Weak supervision anomaly detection method and equipment based on reconstruction and multi-prototype learning

Abstract

The invention discloses a weak supervision anomaly detection method and equipment based on reconstruction and multi-prototype learning, and belongs to the technical field of anomaly detection. The method comprises the following steps: inputting a data instance into an anomaly detection model to obtain an anomaly detection result of the data instance xi; wherein the anomaly detection model comprises a reconstruction learning module used for calculating a potential representation and a reconstruction error of a data instance; the multi-normal prototype learning module is used for generating a plurality of normal prototypes and selecting the maximum similarity after calculating the similarity between the potential representation and all the normal prototypes; and the unified anomaly scoring module is used for connecting the potential representation, the reconstruction error and the maximum similarity into a feature vector, and obtaining an anomaly detection result of the data instance based on the feature vector. According to the invention, a small amount of marked abnormal samples and a large amount of unmarked data can be combined for anomaly detection, and the anomaly detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of anomaly detection, and in particular to a weakly supervised anomaly detection method and device based on reconstruction and multi-prototype learning. Technical Background

[0002] Anomaly detection is a critical task in the field of artificial intelligence and data mining, and is widely used in many fields such as network security, financial fraud detection, and medical diagnosis. The goal of anomaly detection is to identify samples that are significantly different from the majority of data, which usually indicate potential problems or events that need attention. In real-world application scenarios, it is often challenging and costly to obtain labeled data for anomaly detection. Therefore, relying entirely on supervised learning for anomaly detection is often not feasible in practice. Although unsupervised learning methods can bypass the need for a large amount of labeled data, they usually fail to achieve optimal performance due to the inability to know the characteristics of true anomalies. This limitation often causes the model to mistake noisy data or irrelevant data points as anomalies. To address these problems, weakly supervised anomaly detection methods have emerged. These methods combine a small amount of labeled anomaly data with a large amount of unlabeled data, and are particularly suitable for practical applications where only a small number of anomalies can be labeled.

[0003] However, existing anomaly detection methods still face two major challenges. First, most existing methods assume that normal data cluster around a single central prototype, but real data often consists of multiple categories or subgroups. The assumption of a single prototype is too simplistic and difficult to accurately describe the complex distribution of normal data. Second, existing methods usually assume that all unlabeled data are normal, but in fact these data inevitably contain some abnormal samples. Due to this assumption, many studies directly use a large amount of unlabeled data as inliers for model training to identify the distribution of normal data patterns, which makes these methods vulnerable to occasional abnormal samples (i.e., abnormal contamination) in unlabeled data. As the proportion of mixed anomalies increases, the detection accuracy drops rapidly. Summary of the invention

[0004] In view of the problems that existing anomaly detection methods are susceptible to anomaly contamination when dealing with weak supervision, and are difficult to effectively capture the multimodal distribution of normal data, the present invention proposes a weakly supervised anomaly detection method and device based on reconstruction and multi-prototype learning, which can combine a small amount of labeled abnormal samples and a large amount of unlabeled data to perform anomaly detection and improve the accuracy of anomaly detection.

[0005] To achieve the above objectives, the technical solution of the present invention includes the following contents.

[0006] A weakly supervised anomaly detection method based on reconstruction and multi-prototype learning, which inputs the data instance into the anomaly detection model to obtain the data instance x i The anomaly detection result; wherein the anomaly detection model includes:

[0007] The reconstruction learning module is used to calculate the latent representation and reconstruction error of the data instance;

[0008] A multiple normal prototype learning module, used for generating multiple normal prototypes, and after calculating the similarity between the latent representation and all normal prototypes, selecting the maximum similarity;

[0009] The unified anomaly scoring module is used to connect the potential representation, the reconstruction error and the maximum similarity into a feature vector, and obtain an anomaly detection result of the data instance based on the feature vector.

