Data exception recognition model training method, data exception recognition method and data exception recognition device
By determining the initial abnormality identification configuration information and feature identification guidance information in the value generation data exception recognition, and training the model based on sample data, the problem of low accuracy in identifying abnormal value generation data is solved, and higher recognition accuracy and applicability are achieved.
Patent Information
- Application Number
- CN202411448969.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-16
- Publication Date
- 2025-02-25
AI Technical Summary
When the existing LightGBM machine learning model recognizes abnormal value generation data, fixed thresholds or rules lead to fewer applicable application scenarios, and the accuracy of identifying abnormal value generation data is low, resulting in more false alarms or missed reports of abnormal value data.
By determining the initial exception recognition configuration information and initial exception feature recognition guidance information for the corresponding value generation service, model training is carried out based on sample value generation data, and feature information is automatically mined and generated, the accuracy of data abnormal feature information is improved, and exception recognition is performed through the configured exception recognition strategy.
It improves the accuracy of data generated by identifying abnormal value, reduces the number of false alarms or missed reports of abnormal value data, and enhances the applicability of the model to a variety of application scenarios.
Smart Images

Figure CN119513736A_ABST
Abstract
Description
Technical Field
[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to a data anomaly recognition model training method, a data anomaly recognition method and a device. Background Art
[0002] With the popularization of artificial intelligence, the abnormal value-generating data (such as billing data) can be detected in time through the abnormal recognition technology of value-generating data. At present, when performing abnormal recognition on value-generating data, the commonly used method is to perform abnormal recognition through the pre-trained LightGBM (Light Gradient Boosting Machine) machine learning model.
[0003] However, the inventors have discovered that when the above-mentioned method is used to identify anomalies in value-generating data, the following technical problems often occur: the actual application scenarios are diverse, and the LightGBM machine learning model obtains fixed thresholds or rules for anomaly identification through training samples in advance, resulting in fewer applicable application scenarios, resulting in low accuracy in identifying abnormal value-generating data, and thus resulting in a large number of false positives or omissions of abnormal value data.
[0004] The above information disclosed in this Background section is only for enhancement of understanding of the background of the present disclosure concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention
[0005] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.
[0006] Some embodiments of the present disclosure propose a data anomaly recognition model training method, a data anomaly recognition method and device, an electronic device, a computer-readable medium, and a program product to solve one or more of the technical problems mentioned in the above background technology section.
[0007] In a first aspect, some embodiments of the present disclosure provide a data anomaly recognition model training method, the method comprising: determining initial anomaly recognition configuration information and initial anomaly feature recognition guidance information corresponding to a value generating business; performing the following training steps based on sample value generating data selected from a sample value generating data set: inputting the sample value generating data into an initial anomaly feature information generation model corresponding to the initial anomaly feature recognition guidance information to obtain sample data anomaly feature information, wherein the above-mentioned sample value generating data set corresponds to the above-mentioned value generating business; performing anomaly recognition processing on the above-mentioned sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information to obtain sample data anomaly information; comparing the data anomaly label information corresponding to the sample value generating data with the above-mentioned sample data anomaly information to obtain a comparison result; in response to determining that the above-mentioned comparison result satisfies a training completion condition, determining the initial anomaly recognition configuration information, the initial anomaly feature recognition guidance information, the initial anomaly feature information generation model and the initial data anomaly recognition model as anomaly recognition configuration information, anomaly feature recognition guidance information, anomaly feature information generation model and data anomaly recognition model, respectively.
[0008] Optionally, the above-mentioned initial data anomaly recognition model includes a cause information generation sub-model and an anomaly type generation sub-model corresponding to the initial anomaly recognition configuration information; and the above-mentioned initial data anomaly recognition model according to the corresponding initial anomaly recognition configuration information performs anomaly recognition processing on the above-mentioned sample data anomaly feature information to obtain sample data anomaly information, including: inputting the above-mentioned sample data anomaly feature information into the above-mentioned anomaly type generation sub-model to obtain the sample data anomaly type; in response to determining that the above-mentioned sample data anomaly type meets the preset anomaly type condition, inputting the above-mentioned sample data anomaly feature information into the cause information generation sub-model to obtain sample anomaly cause information; and determining the above-mentioned sample data anomaly type and the above-mentioned sample anomaly cause information as the sample data anomaly information.
[0009] Optionally, the above-mentioned initial data anomaly recognition model includes each anomaly type generation sub-model; and the above-mentioned initial data anomaly recognition model according to the corresponding initial anomaly recognition configuration information performs anomaly recognition processing on the above-mentioned sample data anomaly feature information to obtain sample data anomaly information, including: determining each anomaly type generation sub-model corresponding to the initial anomaly recognition configuration information in the above-mentioned each anomaly type generation sub-model as each target anomaly type generation sub-model; inputting the above-mentioned sample data anomaly feature information into each target anomaly type generation sub-model respectively to obtain a sample anomaly recognition result information set; and determining the sample data anomaly type according to the above-mentioned sample anomaly recognition result information set.
[0010] Optionally, the above-mentioned training step also includes: in response to determining that the above-mentioned comparison result does not meet the above-mentioned training completion condition, executing the following steps: updating the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal feature recognition configuration information and the initial data abnormality recognition model according to the above-mentioned comparison result and the above-mentioned selected sample value generation data; reselecting the sample value generation data from the above-mentioned sample value generation data set; and executing the above-mentioned training step again based on the updated initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model, as well as the reselected sample value generation data.
[0011] Optionally, the above-mentioned updating process of the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal recognition configuration information and the initial data abnormal recognition model is performed according to the above-mentioned comparison result and the above-mentioned selected sample value generation data, including: adjusting the parameters of the initial abnormal feature information generation model and the initial data abnormal recognition model corresponding to the initial abnormal feature recognition guidance information; encoding the respective order information corresponding to the above-mentioned selected sample value generation data to obtain at least one order state vector; encoding the initial abnormal recognition configuration information and the above-mentioned comparison result to obtain a metadata state vector; for each order state vector included in the above-mentioned at least one order state vector, concatenating the above-mentioned order state vector and the above-mentioned metadata state vector to obtain a target state vector; inputting the obtained respective target state vectors into a pre-trained updated abnormal recognition configuration information generation model to obtain updated abnormal recognition configuration information; and updating the initial abnormal recognition configuration information according to the above-mentioned updated abnormal recognition configuration information.
[0012] Optionally, before executing the following training steps based on each sample value generation data obtained, the method further includes: obtaining a sample value generation data set as an initial sample value generation data set; parsing each initial sample value generation data in the initial sample value generation data set; converting each initial sample value generation data after parsing to obtain a sample value generation data set.
[0013] Optionally, the method further includes: obtaining a feedback data anomaly information set corresponding to the abnormal feature information generation model and the data anomaly recognition model; generating model evaluation information based on the feedback data anomaly information set; and updating the abnormal feature information generation model and the data anomaly recognition model based on the model evaluation information.
[0014] In a second aspect, some embodiments of the present disclosure provide a data anomaly identification method, the method comprising: inputting value generation data into an abnormal feature information generation model corresponding to abnormal feature identification guidance information to obtain data anomaly feature information, wherein the above-mentioned abnormal feature identification guidance information and the above-mentioned abnormal feature information generation model are determined by the method described in any implementation manner of the above-mentioned first aspect; inputting the above-mentioned data anomaly feature information into a data anomaly identification model corresponding to abnormal identification configuration information to obtain data anomaly information, wherein the above-mentioned abnormal identification configuration information and the above-mentioned data anomaly identification model are determined by the method described in any implementation manner of the above-mentioned first aspect.
[0015] Optionally, the method further includes: controlling an associated display device to display the data anomaly information.
