Abnormal monitoring method, model training method and device, equipment and storage medium

Abstract

The invention provides an anomaly monitoring method, a model training method and device, equipment and a storage medium. The abnormity monitoring method is used for carrying out abnormity monitoring on a message and judging whether the message is abnormal or not. Specifically, after a to-be-judged target message is obtained, firstly, feature extraction can be performed on the target message according to a preset feature type; then, the features extracted from the target message can be input into a recurrent neural network (RNN) model, the features of the target message are analyzed through the RNN model, and an anomaly monitoring result of the target message is obtained. In this way, the specific feature is obtained from the target message according to the preset feature type for anomaly monitoring, and an accurate anomaly monitoring result can be obtained.

Description

Technical Field

[0001] The present application relates to the field of abnormality monitoring technology, and in particular to an abnormality monitoring method, a model training method, a device, a equipment and a storage medium. Background Art

[0002] Abnormal monitoring of network messages is an important part of ensuring the normal operation of business. In particular, for financial institutions such as banks, since money transactions are involved, if transaction messages are abnormal, it may cause economic losses to users. Therefore, abnormal monitoring of transaction messages is very important. It is necessary to detect abnormal transaction messages in a timely manner.

[0003] In some implementations, the transaction messages may be monitored for anomalies using artificial intelligence technology. Specifically, the model may be trained in advance using transaction messages with anomalies and transaction messages without anomalies. Through the training process, the model may learn the characteristics of messages with anomalies. After generating new transaction messages, the new transaction messages may be monitored for anomalies using the model. In this way, anomaly detection of messages may be achieved to a certain extent.

[0004] In the above process, it is necessary to extract features from the message and then identify based on the extracted features. However, in actual scenarios, transaction messages may be more complex, and multiple features may be extracted from the transaction messages, resulting in poor accuracy of anomaly monitoring. Summary of the invention

[0005] In view of this, the present application provides an anomaly monitoring method, a model training method, an apparatus, a device and a storage medium, aiming to accurately monitor anomalies of messages.

[0006] In a first aspect, the present application provides an abnormality monitoring method, the method comprising:

[0007] Get the target message;

[0008] Extracting features from the target message according to preset feature types to obtain multiple preset features of the target message, wherein the preset feature types are determined by analyzing the abnormal message based on a decision tree;

[0009] Multiple preset features of the target message are input into a recurrent neural network (RNN) model to obtain an abnormal monitoring result of the target message.

[0010] In some possible implementations, the preset feature type is obtained by analyzing the influence of the features of the message on the anomaly through a random forest FR algorithm, and the recurrent neural network RNN ​​model includes a bidirectional recurrent neural network BIRNN model.

[0011] In a second aspect, the present application provides a model training method, the method comprising:

[0012] Acquire multiple sample messages, where the multiple sample messages include multiple abnormal sample messages and multiple normal sample messages;

[0013] Determine multiple categories of original features of the sample message and candidate values ​​of each category of original features, each of the sample messages includes the multiple categories of original features;

[0014] Based on the multiple categories of original features, a feature decision tree is determined, wherein the branch nodes of the feature decision tree correspond to the original features one by one, and the number of branches of the branch nodes having a corresponding relationship is the same as the number of candidate values ​​of the original features;

[0015] Based on the feature decision tree, analyzing the influence of each of the original features on the abnormality of the message;

[0016] Based on the influence degree, determining a plurality of target features from the plurality of original features;

[0017] The target feature of each sample message is extracted, and a recurrent neural network (RNN) model is trained based on the abnormal feature of the target feature. The RNN model is used to perform abnormal monitoring on the message based on the target feature of the message.

[0018] In some possible implementations, the original feature includes a target original feature, the candidate value of the target original feature includes a target candidate value, and the analyzing, based on the feature decision tree, the degree of influence of each of the original features on the message anomaly includes:

[0019] Analyze the sample message set to determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature;

[0020] Based on the number of the normal sample messages and the number of the abnormal sample messages, the degree of influence of the target candidate value on the message abnormality is determined.