[0010] Furthermore, the process of training the anomaly detection model includes:

[0011] Construct a training data set, the sample x of the training data set i Includes: a large number of unlabeled samples and a small number of labeled abnormal samples;

[0012] Constructing the total reconstruction loss function of the reconstruction learning module in, represents the reconstruction loss function of the unlabeled sample, represents a reconstruction loss function of the labeled abnormal samples calculated in combination with a hinge loss function;

[0013] Constructing the total normal prototype loss function of the multi-normal prototype learning module in, Represents the KL divergence loss function for optimizing unlabeled samples involved in the deep embedding clustering algorithm. represents a contrast loss function that ensures that normal samples have high similarity with at least one normal prototype, while abnormal samples have low similarity with all normal prototypes;

[0014] Constructing the anomaly scoring loss function of the anomaly scoring module Among them, the anomaly score loss function Used to ensure that the anomaly score of abnormal samples is close to anomaly score A, and the anomaly score of normal samples is close to normal score B;

[0015] Based on the total reconstruction loss function Total Normal Prototype Loss Function And the anomaly score loss function The anomaly detection model is trained end-to-end on the training dataset.

[0016] Further, the generating of multiple normal prototypes includes:

[0017] Cluster the latent representations of unlabeled samples to initialize k normal prototypes u j ;

[0018] Total normal prototype loss function using multiple normal prototype learning module Refinement of the normal prototype.

[0019] Furthermore, the reconstruction loss function of the unlabeled sample is The reconstruction loss function of the labeled abnormal samples in, represents the unlabeled sample set, w i Represents sample x i The weight of , l represents the regression loss function, Represents sample x i The reconstruction value of represents the set of labeled abnormal samples, and m1 represents the loss interval.

[0020] Furthermore, the unlabeled samples optimize the KL divergence loss function Among them, the median value Median Intermediate value f j =∑ i q ij ,s ij Represents sample x i With the normal prototype u j The similarity between .

[0021] Furthermore, it is characterized in that the contrast loss function Among them, σ is the Sigmoid activation function, represents the unlabeled sample set, w i Represents sample x i The weight of represents the set of labeled abnormal samples, s ij Represents sample x i With the normal prototype u j The similarity between .

[0022] Furthermore, the anomaly score loss function in, represents the unlabeled sample set, w i Represents sample x i The weight of , l represents the regression loss function, Represents a set of labeled abnormal samples, score iRepresents sample x i The abnormal score.

[0023] Furthermore, the weight Among them, σ is the Sigmoid activation function, β is the scaling parameter for adjusting the sensitivity of the similarity score, and s ij Represents sample x i With the normal prototype u j The similarity between .

[0024] Furthermore, the similarity in, represents the parameters of the multi-normal prototype learning module, k is the number of normal prototypes, and α represents the degrees of freedom of the Student's t distribution.

[0025] An electronic device, characterized in that the electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the weakly supervised anomaly detection method based on reconstruction and multi-prototype learning as described in any one of the above items is implemented.

[0026] Compared with the prior art, the present invention has at least the following beneficial effects.

[0027] 1) If Figure 1 As shown in (a) of FIG. 1 , most prior arts assume that normal data are clustered around a single central prototype, while the present invention starts from real data, such as Figure 1 As shown in (b) in the figure, a technical solution of multi-normal prototype is constructed to achieve a more accurate description of complex normal data distribution.

[0028] 2) The present invention consistently outperforms other anomaly methods in terms of AUC-PR and AUC-ROC indicators, and achieves statistically significant improvements at a confidence level of more than 99.9%.

[0029] 3) When the proportion of labeled abnormal samples is low, the performance of the present invention decreases slowly and maintains relatively high detection performance in more data sets.

[0030] 4) The present invention can effectively generalize from known anomalies, detect unseen anomalies, and maintain strong detection performance and robustness in dynamic environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a schematic diagram of the core innovation of the present invention.

[0032] Figure 2 It is a model structure diagram of the method proposed in the present invention.