[0016] In a third aspect, some embodiments of the present disclosure provide a data anomaly recognition model training device, the device comprising: a determination unit, configured to determine initial anomaly recognition configuration information and initial anomaly feature recognition guidance information corresponding to a value generating business; an execution unit, configured to perform the following training steps based on sample value generating data selected from a sample value generating data set: inputting the sample value generating data into an initial anomaly feature information generation model corresponding to the initial anomaly feature recognition guidance information to obtain sample data anomaly feature information, wherein the above-mentioned sample value generating data set corresponds to the above-mentioned value generating business; performing anomaly recognition processing on the above-mentioned sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information to obtain sample data anomaly information; comparing the data anomaly label information corresponding to the sample value generating data with the above-mentioned sample data anomaly information to obtain a comparison result; in response to determining that the above-mentioned comparison result meets the training completion condition, determining the initial anomaly recognition configuration information, the initial anomaly feature recognition guidance information, the initial anomaly feature information generation model and the initial data anomaly recognition model as anomaly recognition configuration information, anomaly feature recognition guidance information, anomaly feature information generation model and data anomaly recognition model respectively.
[0017] Optionally, the above-mentioned initial data anomaly recognition model includes a cause information generation sub-model and an anomaly type generation sub-model corresponding to the initial anomaly recognition configuration information; the execution unit can be further configured to input the above-mentioned sample data anomaly feature information into the above-mentioned anomaly type generation sub-model to obtain the sample data anomaly type; in response to determining that the above-mentioned sample data anomaly type meets the preset anomaly type condition, the above-mentioned sample data anomaly feature information is input into the cause information generation sub-model to obtain sample anomaly cause information; the above-mentioned sample data anomaly type and the above-mentioned sample anomaly cause information are determined as the sample data anomaly information.
[0018] Optionally, the above-mentioned initial data anomaly recognition model includes various anomaly type generation sub-models; the execution unit can be further configured to determine the various anomaly type generation sub-models corresponding to the initial anomaly recognition configuration information in the above-mentioned various anomaly type generation sub-models as various target anomaly type generation sub-models; input the above-mentioned sample data anomaly feature information into each target anomaly type generation sub-model respectively to obtain a sample anomaly recognition result information set; determine the sample data anomaly type according to the above-mentioned sample anomaly recognition result information set.
[0019] Optionally, the above-mentioned training step also includes: in response to determining that the above-mentioned comparison result does not meet the above-mentioned training completion condition, executing the following steps: updating the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal feature recognition configuration information and the initial data abnormality recognition model according to the above-mentioned comparison result and the above-mentioned selected sample value generation data; reselecting the sample value generation data from the above-mentioned sample value generation data set; and executing the above-mentioned training step again based on the updated initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model, as well as the reselected sample value generation data.
[0020] Optionally, the execution unit can be further configured to adjust the parameters of the initial abnormal feature information generation model and the initial data abnormality recognition model corresponding to the initial abnormal feature recognition guidance information; encode the order information corresponding to the above-selected sample value generation data to obtain at least one order state vector; encode the initial abnormality recognition configuration information and the above-mentioned comparison result to obtain a metadata state vector; for each order state vector included in the above-mentioned at least one order state vector, concatenate the above-mentioned order state vector and the above-mentioned metadata state vector to obtain a target state vector; input the obtained target state vectors into a pre-trained updated abnormality recognition configuration information generation model to obtain updated abnormality recognition configuration information; and update the initial abnormality recognition configuration information according to the above-mentioned updated abnormality recognition configuration information.
[0021] Optionally, the data anomaly identification model training device may further include: a first acquisition unit, a parsing unit and a conversion unit. The first acquisition unit is configured to acquire a sample value generation data set as an initial sample value generation data set; the parsing unit is configured to parse each initial sample value generation data in the initial sample value generation data set; and the conversion unit is configured to convert each parsed initial sample value generation data to obtain a sample value generation data set.
[0022] Optionally, the data anomaly recognition model training device may further include: a second acquisition unit, a generation unit, and an update unit. The second acquisition unit is configured to acquire a feedback data anomaly information set corresponding to the above-mentioned anomaly feature information generation model and the above-mentioned data anomaly recognition model; the generation unit is configured to generate model evaluation information according to the above-mentioned feedback data anomaly information set; and the update unit is configured to update the above-mentioned anomaly feature information generation model and the above-mentioned data anomaly recognition model according to the above-mentioned model evaluation information.
[0023] In a fourth aspect, some embodiments of the present disclosure provide a data anomaly identification device, the device comprising: a first input unit, configured to input the value generation data into an abnormal feature information generation model corresponding to the abnormal feature identification guidance information, to obtain data anomaly feature information, wherein the above-mentioned abnormal feature identification guidance information and the above-mentioned abnormal feature information generation model are determined by the method described in any implementation manner of the first aspect; a second input unit, configured to input the above-mentioned data anomaly feature information into a data anomaly identification model corresponding to the abnormal identification configuration information to obtain data anomaly information, wherein the above-mentioned abnormal identification configuration information and the above-mentioned data anomaly identification model are determined by the method described in any implementation manner of the first aspect.
[0024] Optionally, the data anomaly identification device may further include a display unit, wherein the display unit is configured to control an associated display device to display the data anomaly information.
[0025] In a fifth aspect, some embodiments of the present disclosure provide an electronic device, comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by one or more processors, the one or more processors implement the method described in any implementation manner of the above-mentioned first aspect.
[0026] In a sixth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method described in any implementation manner of the first aspect.
[0027] In a seventh aspect, some embodiments of the present disclosure provide a computer program product, including a computer program, which implements the method described in any implementation manner of the above-mentioned first aspect when executed by a processor.
[0028] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: through the data anomaly recognition model training method of some embodiments of the present disclosure, the accuracy of identifying abnormal value generation data can be improved, and the number of false alarms or omissions of abnormal value data can be reduced. Specifically, the reasons for the low accuracy of identifying abnormal value generation data and the high number of false alarms or omissions of abnormal value data are: the actual application scenarios are diverse, and the LightGBM machine learning model obtains fixed thresholds or rules for abnormal recognition through training samples in advance, resulting in fewer applicable application scenarios, resulting in low accuracy in identifying abnormal value generation data, thereby causing a high number of false alarms or omissions of abnormal value data. Based on this, the data anomaly recognition model training method of some embodiments of the present disclosure, first, determines the initial anomaly recognition configuration information and initial anomaly feature recognition guidance information of the corresponding value generation business. Thus, the strategy for performing anomaly recognition and the information for guiding the model to perform feature recognition can be obtained, so that it can be used to automatically mine and generate more accurate features and anomaly recognition methods from value generation data for training data anomaly recognition models. Secondly, based on the sample value generation data selected from the sample value generation data set, the following training steps are performed: the first step is to input the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature recognition guidance information to obtain the sample data abnormal feature information. Among them, the above-mentioned sample value generation data set corresponds to the above-mentioned value generation business. Thus, the automatically mined and generated features can be obtained, so that the number and accuracy of the features contained in the data abnormal feature information can be improved. The second step is to perform abnormal recognition processing on the above-mentioned sample data abnormal feature information according to the initial data abnormal recognition model corresponding to the initial abnormal recognition configuration information to obtain the sample data abnormal information. Thus, abnormal recognition can be performed through the configured abnormal recognition strategy, so as to improve the accuracy of the abnormal recognition information. The third step is to compare the data abnormal label information corresponding to the sample value generation data with the above-mentioned sample data abnormal information to obtain a comparison result. Thus, the deviation between the data abnormal information generated by the current initial data abnormal recognition model and the initial abnormal feature information generation model and the already determined data abnormal information can be obtained, which can be used to determine whether the model training is completed. Finally, in response to determining that the above comparison result meets the training completion condition, the initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model are respectively determined as abnormality recognition configuration information, abnormality feature recognition guidance information, abnormality feature information generation model and data abnormality recognition model. Thus, the abnormality feature information generation model corresponding to the abnormality feature recognition guidance information and the data abnormality recognition model corresponding to the abnormality recognition configuration information that have been trained can be obtained, so that they can be used to identify abnormal value generation data.Also, when training the data anomaly recognition model, not only the abnormal feature information generation model corresponding to the abnormal feature recognition guidance information automatically mines and generates feature information containing more features for data anomaly recognition, but also an abnormal recognition strategy is set, thereby improving the accuracy of the trained data anomaly recognition model. Therefore, when the trained data anomaly recognition model is used to identify anomalies in value-generating data, the accuracy of identifying abnormal value-generating data can be improved, and the number of false positives or omissions of abnormal value data can be reduced. BRIEF DESCRIPTION OF THE DRAWINGS
[0029] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.