[0021] In a third aspect, the present application provides an abnormality monitoring device, the device comprising:

[0022] An acquisition unit, used for acquiring a target message;

[0023] A feature extraction unit, configured to extract features from the target message according to a preset feature type to obtain a plurality of preset features of the target message, wherein the preset feature type is determined by analyzing the abnormal message based on a decision tree;

[0024] The model monitoring unit is used to input multiple preset features of the target message into a recurrent neural network (RNN) model to obtain an abnormal monitoring result of the target message.

[0025] In some possible implementations, the preset feature type is obtained by analyzing the influence of the features of the message on the anomaly through a random forest FR algorithm, and the recurrent neural network RNN ​​model includes a bidirectional recurrent neural network BIRNN model.

[0026] In a fourth aspect, the present application provides a model training device, the device comprising:

[0027] An acquisition unit, configured to acquire a plurality of sample messages, wherein the plurality of sample messages include a plurality of abnormal sample messages and a plurality of normal sample messages;

[0028] A feature determination unit, configured to determine multiple types of original features of the sample message and candidate values ​​of each type of original features, each of the sample messages including the multiple types of original features;

[0029] A decision tree building unit, used to determine a feature decision tree based on the multiple types of original features, wherein the branch nodes of the feature decision tree correspond to the original features one by one, and the number of branches of the branch nodes with corresponding relationships is the same as the number of candidate values ​​of the original features;

[0030] An impact degree analysis unit, used for analyzing the impact degree of each of the original features on the abnormality of the message based on the feature decision tree;

[0031] A feature screening unit, configured to determine a plurality of target features from the plurality of original features based on the degree of influence;

[0032] The model training unit is used to extract the target features of each sample message and train a recurrent neural network (RNN) model based on the abnormal features of the target features. The RNN model is used to perform abnormal monitoring on the message based on the target features of the message.

[0033] In some possible implementations, the original feature includes a target original feature, the candidate value of the target original feature includes a target candidate value,

[0034] The impact degree analysis unit is specifically used to analyze the sample message set to determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; based on the number of normal sample messages and the number of abnormal sample messages, determine the degree of impact of the target candidate value on the message anomaly.

[0035] In a fifth aspect, the present application provides a device comprising a memory and a processor, wherein the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes, so that the device executes the abnormality monitoring method described in any one of the first aspects, or implements the model training method described in any one of the second aspects.

[0036] In a sixth aspect, the present application provides a computer storage medium storing a code. When the code is executed, the device executing the code implements the abnormality monitoring method described in any one of the first aspects, or implements the model training method described in any one of the second aspects.

[0037] In the seventh aspect, a computer program product comprising instructions is provided, which, when executed on a computer, enables the computer to execute the abnormality monitoring method described in any one of the first aspects, or implement the model training method described in any one of the second aspects.

[0038] The present application provides an abnormal monitoring method, a model training method, an apparatus, a device and a storage medium. Among them, the abnormal monitoring method is used to perform abnormal monitoring on a message and determine whether an abnormality occurs in the message. Specifically, after obtaining the target message to be judged, the target message can first be feature extracted according to the preset feature type. Then, the features extracted from the target message can be input into a recurrent neural network (RNN) model, and the features of the target message are analyzed by the RNN model to obtain the abnormal monitoring result of the target message. Among them, the preset feature type is determined by analyzing the message with abnormality based on the decision tree, and is the type of feature with the highest correlation with the abnormality among the multiple features of the target message. Therefore, based on the preset feature type, the target message is feature extracted, and multiple preset features with the highest correlation with the abnormality can be found from the target message. Because of the high correlation with the abnormality, compared with the non-preset features, the preset features can better reflect whether the target message is abnormal. In this way, according to the preset feature type, specific features are extracted from the target message for abnormal monitoring, and accurate abnormal monitoring results can be obtained. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0040] Figure 1 A schematic diagram of a flow chart of an abnormality monitoring method provided in an embodiment of the present application;

[0041] Figure 2 A schematic diagram of a flow chart of a model training method provided in an embodiment of the present application;

[0042] Figure 3 A schematic diagram of the structure of an abnormality monitoring device provided in an embodiment of the present application;

[0043] Figure 4 A structural schematic diagram of a model training device adopted in an embodiment of the present application. DETAILED DESCRIPTION

[0044] At present, artificial intelligence models such as neural network models can be used to monitor messages for anomalies. When an artificial intelligence model performs anomaly monitoring, it can extract features from messages and determine whether the messages are abnormal based on the features in the messages.