[0033] Figure 3The anomaly detection performance of the present invention is affected by the proportion of labeled abnormal samples. DETAILED DESCRIPTION

[0034] The present invention is further described in detail below in conjunction with the accompanying drawings and examples. The following examples are used to illustrate the present invention but are not used to limit the scope of the present invention.

[0035] The present invention provides a weakly supervised anomaly detection method based on multi-normal prototype learning. The method effectively performs anomaly detection by combining limited labeled anomaly data with a large amount of unlabeled data. Figure 2 As shown, the present invention includes: a reconstruction learning module, a multiple normal prototype learning module and a unified anomaly scoring module. Among them, the reconstruction learning module is used to convert the input data into a latent space representation, and distinguish normal samples from abnormal samples by analyzing the reconstruction error; the multiple normal prototype learning module aims to better model the distribution of normal data, and use deep embedding clustering and contrastive learning to construct multiple normal prototypes for anomaly detection; the unified anomaly scoring module comprehensively uses the reconstruction error information of the sample and the similarity information of multiple normal prototypes to calculate the final anomaly score of each sample.

[0036] Before discussing each module in detail, we first formally define the problem to be solved: In the context of weakly supervised anomaly detection, given a dataset The dataset consists of two disjoint subsets: and in, Indicates a large number of unlabeled samples. Represents a small number of annotated abnormal samples. The goal of this invention is to learn a scoring function This function assigns an anomaly score to each data instance, where a larger score indicates that the data instance is more likely to be an anomaly.

[0037] 1. Reconstruct the learning module.

[0038] The reconstruction learning module is mainly used to achieve the following two functions: first, convert the input data into potential representations to capture the key features of the sample; second, distinguish normal samples from abnormal samples by analyzing the reconstruction error.

[0039] First, the reconstruction learning module uses an encoder-decoder structure (Encoder-Decoder) for reconstruction learning. The encoder function ψ converts the input x i ∈R D Mapping to the latent representation z i ∈R H :

[0040] z i =ψ(x i ; Θψ )

[0041] The decoder function ψ′ transforms the latent representation z i Remapping to reconstruction of the original input

[0042]

[0043] Among them, Θ ψ and θ ψ′ denote the parameters of the encoder and decoder neural networks respectively.

[0044] In order to achieve weakly supervised anomaly detection, a reconstruction loss function is specially designed. First, by minimizing the reconstruction error, we ensure that the latent representation can capture the most relevant features of normal data. For unlabeled samples, the reconstruction loss is defined as:

[0045]

[0046] Where l is the regression loss function, such as mean square error (MSE), and w i Indicates the probability that an unlabeled sample is a normal sample. By adjusting the weight w i , reducing the impact of abnormal contamination on the training process.

[0047] Secondly, in order to effectively distinguish normal samples from abnormal samples, the present invention adopts the hinge loss function to ensure that the reconstruction loss of normal samples is lower than that of abnormal samples and maintain a sufficient loss interval m1. Therefore, for the annotated abnormal samples, the reconstruction loss is defined as:

[0048]

[0049] Finally, the reconstruction loss of unlabeled data and labeled abnormal samples is combined to obtain the total reconstruction loss function:

[0050]

[0051] In a preferred embodiment, the weight w of the unlabeled samples is i It is crucial to adjust the influence of each sample during the training process. These weights represent the probability that an unlabeled sample is a normal sample, which helps to mitigate the contamination effect of abnormal samples in unlabeled data. i The weight w i Defined based on its maximum similarity to any normal prototype:

[0052]

[0053] Among them, σ is the Sigmoid activation function, and β is a scaling parameter that adjusts the sensitivity of the similarity score. Samples with higher similarity are given larger weights, increasing their influence in the loss function of unlabeled data, so that the model focuses more on maintaining the characteristics of normal samples. On the contrary, samples with lower similarity may be abnormal samples, and their weights are smaller, reducing their influence on the model learning process.

[0054] 2. Multi-normal prototype learning module.