[0030] Figure 1 is a schematic diagram of an application scenario of a data anomaly recognition model training method according to some embodiments of the present disclosure;
[0031] Figure 2 is a flow chart of some embodiments of the data anomaly recognition model training method according to the present disclosure;
[0032] Figure 3 is a flowchart of other embodiments of the data anomaly recognition model training method according to the present disclosure;
[0033] Figure 4 is a flow chart of some embodiments of the data anomaly identification method according to the present disclosure;
[0034] Figure 5 is a schematic diagram of the structure of some embodiments of the data anomaly recognition model training device disclosed in the present invention;
[0035] Figure 6 is a schematic diagram of the structure of some embodiments of the data anomaly identification method and device disclosed in the present invention;
[0036] Figure 7 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION
[0037] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.
[0038] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.
[0039] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.
[0040] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".
[0041] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.
[0042] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.
[0043] Figure 1 It is a schematic diagram of an application scenario of the data anomaly recognition model training method of some embodiments of the present disclosure.
[0044] exist Figure 1In the application scenario, first, the computing device 100 can determine the initial abnormality identification configuration information 102 and the initial abnormality feature identification guidance information 103 corresponding to the value generation business 101. Then, the computing device 100 can perform the following training steps based on the sample value generation data 1041 selected from the sample value generation data set 104: Step 1, input the sample value generation data 1041 into the initial abnormality feature information generation model 105 corresponding to the initial abnormality feature identification guidance information 103, and obtain the sample data abnormality feature information 106. Among them, the above-mentioned sample value generation data set 104 corresponds to the above-mentioned value generation business 101. Step 2, according to the initial data abnormality identification model 107 corresponding to the initial abnormality identification configuration information 102, perform abnormality identification processing on the above-mentioned sample data abnormality feature information 106 to obtain sample data abnormality information 108. Step 3, compare the data abnormality label information 109 corresponding to the sample value generation data 1041 with the above-mentioned sample data abnormality information 108 to obtain a comparison result 110. In the fourth step, in response to determining that the above comparison result satisfies the training completion condition 111, the initial abnormality recognition configuration information 102, the initial abnormality feature recognition guidance information 103, the initial abnormality feature information generation model 105 and the initial data abnormality recognition model 107 are respectively determined as abnormality recognition configuration information 112, abnormality feature recognition guidance information 113, abnormality feature information generation model 114 and data abnormality recognition model 115.
[0045] It should be noted that the computing device 101 can be hardware or software. When the computing device is hardware, it can be implemented as a distributed cluster consisting of multiple servers or terminal devices, or as a single server or a single terminal device. When the computing device is embodied as software, it can be installed in the hardware devices listed above. It can be implemented as multiple software or software modules for providing distributed services, or as a single software or software module. No specific limitation is made here.
[0046] It should be understood that Figure 1 The number of computing devices in the embodiment is only illustrative. Any number of computing devices may be provided according to implementation requirements.
[0047] Continue to refer Figure 2 , shows a process 200 of some embodiments of the data anomaly recognition model training method according to the present disclosure. The data anomaly recognition model training method comprises the following steps:
[0048] Step 201 : determining initial abnormality identification configuration information and initial abnormality feature identification guidance information corresponding to the value generation business.
[0049] In some embodiments, the execution subject of the data anomaly recognition model training method (for example Figure 1The computing device shown in the figure) can determine the initial abnormal identification configuration information and initial abnormal feature identification guidance information of the corresponding value generation business. Among them, the above-mentioned value generation business can be a business that needs to generate value (such as billing). For example, the above-mentioned value generation business can be a billing business of an order. The above-mentioned order can be an order for obtaining (such as purchasing) an item, or it can be an order for logistics transportation. The above-mentioned initial abnormal identification configuration information can be the abnormal identification configuration information before each execution of the training step. The above-mentioned abnormal identification configuration information can be information for configuring the abnormal data identification method. The above-mentioned abnormal identification configuration information can include but is not limited to an identification feature type set, a data abnormality threshold set, and an abnormal type identification method identification set. The identification feature type in the above-mentioned identification feature type set can characterize the type of data corresponding to the feature required when performing abnormal data identification. The above-mentioned identification feature type set can include but is not limited to at least one of the following: item information, value generation method (such as billing method), value submission information identification (such as quotation code), and agreement validity period information. The data abnormality threshold included in the above-mentioned data abnormality threshold set can be a threshold for characterizing the abnormality of value generation data of the corresponding data type. The above-mentioned data type can be but is not limited to value information (such as amount) and agreement validity period. The abnormal type identification method identifier in the abnormal type identification method identifier set may be a unique identifier of the abnormal type identification method. The above-mentioned abnormal type identification method may be a classification method for detecting abnormal types of value-generating data. The above-mentioned classification method may be, but is not limited to, one of the following: Lightgbm (Light Gradient Boosting Machine) machine learning model, LOF (Local Outlier Factor), support vector machine, Autoencoder. The above-mentioned abnormal type may be, but is not limited to, one of the following: abnormal, no abnormal. The above-mentioned initial abnormal feature identification guidance information may be the abnormal feature identification guidance information before each training step is executed. The above-mentioned abnormal feature identification guidance information may be information used to guide the feature extraction model to extract the required features. The above-mentioned initial abnormal feature identification guidance information may include, but is not limited to, a value (e.g., account adjustment) keyword text set, an abnormal numerical type set, a value verification type (e.g., audit logic) set, and numerical fluctuation information. As an example, when the above-mentioned value-generating business is a value-generating business for orders corresponding to logistics transportation, the above-mentioned value-retrieving (e.g., account adjustment) keyword text set may be {"no value generation (e.g., no billing)"; "reduction"; "value submission information (e.g., quotation) is incorrect"; "no loading and unloading"}. The above-mentioned abnormal value type set may be {vehicle weight is greater than the historical weight average; vehicle volume is greater than the historical volume average; generated value information (e.g., billing amount) is greater than the historical generated value information (e.g., billing amount) average; transportation distance is greater than the historical average distance}.The above-mentioned value verification type (such as audit logic) set can be {the smaller of the vehicle model is used to generate value (such as the smaller of the vehicle model is used for settlement); value submission information (such as quotation) maintenance; isochronous value information (such as fees) is adjusted down; vehicle sealing error}. The above-mentioned numerical fluctuation information can be "the variance of the value information (such as amount) corresponding to the preset time period, the mileage of the fixed line on a month-on-month basis". The above-mentioned preset time period can be a pre-set time period. In practice, the above-mentioned execution entity can determine the preset abnormality recognition configuration information and the preset abnormal feature recognition guidance information as the initial abnormality recognition configuration information and the initial abnormal feature recognition guidance information, respectively. Among them, the above-mentioned preset abnormality recognition configuration information can be the preset abnormality recognition configuration information. The above-mentioned preset abnormal feature recognition guidance information can be the preset abnormal feature recognition guidance information.
[0050] Step 202, based on the sample value generation data selected from the sample value generation data set, perform the following training steps:
[0051] Step 2021, input the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature identification guidance information to obtain the sample data abnormal feature information.