[0045] However, there are many types of messages, and even messages of the same type may have different formats. This results in messages having multiple types of features, and the same type of features may have multiple values. Messages with the same value may include normal messages and abnormal messages. In this way, due to the complexity of sample messages, the features extracted from sample messages are difficult to use for abnormal monitoring, resulting in the problem of inaccuracy in traditional abnormal monitoring methods.

[0046] In order to solve the above problems, the embodiments of the present application provide an abnormality monitoring method and a model training method. The model training method is used to determine the feature type to be extracted and train the corresponding model. The abnormality monitoring method can extract features according to the predetermined feature type and use the trained model to perform abnormality monitoring.

[0047] The anomaly monitoring method can be applied to an anomaly monitoring device. Optionally, the anomaly monitoring device can be run on a server, and specifically can be applied to a monitoring server of a processing cluster. The model training method can be applied to a server.

[0048] The following describes the abnormality monitoring method provided by the embodiment of the present application from the perspective of the abnormality monitoring device. Obviously, the described embodiment is only a part of the embodiment of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0049] See also Figure 1 , Figure 1 A method flow chart of an abnormality monitoring method provided in an embodiment of the present application includes:

[0050] S101: Obtain a target message.

[0051] In the embodiment of the present application, the message to be monitored may be referred to as a target message. Accordingly, the abnormality monitoring device may obtain the target message to be detected.

[0052] After the target message is acquired, the target message may be preprocessed before feature extraction, for example, the target message may be format converted, data cleansed, etc. In this way, target messages of different formats from different systems may be unified for subsequent processing.

[0053] S102: Extracting features of the target message according to preset feature types to obtain multiple preset features of the target message.

[0054] Before identification through the model, feature extraction can be performed on the target message. Specifically, in order to ensure the accuracy of abnormal monitoring, feature extraction can be performed according to preset feature types, thereby obtaining multiple preset features of the message.

[0055] Among them, the preset feature type is used to limit the type of preset features. The preset feature type is obtained by analyzing the abnormal message based on the decision tree. Based on the analysis of the decision tree, the feature with the highest correlation with the abnormality can be found from the various features of the message, so as to accurately monitor the abnormality. Optionally, in some implementations, the preset feature type can be determined based on the Random Forest algorithm. For an introduction to this part, please refer to the following, which will not be repeated here.

[0056] Among them, analysis based on a decision tree means mapping each type of feature of a message to a node in a tree structure, mapping the superior-subordinate relationship between features to the parent-child relationship of nodes in the tree structure, and mapping the specific value of the feature to the branch of the node. In this way, through the decision tree, features that are closely related to anomalies can be screened out from multiple features of the message, that is, preset feature types. In this way, feature extraction according to the preset feature type can find features that are strongly related to anomalies from the target message, so as to perform identification based on the preset features.

[0057] S103: Input multiple preset features of the target message into the RNN model to obtain an abnormal monitoring result of the target message.

[0058] After obtaining multiple preset features, the multiple preset features of the target message can be input into the RNN model. By analyzing the preset features of the target message through the RNN model, it can be determined whether the target message is abnormal.

[0059] Optionally, the RNN model used for anomaly monitoring can be a bidirectional RNN (Bi-directional RNN, BIRNN) model. The BIRNN model strengthens the architecture of the RNN model's ability to capture long-term dependencies when processing sequence data. In the BIRNN model, information flow is bidirectional. For any time step t, the BIRNN model can fuse the information of all time steps before and after the time step t to form a more comprehensive contextual understanding. In this way, the target message can be identified more comprehensively and the anomaly of the target message can be discovered more accurately.