[0055] The present invention assumes that normal sample data may be composed of multiple categories or subgroups and conform to multimodal distribution. To this end, the multi-normal prototype learning module of the present invention learns multiple normal prototypes through deep embedding clustering and contrastive learning, so as to better represent normal data and distinguish abnormal data.

[0056] At the beginning of training, the present invention first clusters the potential representations of the unlabeled data extracted by the pre-trained encoder to initialize k normal prototypes During the model training and inference phases, it is necessary to calculate the sample x i With each prototype u j The similarity between them is used to determine which category or subgroup the sample belongs to. Specifically, assuming that the samples of each category or subgroup satisfy the Student's t distribution, the similarity is calculated as follows:

[0057]

[0058] Among them, z i Represents sample x i The potential representation of , α is the degree of freedom of Student's t distribution, are the parameters of the multi-normal prototype. To ensure consistency and stability during training, the prototype u j and the potential representation z i All are normalized before calculating the similarity.

[0059] In a preferred embodiment, in order to improve the accuracy of anomaly detection, the present invention proposes to construct multiple normal prototypes to capture the diversity of normal data. However, the initial prototypes may not fully represent the underlying structure of normal data, so these prototypes need to be further refined through a two-step optimization process.

[0060] First, given that the relationship between normal samples and multiple normal prototypes conforms to the unsupervised clustering problem, the present invention adopts the Deep Embedding Clustering algorithm, which uses a deep neural network to simultaneously learn feature representation and cluster assignment. This process involves optimizing the KL divergence loss for unlabeled samples:

[0061]

[0062] in, f j =∑iq ij , This loss function Prototypes are encouraged to be closely aligned with the central tendency of clusters formed by normal data, ensuring that the learned prototypes accurately reflect the true structure of the normal data distribution.

[0063] Secondly, in order to consolidate the distinction between normal data and abnormal data, the present invention introduces a contrastive learning method. The goal is to ensure that normal samples have a high similarity with at least one refined normal prototype, while abnormal samples have a low similarity with all prototypes. This separation is achieved through the following contrastive loss function:

[0064]

[0065] Through this contrastive learning process, normal samples are guided to cluster around the central prototype in the latent space, while abnormal samples are pushed to the edge far away from any normal prototype. This method ensures a clear and robust separation between normal and abnormal data, greatly improving the effectiveness of the anomaly detection framework.

[0066] Finally, by combining the clustering loss and the contrast loss, the total loss function of this module is obtained:

[0067]

[0068] 3. Unified anomaly scoring module.

[0069] The unified anomaly scoring module of the present invention detects abnormal samples more accurately by combining reconstruction error and multiple normal prototype information. The potential representation of the sample z i , and the maximum similarity s between the sample and the normal prototype i , building a comprehensive anomaly scoring mechanism.

[0070] Specifically, inspired by the residual network, the present invention designs a method to transform the potential representation z i and the reconstruction error e i and similarity s i The input vector is concatenated to form a unified anomaly score evaluator. The input is used to calculate the abnormal score of the sample. The calculation formula is as follows:

[0071]

[0072] in, Indicates the maximum similarity between a sample and any normal prototype, To unify the trainable parameters of the anomaly score evaluator, cat represents the concatenation operation. The evaluator consists of a multi-layer perceptron, and its last layer uses the Sigmoid activation function to output the anomaly score.

[0073] In order to ensure that the score of abnormal samples is close to 1 and the score of normal samples is close to 0, the present invention designs the following loss function:

[0074]

[0075] Among them, the unlabeled sample x i The weight w i It is used to reduce the impact of abnormal samples mixed in unlabeled data on the training process, ensure that the model focuses on normal samples, and reduce the noise caused by abnormal samples during training.

[0076] By unifying the anomaly scoring module, the model can combine reconstruction error, multi-normal prototype information and latent representation to provide more accurate and robust anomaly scoring results. This design not only ensures that abnormal samples are effectively detected, but also improves the detection ability of the model in weakly supervised scenarios.

[0077] The specific implementation of the training and reasoning process of this method will be described in detail below.