[0052] In some embodiments, the execution subject may input the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature identification guidance information to obtain the sample data abnormal feature information. Among them, the sample value generation data set corresponds to the value generation business. The sample value generation data set may be obtained from the database by wired connection or wireless connection. It should be noted that the wireless connection method may include but is not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other wireless connection methods known or developed in the future. The sample value generation data in the sample value generation data set may be the value generation data (e.g., billing data) corresponding to the value generation business used as a training sample. The value generation data may include but is not limited to value generation files (e.g., billing slips), value generation types (e.g., billing types), value generation information (e.g., billing results), value submission information identifiers (e.g., quotation codes), protocol codes, item information, and business information. The business information may be information on value generation business. As an example, when the above-mentioned value-generating business is a value-generating business for orders corresponding to logistics transportation, the above-mentioned business information may include but is not limited to transportation route information, route type, transportation mode, and transportation capacity resource information. The above-mentioned transportation route information may include but is not limited to a transportation starting point identifier and a transportation end point identifier. The above-mentioned transportation starting point identifier may be a unique identifier of the starting point of the transportation item. The above-mentioned transportation end point identifier may be a unique identifier of the end point of the transportation item. The above-mentioned route type may characterize the type of transportation route. The above-mentioned route type may be, but is not limited to, one of the following: a major trunk line and a minor trunk line. The above-mentioned major trunk line may be a trunk line responsible for long-distance, large-volume cargo transportation. The above-mentioned minor trunk line may be a trunk line responsible for short-distance, flexible and diverse cargo transportation. The above-mentioned transportation mode may be, but is not limited to, one of the following: full truckload and less-than-truckload. The above-mentioned transportation capacity resource information may characterize the resources required during the transportation process. The above-mentioned transportation capacity resource information may include a transportation vehicle identifier and a driver identifier. The above-mentioned transportation vehicle identifier may be a unique identifier of a vehicle for transporting goods. The above-mentioned driver identifier may be an identifier of the driver driving the transportation vehicle. The initial abnormal feature information generation model corresponding to the initial abnormal feature identification guidance information can be: a feature extraction model for extracting the features guided by the initial abnormal feature identification guidance information in the value generation data. The above-mentioned initial abnormal feature information generation model can be a GPT model. It should be noted that there is no limitation on the number of selected sample value generation data. For example, the number of selected sample value generation data can be 1 or 10.
[0053] Step 2022: perform anomaly recognition processing on the sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information to obtain sample data anomaly information.
[0054] In some embodiments, the execution subject may perform anomaly recognition processing on the sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information to obtain sample data anomaly information. The initial data anomaly recognition model may be a model for identifying whether the value generating data is abnormal. The sample data anomaly information may characterize whether the corresponding sample value data is abnormal. The initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information may be: each anomaly type recognition method adopted by the initial data anomaly recognition model and each data anomaly threshold used during recognition are present in the initial anomaly recognition configuration information.
[0055] Optionally, the above-mentioned initial data anomaly identification model may include a cause information generation sub-model and an anomaly type generation sub-model corresponding to the initial anomaly identification configuration information. Among them, the above-mentioned cause information generation sub-model may be a model for automatically generating anomaly cause information. The above-mentioned anomaly cause information may characterize the cause of the value generation data anomaly. As an example, the above-mentioned anomaly cause information may be "operation-incorrect basic information-incorrect vehicle model", or it may be "value verification type (such as audit logic) error". The above-mentioned cause information generation sub-model may be a GPT model. The above-mentioned anomaly type generation sub-model corresponding to the initial anomaly identification configuration information may be: a model corresponding to at least one of the anomaly type identification methods of the initial anomaly identification configuration information. The various anomaly type identification methods corresponding to the initial anomaly identification configuration information may be: various anomaly type identification methods corresponding to the anomaly type identification method identifier set included in the initial anomaly identification configuration information.
[0056] In some optional implementations of some embodiments, the execution subject may perform anomaly recognition processing on the sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information through the following steps to obtain sample data anomaly information:
[0057] In the first step, the sample data abnormality feature information is input into the abnormality type generation sub-model to obtain the sample data abnormality type. The sample data abnormality type can characterize whether the sample value generation data is abnormal. The sample data abnormality type can be, but is not limited to, one of the following: abnormal, no abnormal.
[0058] In the second step, in response to determining that the sample data abnormality type meets the preset abnormality type condition, the sample data abnormality feature information is input into the cause information generation sub-model to obtain the sample abnormality cause information. The preset abnormality type condition may be: the sample data abnormality type indicates that the sample value generation data is abnormal.
[0059] The third step is to determine the sample data anomaly type and the sample anomaly reason information as the sample data anomaly information. In practice, the execution subject may combine the sample data anomaly type and the sample anomaly reason information to obtain the sample data anomaly information. The combination may be character concatenation.
[0060] In this way, the data anomaly type can be automatically identified and the anomaly cause information can be automatically generated, which can facilitate the verification user to conduct a review and verification.
[0061] Optionally, the initial data anomaly recognition model may include various anomaly type generation sub-models. Among them, the anomaly type generation sub-models in the various anomaly type generation sub-models may be classification models for identifying data anomaly types. For example, the anomaly type generation sub-model may be a support vector machine or an Autoencoder.
[0062] In some other optional implementations of some embodiments, the execution subject may perform anomaly recognition processing on the sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information through the following steps to obtain sample data anomaly information:
[0063] In the first step, each of the above-mentioned abnormal type generation sub-models corresponding to the initial abnormal identification configuration information is determined as each target abnormal type generation sub-model. The abnormal type generation sub-model corresponding to the initial abnormal identification configuration information can be: the abnormal type generation sub-model whose corresponding identifier exists in the abnormal type identification method identifier set included in the initial abnormal identification configuration information.
[0064] In the second step, the sample data abnormal feature information is input into each target abnormal type generation sub-model to obtain a sample abnormality recognition result information set. The sample abnormality recognition result information in the sample abnormality recognition result information set may include each abnormality type score corresponding to each data abnormality type. The abnormality type score may be the score of the corresponding data abnormality type.
[0065] The third step is to determine the sample data anomaly type based on the sample anomaly identification result information set. In practice, first, for each data anomaly type, the execution entity may determine the sum of the scores of each anomaly type corresponding to the data anomaly type included in the sample anomaly identification result information set as the total score of the anomaly type. Then, the maximum value of the total scores of each anomaly type determined is determined as the target anomaly type total score. Finally, the data anomaly type corresponding to the total score of the target anomaly type in each data anomaly type is determined as the sample data anomaly type.
[0066] Therefore, the ensemble learning method can be applied to integrate various anomaly types to generate sub-models, thereby improving the accuracy and robustness of anomaly recognition of the initial data anomaly recognition model.
[0067] Step 2023, compare the data anomaly label information of the data generated corresponding to the sample value with the sample data anomaly information to obtain a comparison result.
[0068] In some embodiments, the execution subject may compare the data anomaly label information of the corresponding sample value generation data with the sample data anomaly information to obtain a comparison result. The data anomaly label information may be a data anomaly label of the corresponding sample value generation data. In practice, first, the execution subject may determine the similarity between the data anomaly label information of the corresponding sample value generation data and the sample data anomaly information as information similarity. The similarity may be cosine similarity. Then, according to the obtained information similarity, the training model evaluation information is generated as a comparison result by a preset model evaluation method. The preset model evaluation method may be a pre-set method for evaluating the performance of the initial data anomaly recognition model. For example, the preset model evaluation method may be a model accuracy evaluation method or a model recall evaluation method. The model accuracy evaluation method may be a method for generating the accuracy of the model. For example, the model accuracy evaluation method may be: determining the ratio of the number of predicted accurate samples to the total number of selected samples as the model accuracy. The number of predicted accurate samples may be the number of predicted accurate samples. The predicted accurate samples may be sample value generation data whose corresponding information similarity is greater than a preset similarity threshold. The preset similarity may be a similarity of a pre-set representation of similar information. The total number of selected samples may be the total number of sample value generation data selected. The model recall rate evaluation method may be a method for generating the recall rate of a model. For example, the model recall rate evaluation method may be: determining the model recall rate as the ratio of the number of predicted abnormal samples to the total number of sample value generation data selected with label anomalies. The number of predicted abnormal samples may be the number of sample value generation data for each sample value generation data for which the sample data anomaly information represents anomalies. The total number of sample value generation data for each sample value generation data for which the corresponding data anomaly label information represents anomalies in the selected sample value generation data.
[0069] Optionally, before step 202, the execution entity may perform the following steps:
[0070] The first step is to obtain a sample value generation data set as an initial sample value generation data set. In practice, the above-mentioned execution entity can use Spark SQL technology to obtain a sample value generation data set from a database through a wired connection or a wireless connection as an initial sample value generation data set. It should be noted that the initial sample value generation data set corresponds to various data formats. The above-mentioned various data formats may include but are not limited to excel format, csv format, zip format, and 7z format.
[0071] The second step is to parse and process each initial sample value generation data in the above-mentioned initial sample value generation data set. In practice, the above-mentioned execution entity can parse and process each initial sample value generation data in the above-mentioned initial sample value generation data set through the MapReduce model and the Reducer function. It should be noted that the data format corresponding to each initial sample value generation data in the parsed initial sample value generation data set is the same.