[0060] The present application provides an abnormality monitoring method. First, it can be determined whether a message is abnormal. Specifically, after obtaining the target message to be judged, the target message can first be feature extracted according to the preset feature type. Then, the features extracted from the target message can be input into a recurrent neural network (RNN) model, and the features of the target message are analyzed by the RNN model to obtain the abnormality monitoring result of the target message. Among them, the preset feature type is determined by analyzing the message with abnormality based on the decision tree, and is the type of feature with the highest correlation with the abnormality among the multiple features of the target message. Therefore, based on the preset feature type, the target message is feature extracted, and multiple preset features with the highest correlation with the abnormality can be found from the target message. Because of the high correlation with the abnormality, compared with the non-preset features, the preset features can better reflect whether the target message is abnormal. In this way, according to the preset feature type, specific features are extracted from the target message for abnormal monitoring, and accurate abnormality monitoring results can be obtained.

[0061] Combine the following Figure 2 , the process of determining the preset feature type and training the RNN model is introduced.

[0062] See also Figure 2 , Figure 2 A method flow chart of a model training method provided in an embodiment of the present application includes:

[0063] S201: Acquire multiple sample messages.

[0064] In order to determine the preset feature type and train the RNN model, first, a plurality of sample messages for training can be obtained. Among them, the obtained plurality of sample messages may include a plurality of abnormal sample messages and a plurality of normal sample messages. The abnormal sample message refers to a message with an abnormality, and the normal sample message refers to a message without an abnormality.

[0065] Optionally, before determining the original features, the sample message may be preprocessed. For example, the sample message may be formatted uniformly, data cleansed, etc. Optionally, the sample message may be standardized, for example, the sample message may be organized into standardized fields. The standardized fields may include, for example, a message length field, an IP address field, a protocol type field, a message header field, a message time interval field, a transaction amount field, a transaction parties field, a transaction date field, and a postscript field.

[0066] Optionally, the sample abnormal message may correspond to different types of abnormalities or the same type of abnormalities. Optionally, an abnormality label may be added to the sample abnormal message. The abnormality label indicates the abnormality type of the sample abnormal message, for example, it may include abnormalities of the protocol abnormality, system internal abnormality, insufficient resource abnormality, security-related abnormality, performance abnormality, server abnormality, and client abnormality.

[0067] If the sample abnormal messages correspond to the same type of abnormalities, statistics can be performed based on the abnormalities of that type when the decision tree is established below. If the sample abnormal messages correspond to different types of abnormalities, statistics can be performed based on different types of abnormalities. For example, assuming that sample message A has type X abnormalities but does not have type Y abnormalities, then when establishing the decision tree, message A can be considered a normal message for type Y abnormalities.

[0068] S202: Determine multiple types of original features of the sample message and candidate values ​​for each type of original feature.

[0069] After obtaining a plurality of sample messages, feature extraction may be performed on the sample messages to determine multiple categories of original features of the sample messages and values ​​of each category of original features corresponding to the plurality of sample messages.

[0070] Among them, the original features are the features of the sample messages. A type of original features refers to features of the same type that exist in multiple sample messages. The values ​​of the same type of original features in different sample messages may be different. The candidate values ​​of the original features refer to the possible values ​​of the sample messages for a certain type of original features. In other words, assuming that feature extraction is performed on multiple sample messages, a total of 10,000 original features can be obtained. These 100 original features can be divided into 1,000 categories of original features. For a certain type of original features, if there are 50 possible values ​​in the sample messages, then the number of candidate values ​​for this type of original features is 50.

[0071] S203: Determine a feature decision tree based on multiple categories of original features.

[0072] After the original features and the candidate values ​​of the original features are determined, a feature decision tree can be established based on the original features so as to analyze the correlation between the features and the anomalies through the feature decision tree. The branch nodes of the feature decision tree correspond to the original features one by one, and the number of branches of the branch nodes with corresponding relationships is the same as the number of candidate values ​​of the original features.