[0078] 1. Training phase.

[0079] Before formally training the model, the present invention first normalizes the features of the input data. The present invention uses the Min-Max normalization method to scale each feature to the interval [0,1]. Then the autoencoder is pre-trained. In order to improve the generalization ability of the model, the unlabeled data is first The denoising autoencoder is pre-trained layer by layer. Specifically, each layer of the autoencoder is trained to reconstruct a noise-degraded version of its input data, with the goal of enabling the encoder to learn a more robust feature representation. After pre-training, the encoder and decoder layers are connected to form a complete deep autoencoder. The entire autoencoder is fine-tuned by minimizing the reconstruction error to further refine the latent representation. This process ensures that the latent representation captures the main features of the data, making the model more effective in subsequent anomaly detection tasks. After fine-tuning, the present invention uses the trained encoder to extract unlabeled data The latent representations of the data are clustered using the k-means clustering algorithm to obtain k cluster centers. These cluster centers are used as the initial values ​​of the multi-normal prototypes in the model to ensure that these prototypes can represent the distribution of normal data. Through this initialization process, the model can better capture the multimodal distribution of normal data.

[0080] The present invention adopts an end-to-end approach to model training, using small batches of data during training, including b u = 128 unlabeled samples and b a = 32 anomaly samples with annotations. In each small batch, three loss functions are calculated: reconstruction loss Multi-Normal Prototype Loss and anomaly score loss The specific formulas are described in detail in the content of the invention. In order to dynamically balance these three loss functions, the present invention adopts dynamic weighting technology. The total loss function The calculation formula is:

[0081]

[0082] Among them, the weights w1, w2 and w3 are dynamically updated in each training cycle according to the decreasing rate of each loss.

[0083] All parameters of the model, including the parameters of the encoder and decoder Θ {ψ,ψ′} , parameters of multi-normal prototypes and the parameters of the anomaly score evaluator By optimizing the total loss function This training method ensures the comprehensive optimization effect of the model. In addition, during the training process, the present invention uses the Adam optimizer and the learning rate is set to 5×10 -3 , the weight decay coefficient is 5×10 -4 The dimension H of the latent representation is set to 8, and the hyperparameters are configured as follows: interval parameter m1 = 0.02, Student's t distribution degrees of freedom α = 1, and similarity scaling parameter β = 1.

[0084] 2. Reasoning stage.

[0085] In the inference phase, the input data instance x i First, by reconstructing the learning module, we get its potential representation z i and the reconstruction error e i Next, the multi-normal prototype learning module calculates the similarity between the latent representation and all normal prototypes and selects the maximum similarity score s i Finally, the reconstruction error e i , potential representation z i and the maximum similarity si are concatenated into a feature vector and fed into the unified anomaly score evaluator In , the anomaly score of each data instance is calculated. The higher the anomaly score, the greater the possibility that the data instance is an abnormal sample.

[0086] Through the above training and reasoning process, the weakly supervised anomaly detection method of the present invention can accurately and effectively detect abnormal samples under the conditions of limited labeled data and a large amount of unlabeled data.

[0087] Below, a specific experiment is used to illustrate the weakly supervised anomaly detection method based on reconstruction and multi-prototype learning provided by the present invention.

[0088] The experimental part of the present invention covers a variety of data sets, as shown in Table 1, representing actual application scenarios in different fields, such as network security, Internet of Things (IoT) security, financial fraud detection, etc. These data sets cover a wide range of anomaly detection applications, and their abnormal sample ratios, feature dimensions, and data sizes are diverse, providing a reliable benchmark to evaluate various anomaly detection methods. Through the experimental settings of these data sets, the performance of the present invention in different application scenarios can be fully verified.