[0072] The third step is to convert each parsed initial sample value generation data to obtain a sample value generation data set. In practice, the above-mentioned execution entity can input each parsed initial sample value generation data into a preset data mapping model to obtain a sample value generation data set. Among them, the above-mentioned preset data mapping model can be a pre-set model for converting initial sample value generation data of various formats and lengths into the same length and header type. The above-mentioned header type can characterize the type to which each data value of the corresponding header belongs. For example, the above-mentioned header type can be a value generation (billing) method, or it can be a retrieval of value information (such as account adjustment).
[0073] In this way, the formats of various value-generating data from multiple sources can be integrated and unified, improving the accuracy and efficiency of subsequent abnormal data identification.
[0074] Optionally, the execution entity may store the obtained sample value generation data set in a preset database. The preset database may be a pre-set database for storing sample value generation data sets. For example, the preset database may be a HDFS (Hadoop Distributed File System) database.
[0075] Step 2024, in response to determining that the comparison result meets the training completion condition, the initial anomaly recognition configuration information, the initial anomaly feature recognition guidance information, the initial anomaly feature information generation model and the initial data anomaly recognition model are respectively determined as the anomaly recognition configuration information, the anomaly feature recognition guidance information, the anomaly feature information generation model and the data anomaly recognition model.
[0076] In some embodiments, the execution subject may determine the initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model as abnormality recognition configuration information, abnormality feature recognition guidance information, abnormality feature information generation model and data abnormality recognition model respectively in response to determining that the comparison result satisfies the training completion condition. Among them, the preset training completion condition may be: the evaluation parameter in the training model evaluation information corresponding to the comparison result is greater than the preset evaluation parameter. Among them, the preset evaluation parameter may be a pre-set evaluation parameter. The evaluation parameter may be a model accuracy rate or a model recall rate.
[0077] Optionally, the execution subject may further execute the following sub-steps in response to determining that the comparison result does not satisfy the training completion condition:
[0078] In the first sub-step, data is generated based on the comparison result and the selected sample value, and the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal recognition configuration information and the initial data abnormal recognition model are updated.
[0079] The second sub-step is to reselect the sample value generation data from the above sample value generation data set.
[0080] The third sub-step is to execute the above training step again based on the updated initial anomaly recognition configuration information, initial anomaly feature recognition guidance information, initial anomaly feature information generation model and initial data anomaly recognition model, as well as the re-selected sample value generation data.
[0081] In some optional implementations of some embodiments, the execution subject may generate data according to the comparison result and the selected sample value through the following steps to update the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal recognition configuration information and the initial data abnormal recognition model:
[0082] The first step is to adjust the parameters of the initial abnormal feature information generation model and the initial data abnormality recognition model corresponding to the initial abnormal feature recognition guidance information. In practice, the above-mentioned execution entity can adjust the parameters of the initial abnormal feature information generation model and the initial data abnormality recognition model corresponding to the initial abnormal feature recognition guidance information by using the gradient descent method or the federated learning method.
[0083] The second step is to encode the order information corresponding to the selected sample value generation data to obtain at least one order status vector. The order information may include but is not limited to order identification, order value information (such as order amount), and business information. The order identification may be a unique identification of the corresponding order. As an example, when the order information corresponds to a logistics transportation order, the order information may also include transportation route information, line type, transportation method, transportation resource information, transportation distance, and transportation item weight. In practice, the execution subject may encode the order information corresponding to the selected sample value generation data through a preset text vectorization method to obtain at least one order status vector. The preset text vectorization method may be a method for converting the semantics of text expression into a vector. For example, the preset text vectorization method may be a one-hot encoding method or a word embedding method.
[0084] The third step is to encode the initial abnormality identification configuration information and the above comparison result to obtain a metadata state vector. In practice, the above execution subject can encode the initial abnormality identification configuration information and the above comparison result through the above preset text vectorization method to obtain a metadata state vector.
[0085] In the fourth step, for each order state vector included in the at least one order state vector, the order state vector and the metadata state vector are concatenated to obtain a target state vector.
[0086] In the fifth step, each target state vector obtained is input into a pre-trained update anomaly identification configuration information generation model to obtain the update anomaly identification configuration information. The update anomaly identification configuration information generation model may be a neural network with the target state vector as input and the update anomaly identification configuration information as output. The neural network may be Deep Q-Networks (DQN), Deep Deterministic Policy Gradient (DDPG), or an asynchronous advantage actor-critic algorithm (Asynchronous Advantage Actor-Critic, A3C). The update anomaly identification configuration information may be the updated anomaly identification configuration information.
[0087] As an example, the neural network can be Deep Q-Networks (DQN), and the action corresponding to Deep Q-Networks (DQN) can be the adjustment range of the data anomaly threshold set included in the corresponding initial anomaly recognition configuration information. When training and updating the anomaly recognition configuration information generation model, an experience replay pool can also be constructed to store historical anomaly recognition configuration information, actions, rewards, and new states, and then randomly sample and replay experience.
[0088] Step 6: Update the initial abnormality identification configuration information according to the updated abnormality identification configuration information. In practice, the execution subject may update the initial abnormality identification configuration information to the updated abnormality identification configuration information.
[0089] Therefore, the anomaly recognition configuration information can be optimized and adjusted through reinforcement learning methods, and the anomaly recognition strategy can be dynamically adjusted, thereby improving the accuracy of anomaly recognition.
[0090] The above-mentioned various embodiments of the present disclosure have the following beneficial effects: the data anomaly recognition model training method of some embodiments of the present disclosure can improve the accuracy of identifying abnormal value generation data and reduce the number of false alarms or omissions of abnormal value data. Specifically, the reasons for the low accuracy of identifying abnormal value generation data and the high number of false alarms or omissions of abnormal value data are: the actual application scenarios are diverse, and the LightGBM machine learning model obtains fixed thresholds or rules for abnormal recognition through training samples in advance, resulting in fewer applicable application scenarios, resulting in low accuracy in identifying abnormal value generation data, thereby causing a high number of false alarms or omissions of abnormal value data. Based on this, the data anomaly recognition model training method of some embodiments of the present disclosure, first, determines the initial anomaly recognition configuration information and initial anomaly feature recognition guidance information of the corresponding value generation business. Thus, the strategy for performing anomaly recognition and the information for guiding the model to perform feature recognition can be obtained, so that it can be used to automatically mine and generate more accurate features and anomaly recognition methods from value generation data for training data anomaly recognition models. Secondly, based on the sample value generation data selected from the sample value generation data set, the following training steps are performed: the first step is to input the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature recognition guidance information to obtain the sample data abnormal feature information. Among them, the above-mentioned sample value generation data set corresponds to the above-mentioned value generation business. Thus, the automatically mined and generated features can be obtained, so that the number and accuracy of the features contained in the data abnormal feature information can be improved. The second step is to perform abnormal recognition processing on the above-mentioned sample data abnormal feature information according to the initial data abnormal recognition model corresponding to the initial abnormal recognition configuration information to obtain the sample data abnormal information. Thus, abnormal recognition can be performed through the configured abnormal recognition strategy, so as to improve the accuracy of the abnormal recognition information. The third step is to compare the data abnormal label information corresponding to the sample value generation data with the above-mentioned sample data abnormal information to obtain a comparison result. Thus, the deviation between the data abnormal information generated by the current initial data abnormal recognition model and the initial abnormal feature information generation model and the already determined data abnormal information can be obtained, which can be used to determine whether the model training is completed. Finally, in response to determining that the above comparison result meets the training completion condition, the initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model are respectively determined as abnormality recognition configuration information, abnormality feature recognition guidance information, abnormality feature information generation model and data abnormality recognition model. Thus, the abnormality feature information generation model corresponding to the abnormality feature recognition guidance information and the data abnormality recognition model corresponding to the abnormality recognition configuration information that have been trained can be obtained, so that they can be used to identify abnormal value generation data.Also, when training the data anomaly recognition model, not only the abnormal feature information generation model corresponding to the abnormal feature recognition guidance information automatically mines and generates feature information containing more features for data anomaly recognition, but also an abnormal recognition strategy is set, thereby improving the accuracy of the trained data anomaly recognition model. Therefore, when the trained data anomaly recognition model is used to identify anomalies in value-generating data, the accuracy of identifying abnormal value-generating data can be improved, and the number of false positives or omissions of abnormal value data can be reduced.