[0073] In particular, for transaction business messages, since the messages themselves have a high correlation with business attributes, the importance of features can be analyzed through the tree model, in combination with the characteristic that the model outputs the importance ranking of features (such as the random forest model).

[0074] Specifically, when establishing a feature decision tree, each original feature can first be mapped to a node in the tree structure. In addition, the original features can be analyzed to analyze the dependencies between the original features, so as to determine the parent-child relationship of the nodes based on the dependencies. The number of branches corresponding to the node is determined according to the candidate values ​​of the feature. If there are k candidate values ​​for a certain original feature, then the original feature has k child nodes in the tree structure, and each child node corresponds to a candidate value of the original feature.

[0075] If the original feature A depends on the existence of the original feature B, then in the tree structure, the node of the original feature A is the child node of the node of the original feature B. Furthermore, if the original feature A exists in the sample message when the value of the original feature B is b1, then the node corresponding to the original feature A can be the child node on the branch corresponding to the candidate value b1. If the original feature B is b2, and the original feature B exists in the sample message, then the node corresponding to the original feature A can also be the child node on the branch corresponding to the candidate value b2.

[0076] Optionally, if there are multiple types of anomalies, different feature decision trees may be established based on different types of anomalies.

[0077] S204: Based on the feature decision tree, analyze the influence of each original feature on the abnormality of the message.

[0078] After the feature decision tree is established, the influence of the original feature on the abnormality of the message can be analyzed based on the feature decision tree. Specifically, the Gini coefficient of each node can be calculated separately. The Gini coefficient of the node is determined based on the normal sample message and the abnormal sample message in the sample message. The Gini coefficient of the node indicates the influence of each branch (i.e., candidate value) under the feature corresponding to the node on the abnormality.

[0079] Next, the importance of each candidate value in the feature decision tree can be calculated. Specifically, the change in the Gini coefficient before and after the branch can be calculated, and the importance of the branch can be expressed by the change. Next, the importance of the same feature in different feature decision trees and different branches can be summed up, and the result obtained is the degree of influence of the feature on the abnormality of the message.

[0080] Thus, through the above method, the influence degree of each feature on the abnormality of the message can be calculated respectively. Considering that the influence degree standards of different features may have deviations, the influence degrees can be normalized.

[0081] S205: Determine a plurality of target features from a plurality of original features based on the degree of influence.

[0082] After the influence degree of the original feature on the abnormality of the message is obtained, multiple target features can be determined from the multiple original features based on the influence degree. The type of the target feature is the aforementioned preset feature type.

[0083] Optionally, the top N original features with the highest influence among the multiple original features can be determined as target features. N is a positive integer and can be the number of pre-configured target features. Alternatively, original features with an influence greater than a preset threshold can be determined as target original features according to the influence. Alternatively, automatic selection of target features can be achieved by L1 regularization (such as Lasso regression).

[0084] S206: Extract target features of each sample message, and train the RNN model based on the abnormal features of the target features.

[0085] After the target features are determined, the RNN model can be trained based on the target features. Specifically, features can be extracted from each sample message according to the preset feature type, and the RNN model can be trained using the extracted features and the labels of the sample messages (including normal labels and abnormal labels). Optionally, the RNN model can be a BIRNN model.

[0086] exist Figure 2 In the implementation shown, for sample messages with a large number of original features and a large number of redundant features, the model is not trained directly using the features of the message, but the original features are first screened through the feature decision tree to select more important target features for training. In addition, when the model is actually used, feature extraction is also performed on the target message to be monitored according to the type of target feature. In this way, redundant features are filtered out through the feature decision tree, and only the features with higher value in the message are retained, thereby improving the accuracy of the model.

