal object in each historical detection period; The detection module is configured to perform anomaly detection processing on the target object according to the differences between the target object and the abnormal object respectively corresponding to the multiple historical detection cycles.

14. An electronic device, characterized in that: include: one or more processors; A storage device for storing one or more computer programs, which, when executed by the one or more processors, enables the electronic device to implement the anomaly detection method described in any one of claims 1 to 12.

15. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed by a processor of an electronic device, the electronic device implements the abnormality detection method described in any one of claims 1-12.

16. A computer program product, characterized in that The invention comprises a computer program, which implements the anomaly detection method according to any one of claims 1 to 12 when being executed by a processor.

Images