[0091] Further references Figure 3 , which shows a process 300 of another embodiment of a data anomaly recognition model training method. The process 300 of the data anomaly recognition model training method includes the following steps:
[0092] Step 301, determining initial abnormality identification configuration information and initial abnormality feature identification guidance information corresponding to the value generation business.
[0093] Step 302, based on the sample value generation data selected from the sample value generation data set, perform the following training steps:
[0094] Step 3021, input the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature identification guidance information to obtain the sample data abnormal feature information.
[0095] Step 3022: perform anomaly recognition processing on the sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information to obtain sample data anomaly information.
[0096] Step 3023, compare the data anomaly label information of the data generated corresponding to the sample value with the sample data anomaly information to obtain a comparison result.
[0097] Step 3024, in response to determining that the comparison result meets the training completion condition, the initial anomaly recognition configuration information, the initial anomaly feature recognition guidance information, the initial anomaly feature information generation model and the initial data anomaly recognition model are respectively determined as the anomaly recognition configuration information, the anomaly feature recognition guidance information, the anomaly feature information generation model and the data anomaly recognition model.
[0098] In some embodiments, the specific implementation of steps 301-3024 and the technical effects brought about can be referred to in Figure 2 Steps 201-2024 in the corresponding embodiment are not repeated here.
[0099] Step 303: Obtain a feedback data anomaly information set corresponding to the anomaly feature information generation model and the data anomaly recognition model.
[0100] In some embodiments, the above execution entities (e.g. Figure 1 The computing device shown in the figure) can obtain the feedback data anomaly information set corresponding to the above-mentioned abnormal feature information generation model and the above-mentioned data anomaly identification model. Among them, each feedback data anomaly information in the above-mentioned feedback data anomaly information set corresponds to a value generation data. The feedback data anomaly information may include actual data anomaly information and predicted data anomaly information. Among them, the above-mentioned actual data anomaly information can be data anomaly information verified by the user who verifies the value generation data (for example, the auditor of the billing data). The above-mentioned predicted data anomaly information can be predicted according to the above-mentioned abnormal feature information generation model and the above-mentioned data anomaly identification model. In practice, the above-mentioned execution entity can obtain the feedback data anomaly information set corresponding to the above-mentioned abnormal feature information generation model and the above-mentioned data anomaly identification model from the database through a wired connection or a wireless connection.
[0101] Step 304: Generate model evaluation information based on the feedback data anomaly information set.
[0102] In some embodiments, the above-mentioned execution entity may generate model evaluation information based on the above-mentioned feedback data anomaly information set. The above-mentioned model evaluation information may be information of a data anomaly recognition model. The above-mentioned model evaluation information may include various evaluation parameters corresponding to various preset model evaluation methods. The evaluation parameters may be model accuracy, model precision, and model recall. In practice, first, for each of the above-mentioned feedback data anomaly information included in the above-mentioned feedback data anomaly information set, the above-mentioned execution entity may determine the similarity between the actual data anomaly information and the predicted data anomaly information included in the above-mentioned feedback data anomaly information as the recognition result similarity. Then, based on the obtained similarities of each recognition result, the model evaluation information is generated through each preset model evaluation method.
[0103] Step 305: update the abnormal feature information generation model and the data anomaly recognition model according to the model evaluation information.
[0104] In some embodiments, the execution subject may update the abnormal feature information generation model and the data anomaly recognition model according to the model evaluation information. Here, the specific implementation and technical effect of updating the abnormal feature information generation model and the data anomaly recognition model according to the model evaluation information can refer to the corresponding implementation of updating the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal recognition configuration information and the initial data anomaly recognition model according to the comparison result and the selected sample value data, and will not be repeated here.
[0105] from Figure 3 It can be seen that Figure 2 Compared with the description of some corresponding embodiments, Figure 3 The process 300 of the data anomaly recognition model training method in some corresponding embodiments embodies the steps of updating the abnormal feature information generation model and the data anomaly recognition model again according to the feedback results of the application model. Therefore, the schemes described in these embodiments can improve the accuracy of the abnormal feature information generation model and the data anomaly recognition model.
[0106] Further references Figure 4 , which shows a process 400 of some embodiments of a method for identifying anomalies in data. The process 400 of the method for identifying anomalies in data includes the following steps:
[0107] Step 401, input the value generation data into the abnormal feature information generation model corresponding to the abnormal feature recognition guidance information to obtain data abnormal feature information.
[0108] In some embodiments, the execution subject (e.g., computing device) of the data anomaly identification method may input the value generation data into the abnormal feature information generation model corresponding to the abnormal feature identification guidance information to obtain the data anomaly feature information. The abnormal feature identification guidance information and the abnormal feature information generation model are determined by the data anomaly identification model training method of some embodiments of the present disclosure.
[0109] Step 402: input the data anomaly feature information into a data anomaly recognition model corresponding to the anomaly recognition configuration information to obtain data anomaly information.
[0110] In some embodiments, the execution subject may input the data anomaly feature information into a data anomaly recognition model corresponding to the anomaly recognition configuration information to obtain data anomaly information. The anomaly recognition configuration information and the data anomaly recognition model are determined by the data anomaly recognition model training method of some embodiments of the present disclosure.
[0111] Optionally, the execution entity may control the associated display device to display the data anomaly information. In practice, the execution entity may display the data anomaly information on a value generation (e.g., settlement) interface. The value generation (e.g., settlement) interface may be an interface for value generation. Thus, the verification user may view and verify the value generation data in a timely manner.
[0112] Optionally, the execution subject may execute an abnormality adjustment operation corresponding to the abnormality cause information included in the data abnormality information, wherein the abnormality adjustment operation may be an operation for reducing and verifying abnormal value generation data.
[0113] As an example, when the abnormal reason information is "line type error", the abnormal adjustment operation may be to update the field corresponding to "line type". For example, if the line type is currently "large trunk line", the abnormal adjustment operation may be to update the line type to "small trunk line".
[0114] As another example, when the abnormal reason information is "the weight of the item is wrong", the abnormal adjustment operation may be: sending a preset error prompt information to the weighing user terminal. The predicted error prompt information may be pre-set information indicating a weight error. The weighing user terminal may be a terminal of a user responsible for weighing the item.
[0115] In this way, errors corresponding to the abnormal cause information can be corrected in time, thereby reducing the generation of abnormal value-generating data.
[0116] The above-mentioned embodiments of the present disclosure have the following beneficial effects: the data anomaly identification method of some embodiments of the present disclosure can improve the accuracy of identifying abnormal value generation data and reduce the number of false alarms or omissions of abnormal value data. Specifically, the reason for the low accuracy of identifying abnormal value generation data and the high number of false alarms or omissions of abnormal value data is that the actual application scenarios are diverse, and the LightGBM machine learning model obtains fixed thresholds or rules for abnormal identification through training samples in advance, resulting in fewer applicable application scenarios, resulting in low accuracy of identifying abnormal value generation data, thereby causing a high number of false alarms or omissions of abnormal value data. Based on this, the data anomaly identification method of some embodiments of the present disclosure, first, inputs the value generation data into the abnormal feature information generation model corresponding to the abnormal feature identification guidance information to obtain data abnormal feature information. Among them, the above-mentioned abnormal feature identification guidance information and the above-mentioned abnormal feature information generation model are determined by the data anomaly identification model training method of some embodiments of the present disclosure. Thus, data abnormal feature information with higher accuracy can be obtained, which can be used to identify abnormal value generation data. Then, the above-mentioned data abnormal feature information is input into the data abnormal identification model corresponding to the abnormal identification configuration information to obtain data abnormal information. Among them, the above-mentioned anomaly identification configuration information and the above-mentioned data anomaly identification model are determined by the data anomaly identification model training method of some embodiments of the present disclosure. As a result, data anomaly information with higher accuracy can be obtained. Also, when performing data anomaly identification, a higher-accuracy abnormal feature information generation model and a data anomaly identification model are used, thereby improving the accuracy of the value generation data for identifying anomalies, thereby reducing the number of false positives or omissions of abnormal value data.