[0087] Optionally, in some possible implementations, the model can also be fine-tuned during the use of the model. Specifically, the monitoring results of the RNN model can be manually judged. If the monitoring results of the RNN model are found to be incorrect, the RNN model can be retrained using the correct monitoring results. In this way, by fine-tuning the RNN model, the accuracy of the model can be improved and anomaly monitoring can be better performed.

[0088] The above are some specific implementations of the abnormal monitoring method and model training method provided in the embodiments of the present application. Based on this, the present application also provides corresponding abnormal monitoring devices and model training devices. The abnormal monitoring device and model training device provided in the embodiments of the present application will be introduced from the perspective of functional modularization.

[0089] See also Figure 3 , Figure 3 A schematic diagram of a structure of an abnormality monitoring device provided in an embodiment of the present application. Specifically, Figure 3 The abnormality monitoring device 300 shown includes:

[0090] An acquisition unit 310 is used to acquire a target message;

[0091] A feature extraction unit 320 is used to extract features from the target message according to a preset feature type to obtain a plurality of preset features of the target message, wherein the preset feature type is determined by analyzing the abnormal message based on a decision tree;

[0092] The model monitoring unit 330 is used to input multiple preset features of the target message into a recurrent neural network RNN ​​model to obtain an abnormal monitoring result of the target message.

[0093] In some possible implementations, the preset feature type is obtained by analyzing the influence of the features of the message on the anomaly through a random forest FR algorithm, and the recurrent neural network RNN ​​model includes a bidirectional recurrent neural network BIRNN model.

[0094] See also Figure 4 , Figure 4 A schematic diagram of the structure of the model training device provided in the embodiment of the present application. Specifically, Figure 4 The model training device 400 shown includes:

[0095] An acquisition unit 410 is configured to acquire a plurality of sample messages, wherein the plurality of sample messages include a plurality of abnormal sample messages and a plurality of normal sample messages;

[0096] A feature determination unit 420, configured to determine multiple types of original features of the sample message and candidate values ​​of each type of original features, each of the sample messages including the multiple types of original features;

[0097] A decision tree building unit 430 is used to determine a feature decision tree based on the multiple types of original features, wherein the branch nodes of the feature decision tree correspond to the original features one by one, and the number of branches of the branch nodes with corresponding relationships is the same as the number of candidate values ​​of the original features;

[0098] An impact degree analysis unit 440 is used to analyze the impact degree of each of the original features on the abnormality of the message based on the feature decision tree;

[0099] A feature screening unit 450 is used to determine a plurality of target features from the plurality of original features based on the influence degree;

[0100] The model training unit 460 is used to extract the target features of each sample message and train a recurrent neural network (RNN) model based on the abnormal features of the target features. The RNN model is used to monitor the messages for abnormalities based on the target features of the messages.

[0101] In some possible implementations, the original feature includes a target original feature, and the candidate value of the target original feature includes a target candidate value. The impact degree analysis unit 440 is specifically used to analyze the sample message set, determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; based on the number of normal sample messages and the number of abnormal sample messages, determine the degree of influence of the target candidate value on the message anomaly.

[0102] The embodiments of the present application also provide corresponding devices, computer storage media and computer program products for implementing the technical solutions provided by the embodiments of the present application.

[0103] Among them, the device includes a memory and a processor, the memory is used to store instructions or codes, and the processor is used to execute the instructions or codes so that the device executes the abnormality monitoring method or model training method described in any embodiment of the present application.

[0104] The computer storage medium stores codes, and when the codes are executed, the device executing the codes implements the abnormality monitoring method or model training method described in any embodiment of the present application.

[0105] The computer program product includes instructions. When the instructions are executed on a computer, the computer is enabled to execute the abnormality monitoring method or model training method described in any embodiment of the present application.

[0106] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.

[0107] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0108] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0109] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An abnormality monitoring method, characterized in that: The method comprises: Get the target message; Extracting features from the target message according to preset feature types to obtain multiple preset features of the target message, wherein the preset feature types are determined by analyzing the abnormal message based on a decision tree; Multiple preset features of the target message are input into a recurrent neural network (RNN) model to obtain an abnormal monitoring result of the target message.