[0089] In order to comprehensively evaluate the performance of the present invention, the present invention selects several existing state-of-the-art anomaly detection algorithms for comparison. These baseline methods can be divided into two categories: weakly supervised algorithms and unsupervised algorithms. Weakly supervised algorithms use limited labeled anomaly data combined with a large amount of unlabeled data, including RoSAS, PReNet, DevNet, DeepSAD, and FeaWAD. These methods are similar to the method of the present invention in terms of supervision level. Unsupervised algorithms do not rely on labeled data at all during training, including DeepIForest, DeepSVDD, and iForest. Through these baseline methods, it can be evaluated whether weakly supervised methods can achieve significant performance improvements even with fewer labeled samples.

[0090]

[0091] Table 1

[0092] First, the overall anomaly detection performance of the present invention was experimented. In the experiment, the anomaly detection method proposed by the present invention was evaluated on multiple data sets, and the proportion of labeled abnormal samples in each data set was fixed to 1.0%. The proportion of labeled abnormal samples is defined as the proportion of labeled abnormal samples in the training data set. This means that in the actual anomaly detection scenario, only 1.0% of the abnormal samples in the training data need to be labeled to ensure that the weakly supervised anomaly detection setting does not affect the proportion of abnormal samples in the training set. The present invention regards unlabeled abnormal samples in unlabeled data as abnormal contamination. Table 2 shows the performance of different methods on 15 benchmark data sets. The method of the present invention consistently outperforms other methods in AUC-PR and AUC-ROC indicators, and has achieved statistically significant improvements at a confidence level of more than 99.9%. Specifically, in terms of AUC-PR, the present invention achieved the best results in 13 of the 15 data sets, and also achieved suboptimal results in the remaining two data sets, and was close to the best. The average AUC-PR of the present invention is 0.642, which is significantly higher than other methods. Similarly, in the AUC-ROC indicator, the average score of the present invention is 0.886, which also surpasses all other methods. Statistical verification further confirms that the improvements brought by the present invention significantly improve the performance of anomaly detection in a weakly supervised setting. In addition, compared with unsupervised algorithms, weakly supervised algorithms (such as the present invention, RoSAS and DevNet) show obvious advantages on almost all data sets. This shows that even with only a small number of labeled abnormal samples, the performance of anomaly detection can be significantly improved.

[0093]

[0094] Table 2

[0095] Secondly, an experiment was conducted to investigate the effect of the ratio of labeled abnormal samples on the anomaly detection performance of the present invention. This experiment aims to examine the effect of the ratio of labeled abnormal samples on the anomaly detection effect of the model, so as to help the present invention understand the trade-off between the supervision level and the detection performance. Figure 3 It can be seen that when the proportion of labeled abnormal samples is low, the performance of the method of the present invention decreases slowly and maintains relatively high detection performance in more data sets, while other methods show a significant downward trend in most data sets. From the perspective of abnormal contamination, as the proportion of labeled abnormalities decreases, the proportion of abnormal contamination in unlabeled data increases. Figure 3 It shows that when the abnormal pollution ratio increases, the detection performance of the method of the present invention decreases more slowly and still maintains good detection performance. This shows that the present invention has strong robustness in combating abnormal pollution.

[0096] Finally, the ability of the present invention to detect unknown anomalies was experimented. One of the important features of an effective anomaly detection system is its ability to detect unknown anomalies from known anomalies. This is crucial to maintain robustness in dynamic environments, as new types of anomalies may appear. In order to evaluate the performance of the present invention in detecting unseen anomalies, the present invention constructed multiple sets of experimental datasets using the UNSW-NB15 dataset, which contains four anomaly types: DoS, Rec, Ana, and Bac. In each experiment, the present invention selects two anomaly types, one used only in the test set (unseen anomalies) and the other used in the training and validation sets (seen anomalies). The experimental results are summarized in Table 3, showing the AUC-PR scores of different methods on various combinations of seen and unseen anomaly types. Overall, the present invention significantly outperforms other methods with an average AUC-PR of 0.765, a performance improvement of more than 20%, and a confidence level of more than 99.0%. These experiments show that the present invention can effectively generalize from known anomalies, detect unseen anomalies, and maintain strong detection performance and robustness in dynamic environments.