[0117] Further references Figure 5As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a data anomaly recognition model training device, and these device embodiments are similar to Figure 2 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.
[0118] like Figure 5 As shown, the data anomaly recognition model training device 500 of some embodiments includes: a determination unit 501 and an execution unit 502. The determination unit 501 is configured to determine the initial anomaly recognition configuration information and the initial anomaly feature recognition guidance information of the corresponding value generation business; the execution unit 502 is configured to perform the following training steps based on the sample value generation data selected from the sample value generation data set: input the sample value generation data into the initial anomaly feature information generation model corresponding to the initial anomaly feature recognition guidance information to obtain the sample data anomaly feature information, wherein the above-mentioned sample value generation data set corresponds to the above-mentioned value generation business; perform anomaly recognition processing on the above-mentioned sample data anomaly feature information according to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information to obtain the sample data anomaly information; compare the data anomaly label information corresponding to the sample value generation data with the above-mentioned sample data anomaly information to obtain a comparison result; in response to determining that the above-mentioned comparison result meets the training completion condition, the initial anomaly recognition configuration information, the initial anomaly feature recognition guidance information, the initial anomaly feature information generation model and the initial data anomaly recognition model are respectively determined as the anomaly recognition configuration information, the anomaly feature recognition guidance information, the anomaly feature information generation model and the data anomaly recognition model.
[0119] Optionally, the above-mentioned initial data anomaly recognition model includes a cause information generation sub-model and an anomaly type generation sub-model corresponding to the initial anomaly recognition configuration information; the execution unit 501 can be further configured to input the above-mentioned sample data anomaly feature information into the above-mentioned anomaly type generation sub-model to obtain the sample data anomaly type; in response to determining that the above-mentioned sample data anomaly type meets the preset anomaly type condition, the above-mentioned sample data anomaly feature information is input into the cause information generation sub-model to obtain sample anomaly cause information; the above-mentioned sample data anomaly type and the above-mentioned sample anomaly cause information are determined as sample data anomaly information.
[0120] Optionally, the above-mentioned initial data anomaly recognition model includes various anomaly type generation sub-models; the execution unit 501 can be further configured to determine the various anomaly type generation sub-models corresponding to the initial anomaly recognition configuration information in the above-mentioned various anomaly type generation sub-models as various target anomaly type generation sub-models; input the above-mentioned sample data anomaly feature information into each target anomaly type generation sub-model respectively to obtain a sample anomaly recognition result information set; determine the sample data anomaly type according to the above-mentioned sample anomaly recognition result information set.
[0121] Optionally, the above-mentioned training step also includes: in response to determining that the above-mentioned comparison result does not meet the above-mentioned training completion condition, executing the following steps: updating the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal feature recognition configuration information and the initial data abnormality recognition model according to the above-mentioned comparison result and the above-mentioned selected sample value generation data; reselecting the sample value generation data from the above-mentioned sample value generation data set; and executing the above-mentioned training step again based on the updated initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model, as well as the reselected sample value generation data.
[0122] Optionally, the execution unit 501 can be further configured to adjust the parameters of the initial abnormal feature information generation model and the initial data abnormality recognition model corresponding to the initial abnormal feature recognition guidance information; encode the order information corresponding to the above-selected sample value generation data to obtain at least one order state vector; encode the initial abnormality recognition configuration information and the above-mentioned comparison result to obtain a metadata state vector; for each order state vector included in the above-mentioned at least one order state vector, concatenate the above-mentioned order state vector and the above-mentioned metadata state vector to obtain a target state vector; input the obtained target state vectors into a pre-trained update abnormality recognition configuration information generation model to obtain updated abnormality recognition configuration information; and update the initial abnormality recognition configuration information according to the above-mentioned updated abnormality recognition configuration information.
[0123] Optionally, the data anomaly identification model training device 500 may further include: a first acquisition unit, a parsing unit and a conversion unit (not shown in the figure). The first acquisition unit is configured to acquire a sample value generation data set as an initial sample value generation data set; the parsing unit is configured to parse each initial sample value generation data in the initial sample value generation data set; the conversion unit is configured to convert each parsed initial sample value generation data to obtain a sample value generation data set.
[0124] Optionally, the data anomaly recognition model training device 500 may further include: a second acquisition unit, a generation unit, and an update unit (not shown in the figure). The second acquisition unit is configured to acquire a feedback data anomaly information set corresponding to the above-mentioned anomaly feature information generation model and the above-mentioned data anomaly recognition model; the generation unit is configured to generate model evaluation information based on the above-mentioned feedback data anomaly information set; and the update unit is configured to update the above-mentioned anomaly feature information generation model and the above-mentioned data anomaly recognition model based on the above-mentioned model evaluation information.
[0125] It is understandable that the units recorded in the data anomaly recognition model training device 500 and the reference Figure 2 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 500 and the units included therein, and will not be described in detail here.
[0126] Further references Figure 6 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of a data anomaly identification device. These device embodiments are similar to Figure 4 Corresponding to the method embodiments shown, the device can be specifically applied to various electronic devices.
[0127] like Figure 6 As shown, the data anomaly identification device 600 of some embodiments includes: a first input unit 601 and a second input unit 602. The first input unit 601 is configured to input the value generation data into the abnormal feature information generation model corresponding to the abnormal feature identification guidance information to obtain the data abnormal feature information, wherein the abnormal feature identification guidance information and the abnormal feature information generation model are determined by the data anomaly identification model training method disclosed in the present invention; the second input unit 602 is configured to input the data abnormal feature information into the data anomaly identification model corresponding to the abnormal identification configuration information to obtain the data anomaly information, wherein the abnormal identification configuration information and the data anomaly identification model are determined by the data anomaly identification model training method disclosed in the present invention.
[0128] Optionally, the data anomaly identification device 600 may further include a display unit (not shown in the figure). The display unit is configured to control an associated display device to display the above data anomaly information.
[0129] It can be understood that the units recorded in the data anomaly identification device 600 are similar to those in the reference Figure 4 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the device 600 and the units included therein, and will not be described in detail here.
[0130] Reference below Figure 7 , which shows an electronic device 700 (eg, Figure 1 The electronic devices in some embodiments of the present disclosure may include but are not limited to mobile terminals such as mobile phones, notebook computers, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 7The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.
[0131] like Figure 7 As shown, the electronic device 700 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 701, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 702 or a program loaded from a storage device 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The processing device 701, the ROM 702, and the RAM 703 are connected to each other via a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.
[0132] Typically, the following devices may be connected to the I / O interface 705: an input device 706 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 707 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 708 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 709. The communication device 709 may allow the electronic device 700 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 7 The electronic device 700 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 7 Each block shown in the figure may represent one device, or may represent multiple devices as required.
[0133] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 709, or installed from the storage device 708, or installed from the ROM 702. When the computer program is executed by the processing device 701, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.
[0134] It should be noted that the computer-readable medium recorded in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with a boot information execution system, device or device. In some embodiments of the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with a boot information execution system, device or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.
[0135] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (Hyper Text Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.
[0136] The computer-readable medium may be included in the electronic device; or it may exist independently without being assembled into the electronic device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device: determines the initial abnormality identification configuration information and initial abnormality feature identification guidance information corresponding to the value generation business; based on the sample value generation data selected from the sample value generation data set, performs the following training steps: inputs the sample value generation data into the initial abnormality feature information generation model corresponding to the initial abnormality feature identification guidance information to obtain the sample data abnormality feature information, wherein the sample value generation data set corresponds to the value generation business; performs abnormality identification processing on the sample data abnormality feature information according to the initial data abnormality identification model corresponding to the initial abnormality identification configuration information to obtain the sample data abnormality information; compares the data abnormality label information corresponding to the sample value generation data with the sample data abnormality information to obtain a comparison result; in response to determining that the comparison result meets the training completion condition, the initial abnormality identification configuration information, the initial abnormality feature identification guidance information, the initial abnormality feature information generation model and the initial data abnormality identification model are respectively determined as the abnormality identification configuration information, the abnormality feature identification guidance information, the abnormality feature information generation model and the data abnormality identification model. Or enable the electronic device to: input the value generation data into the abnormal feature information generation model corresponding to the abnormal feature recognition guidance information to obtain data abnormal feature information, wherein the above-mentioned abnormal feature recognition guidance information and the above-mentioned abnormal feature information generation model are determined by the data abnormality recognition model training method disclosed in the present invention; input the above-mentioned data abnormality feature information into the data abnormality recognition model corresponding to the abnormal recognition configuration information to obtain data abnormality information, wherein the above-mentioned abnormal recognition configuration information and the above-mentioned data abnormality recognition model are determined by the data abnormality recognition model training method disclosed in the present invention.