2. The method according to claim 1, characterized in that The preset feature type is obtained by analyzing the influence of the features of the message on the anomaly through the random forest FR algorithm, and the recurrent neural network RNN ​​model includes a bidirectional recurrent neural network BIRNN model.

3. A model training method, characterized in that: The method comprises: Acquire multiple sample messages, where the multiple sample messages include multiple abnormal sample messages and multiple normal sample messages; Determine multiple categories of original features of the sample message and candidate values ​​of each category of original features, each of the sample messages includes the multiple categories of original features; Based on the multiple categories of original features, a feature decision tree is determined, wherein the branch nodes of the feature decision tree correspond to the original features one by one, and the number of branches of the branch nodes having a corresponding relationship is the same as the number of candidate values ​​of the original features; Based on the feature decision tree, analyzing the influence of each of the original features on the abnormality of the message; Based on the influence degree, determining a plurality of target features from the plurality of original features; The target feature of each sample message is extracted, and a recurrent neural network (RNN) model is trained based on the abnormal feature of the target feature. The RNN model is used to perform abnormal monitoring on the message based on the target feature of the message.

4. The method according to claim 3, characterized in that: The original feature includes a target original feature, the candidate value of the target original feature includes a target candidate value, and the analyzing, based on the feature decision tree, the influence of each original feature on the message anomaly includes: Analyze the sample message set to determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; Based on the number of the normal sample messages and the number of the abnormal sample messages, the degree of influence of the target candidate value on the message abnormality is determined.

5. An abnormality monitoring device, characterized in that: The device comprises: An acquisition unit, used for acquiring a target message; A feature extraction unit, configured to extract features from the target message according to a preset feature type to obtain a plurality of preset features of the target message, wherein the preset feature type is determined by analyzing the abnormal message based on a decision tree; The model monitoring unit is used to input multiple preset features of the target message into a recurrent neural network (RNN) model to obtain an abnormal monitoring result of the target message.

6. The device according to claim 5, characterized in that The preset feature type is obtained by analyzing the influence of the features of the message on the anomaly through the random forest FR algorithm, and the recurrent neural network RNN ​​model includes a bidirectional recurrent neural network BIRNN model.

7. A model training device, characterized in that: The device comprises: An acquisition unit, configured to acquire a plurality of sample messages, wherein the plurality of sample messages include a plurality of abnormal sample messages and a plurality of normal sample messages; A feature determination unit, configured to determine multiple types of original features of the sample message and candidate values ​​of each type of original features, each of the sample messages including the multiple types of original features; A decision tree building unit, used to determine a feature decision tree based on the multiple types of original features, wherein the branch nodes of the feature decision tree correspond to the original features one by one, and the number of branches of the branch nodes with corresponding relationships is the same as the number of candidate values ​​of the original features; An impact degree analysis unit, used for analyzing the impact degree of each of the original features on the abnormality of the message based on the feature decision tree; A feature screening unit, configured to determine a plurality of target features from the plurality of original features based on the degree of influence; The model training unit is used to extract the target features of each sample message and train a recurrent neural network (RNN) model based on the abnormal features of the target features. The RNN model is used to perform abnormal monitoring on the message based on the target features of the message.

8. The device according to claim 7, characterized in that The original feature includes a target original feature, and the candidate values ​​of the target original feature include a target candidate value. The impact degree analysis unit is specifically used to analyze the sample message set to determine the number of normal sample messages and the number of abnormal sample messages corresponding to each candidate value of the target original feature; Based on the number of the normal sample messages and the number of the abnormal sample messages, the degree of influence of the target candidate value on the message abnormality is determined.

9. A device, characterized in that: The device includes a memory and a controller, the memory is used to store instructions or codes, and the controller is used to execute the instructions or codes stored in the memory to implement the method according to any one of claims 1 to 4.

10. A computer storage medium, characterized in that: The computer storage medium stores codes, and when the codes are executed, a device executing the codes implements the method according to any one of claims 1 to 4.

Images