[0097]

[0098] Table 3

[0099] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the present disclosure. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The specification and examples are intended to be exemplary only, and the present disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes may be made without departing from the scope thereof.

Claims

1. A weakly supervised anomaly detection method based on reconstruction and multi-prototype learning, characterized in that: Input the data instance into the anomaly detection model to obtain the data instance x i The anomaly detection result; wherein the anomaly detection model includes: The reconstruction learning module is used to calculate the latent representation and reconstruction error of the data instance; A multiple normal prototype learning module, used for generating multiple normal prototypes, and after calculating the similarity between the latent representation and all normal prototypes, selecting the maximum similarity; The unified anomaly scoring module is used to connect the potential representation, the reconstruction error and the maximum similarity into a feature vector, and obtain an anomaly detection result of the data instance based on the feature vector.

2. The method according to claim 1, characterized in that The process of training the anomaly detection model includes: Construct a training data set, the sample x of the training data set i Includes: a large number of unlabeled samples and a small number of labeled abnormal samples; Constructing the total reconstruction loss function of the reconstruction learning module in, represents the reconstruction loss function of the unlabeled sample, represents a reconstruction loss function of the labeled abnormal samples calculated in combination with a hinge loss function; Constructing the total normal prototype loss function of the multi-normal prototype learning module in, Represents the KL divergence loss function for optimizing unlabeled samples involved in the deep embedding clustering algorithm. represents a contrast loss function that ensures that normal samples have high similarity with at least one normal prototype, while abnormal samples have low similarity with all normal prototypes; Constructing the anomaly scoring loss function of the anomaly scoring module Among them, the anomaly score loss function Used to ensure that the anomaly score of abnormal samples is close to anomaly score A, and the anomaly score of normal samples is close to normal score B; Based on the total reconstruction loss function Total Normal Prototype Loss Function And the anomaly score loss function The anomaly detection model is trained end-to-end on the training dataset.

3. The method according to claim 2, characterized in that The generating of multiple normal prototypes includes: Cluster the latent representations of unlabeled samples to initialize k normal prototypes u j ; Total normal prototype loss function using multiple normal prototype learning module Refinement of the normal prototype.

4. The method according to claim 2, characterized in that: The reconstruction loss function of the unlabeled sample The reconstruction loss function of the labeled abnormal samples in, represents the unlabeled sample set, w i Represents sample x i The weight of , l represents the regression loss function, Represents sample x i The reconstruction value of represents the set of labeled abnormal samples, and m1 represents the loss interval.

5. The method according to claim 2, characterized in that: The unlabeled samples optimize the KL divergence loss function Among them, the median value Median Intermediate value f j =∑ i q ij ,s ij Represents sample x i With the normal prototype u j The similarity between .

6. The method according to claim 2, characterized in that The contrast loss function Among them, σ is the Sigmoid activation function, represents the unlabeled sample set, w i Represents sample x i The weight of represents the set of labeled abnormal samples, s ij Represents sample x i With the normal prototype u j The similarity between .

7. The method according to claim 2, characterized in that The anomaly score loss function in, represents the unlabeled sample set, w i Represents sample x i The weight of , l represents the regression loss function, Represents a set of labeled abnormal samples, score i Represents sample x i The abnormal score.

8. The method according to claim 4, 6 or 7, characterized in that: The weight Among them, σ is the Sigmoid activation function, β is the scaling parameter for adjusting the sensitivity of the similarity score, and s ij Represents sample x i With the normal prototype u j The similarity between .

9. The method according to claim 8, characterized in that The similarity in, represents the parameters of the multi-normal prototype learning module, k is the number of normal prototypes, and α represents the degrees of freedom of the Student's t distribution.

10. An electronic device, characterized in that: The electronic device comprises: a processor and a memory storing computer program instructions; when the processor executes the computer program instructions, the weakly supervised anomaly detection method based on reconstruction and multi-prototype learning as described in any one of claims 1 to 9 is implemented.

Images