[0137] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages or a combination thereof, including object-oriented programming languages such as Java, Smalltalk, C++, and conventional procedural programming languages such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).
[0138] The flowcharts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flowchart or block diagram can represent a module, a program segment, or a part of a code, and the module, program segment, or a part of the code contains one or more executable boot information for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flowchart, and the combination of boxes in the block diagram and / or flowchart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer boot information.
[0139] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The described units may also be provided in a processor, for example, may be described as: a processor includes a determination unit and an execution unit. Among them, the names of these units do not constitute a limitation on the unit itself in some cases, for example, the determination unit may also be described as a "unit for determining the initial abnormality identification configuration information and the initial abnormality feature identification guidance information of the corresponding value generating business".
[0140] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.
[0141] Some embodiments of the present disclosure further provide a computer program product, including a computer program, which implements any of the above-mentioned data anomaly recognition model training methods or data anomaly recognition methods when executed by a processor.
[0142] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.
Claims
1. A data anomaly recognition model training method, comprising: Determine the initial anomaly identification configuration information and initial anomaly feature identification guidance information corresponding to the value generation business; Based on the sample value generation data selected from the sample value generation dataset, perform the following training steps: Inputting the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature identification guidance information to obtain the sample data abnormal feature information, wherein the sample value generation data set corresponds to the value generation business; According to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information, anomaly recognition processing is performed on the sample data anomaly feature information to obtain sample data anomaly information; Compare the data anomaly label information of the data generated by the corresponding sample value with the sample data anomaly information to obtain a comparison result; In response to determining that the comparison result satisfies the training completion condition, the initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model are respectively determined as the abnormality recognition configuration information, the abnormality feature recognition guidance information, the abnormality feature information generation model and the data abnormality recognition model.
2. The method according to claim 1, wherein: The initial data anomaly recognition model includes a cause information generation sub-model and an anomaly type generation sub-model corresponding to the initial anomaly recognition configuration information; and the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information performs anomaly recognition processing on the sample data anomaly feature information to obtain sample data anomaly information, including: Inputting the sample data abnormal feature information into the abnormal type generation sub-model to obtain the sample data abnormal type; In response to determining that the sample data abnormality type meets a preset abnormality type condition, inputting the sample data abnormality feature information into a cause information generation sub-model to obtain sample abnormality cause information; The sample data abnormality type and the sample abnormality cause information are determined as sample data abnormality information.
3. The method according to claim 1, wherein: The initial data anomaly recognition model includes each anomaly type generation sub-model; and the initial data anomaly recognition model according to the corresponding initial anomaly recognition configuration information performs anomaly recognition processing on the sample data anomaly feature information to obtain sample data anomaly information, including: Determine each of the abnormality type generation sub-models corresponding to the initial abnormality identification configuration information in the abnormality type generation sub-models as each of the target abnormality type generation sub-models; Inputting the sample data abnormal feature information into each target abnormal type generation sub-model respectively to obtain a sample abnormality recognition result information set; The sample data anomaly type is determined based on the sample anomaly identification result information set.
4. The method according to claim 1, wherein: The training step also includes: In response to determining that the comparison result does not satisfy the training completion condition, performing the following steps: According to the comparison result and the selected sample value generation data, the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal recognition configuration information and the initial data abnormal recognition model are updated; Reselecting sample value generation data from the sample value generation data set; Based on the updated initial anomaly recognition configuration information, initial anomaly feature recognition guidance information, initial anomaly feature information generation model and initial data anomaly recognition model, and the re-selected sample value generation data, the training step is performed again.
5. The method according to claim 4, wherein: The generating data according to the comparison result and the selected sample value, updating the initial abnormal feature recognition guidance information, the initial abnormal feature information generation model, the initial abnormal recognition configuration information and the initial data abnormal recognition model, comprises: Perform parameter adjustment processing on the initial abnormal feature information generation model and the initial data abnormality recognition model corresponding to the initial abnormal feature recognition guidance information; Encoding each order information corresponding to the selected sample value generation data to obtain at least one order status vector; Encoding the initial abnormality identification configuration information and the comparison result to obtain a metadata state vector; For each order state vector included in the at least one order state vector, concatenate the order state vector and the metadata state vector to obtain a target state vector; Inputting each obtained target state vector into a pre-trained update anomaly identification configuration information generation model to obtain update anomaly identification configuration information; The initial abnormality identification configuration information is updated according to the updated abnormality identification configuration information.
6. The method according to claim 1, wherein: Before generating data based on each sample value obtained and performing the following training steps, the method further includes: Obtain a sample value generation data set as an initial sample value generation data set; Analyzing and processing each initial sample value generation data in the initial sample value generation data set; The parsed initial sample value generation data are converted to obtain a sample value generation data set.
7. The method according to any one of claims 1 to 6, wherein: The method further comprises: Acquire a feedback data anomaly information set corresponding to the anomaly feature information generation model and the data anomaly recognition model; Generate model evaluation information according to the feedback data abnormal information set; According to the model evaluation information, the abnormal feature information generation model and the data anomaly recognition model are updated.
8. A method for identifying data anomalies, comprising: Inputting the value generation data into an abnormal feature information generation model corresponding to the abnormal feature identification guidance information to obtain data abnormal feature information, wherein the abnormal feature identification guidance information and the abnormal feature information generation model are determined according to the data abnormality identification model training method according to any one of claims 1 to 7; The data anomaly feature information is input into a data anomaly recognition model corresponding to the anomaly recognition configuration information to obtain data anomaly information, wherein the anomaly recognition configuration information and the data anomaly recognition model are determined according to the data anomaly recognition model training method according to any one of claims 1-7.
9. The method according to claim 8, wherein: The method further comprises: Control the associated display device to display the data abnormality information.
10. A data anomaly recognition model training device, comprising: A determination unit configured to determine initial abnormality identification configuration information and initial abnormality feature identification guidance information corresponding to a value generation business; The execution unit is configured to perform the following training steps based on the sample value generation data selected from the sample value generation data set: Inputting the sample value generation data into the initial abnormal feature information generation model corresponding to the initial abnormal feature identification guidance information to obtain the sample data abnormal feature information, wherein the sample value generation data set corresponds to the value generation business; According to the initial data anomaly recognition model corresponding to the initial anomaly recognition configuration information, anomaly recognition processing is performed on the sample data anomaly feature information to obtain sample data anomaly information; Compare the data anomaly label information of the data generated by the corresponding sample value with the sample data anomaly information to obtain a comparison result; In response to determining that the comparison result satisfies the training completion condition, the initial abnormality recognition configuration information, the initial abnormality feature recognition guidance information, the initial abnormality feature information generation model and the initial data abnormality recognition model are respectively determined as the abnormality recognition configuration information, the abnormality feature recognition guidance information, the abnormality feature information generation model and the data abnormality recognition model.
11. A data anomaly identification device, comprising: A first input unit is configured to input the value generation data into an abnormal feature information generation model corresponding to the abnormal feature identification guidance information to obtain data abnormal feature information, wherein the abnormal feature identification guidance information and the abnormal feature information generation model are determined according to the data abnormality identification model training method according to any one of claims 1 to 7; The second input unit is configured to input the data anomaly feature information into a data anomaly recognition model corresponding to the anomaly recognition configuration information to obtain data anomaly information, wherein the anomaly recognition configuration information and the data anomaly recognition model are determined according to the data anomaly recognition model training method according to any one of claims 1-7.
12. An electronic device comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method as claimed in any one of claims 1-7 or 8-9.
13. A computer readable medium having a computer program stored thereon, wherein: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 or 8 to 9 is implemented.
14. A computer program product, comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1-7 or 8-9.
Citation Information
Cited By
Network communication encryption and authentication method and device based on power edge terminal
CN119834980A