Data processing method and device, storage medium and electronic equipment

Abstract

The invention discloses a data processing method and device, a storage medium and electronic equipment. The method comprises the following steps: acquiring time sequence data; performing vectorization operation on the time sequence data to obtain an initial input vector, and splicing the initial input vector and the memory mark vector to obtain a target input vector; the target input vector is input into an anomaly detection model to obtain a target detection result, the target detection result is used for indicating whether the time sequence data is abnormal data, and the anomaly detection model comprises a first feed-forward module, a multi-head self-attention module, a convolution module and a second feed-forward module which are arranged in series, the multi-head self-attention module is used for capturing the global correlation of the time series data based on the global information, and the convolution module is used for capturing the local correlation of the time series data based on the local information. According to the method and the device, the technical problem of relatively low data processing accuracy caused by insufficient capture of local dependency and long-range dependency relationships in a data processing process of an existing anomaly detection model is solved.

Description

Technical Field

[0001] The present application relates to the field of computers, and in particular to a data processing method and device, a storage medium, and an electronic device. Background Art

[0002] At present, due to the difficulty of existing deep learning models in accurately distinguishing and memorizing key local patterns and long-range dependencies in data sequences, the performance of the models in abnormal data detection tasks is poor and their recognition accuracy is not high. For example, when abnormal data is embedded in the context of a long sequence, existing models are often unable to accurately capture the subtle features of abnormal patterns, thereby affecting the accuracy and response speed of data security monitoring. Therefore, there is a technical problem in related technologies that the existing anomaly detection models do not capture local dependencies and long-range dependencies sufficiently during data processing, resulting in low data processing accuracy.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a data processing method and device, a storage medium and an electronic device to at least solve the technical problem that the existing anomaly detection model does not capture local dependencies and long-range dependencies during data processing, resulting in low data processing accuracy.

[0005] According to one aspect of an embodiment of the present application, a data processing method is provided, including: acquiring time series data, wherein the time series data is used to represent the operating status of a target device within a preset time period; performing a vectorization operation on the time series data to obtain an initial input vector, concatenating the initial input vector and a memory tag vector to obtain a target input vector, wherein the memory tag vector is used to store local information and global information of the time series data; inputting the target input vector into an anomaly detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the time series data is abnormal data, and the anomaly detection model includes a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module arranged in series, the multi-head self-attention module is used to capture the global correlation in the time series data based on the global information, and the convolution module is used to capture the local correlation in the time series data based on the local information.

[0006] According to another aspect of an embodiment of the present application, a data processing device is also provided, including: an acquisition module, used to acquire time series data, wherein the time series data is used to represent the operating status of a target device within a preset time period; a splicing module, used to perform a vectorization operation on the time series data to obtain an initial input vector, splice the initial input vector and a memory tag vector to obtain a target input vector, wherein the memory tag vector is used to store local information and global information of the time series data; a processing module, used to input the target input vector into an anomaly detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the time series data is abnormal data, and the anomaly detection model includes a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module arranged in series, the multi-head self-attention module is used to capture the global correlation in the time series data based on the global information, and the convolution module is used to capture the local correlation in the time series data based on the local information.

[0007] Optionally, the device is used to input the target input vector into an anomaly detection model in the following manner to obtain a target detection result: input the target input vector into the anomaly detection model, and the first feedforward module performs an input conversion operation on the target input vector to obtain a first intermediate vector, wherein the first intermediate vector represents the target input vector after linear mapping and nonlinear transformation; uses the multi-head self-attention module to perform an attention aggregation operation on the first intermediate vector to obtain a second intermediate vector, wherein the second intermediate vector represents the first intermediate vector after global dependency modeling; uses the convolution module to perform a local feature extraction operation on the second intermediate vector to obtain a third intermediate vector, wherein the third intermediate vector represents the second intermediate vector after local dependency modeling of relative position; uses the second feedforward module to perform an output conversion operation on the third intermediate vector to obtain the target detection result.

[0008] Optionally, the device is used to input the target input vector into the anomaly detection model in the following manner, and the first feedforward module performs an input conversion operation on the target input vector to obtain a first intermediate vector: performs a layer normalization operation on the target input vector to obtain a first input feedforward sub-result; performs a linear mapping operation on the first input feedforward sub-result through the input linear layer and input activation function in the first feedforward module to obtain a regularized second input feedforward sub-result; performs a linear conversion operation on the second input feedforward sub-result through the output linear layer in the first feedforward module to obtain a first intermediate vector.

[0009] Optionally, the device is used to perform an attention aggregation operation on the first intermediate vector using the multi-head self-attention module to obtain a second intermediate vector in the following manner: position-encode the first intermediate vector using relative sinusoidal position coding to obtain a first aggregated sub-result; perform a layer normalization operation on the first aggregated sub-result to obtain a regularized second intermediate vector.

[0010] Optionally, the device is used to perform a local feature extraction operation on the second intermediate vector using the convolution module in the following manner to obtain a third intermediate vector: perform a layer normalization operation on the second intermediate vector to obtain a first local vector; perform a point convolution operation, a convolution activation function processing, and a one-dimensional depth convolution operation on the first local vector in sequence to obtain a second local vector; perform a batch normalization operation on the second local vector to obtain a third local vector; perform the point convolution operation on the third local vector to obtain the regularized third intermediate vector.

[0011] Optionally, the device is used to perform an output conversion operation on the third intermediate vector using the second feedforward module in the following manner to obtain the target detection result: perform a layer normalization operation on the third intermediate vector to obtain a first output feedforward sub-result; perform a linear mapping operation on the first output feedforward sub-result through the input linear layer and input activation function in the first feedforward module to obtain a regularized second output feedforward sub-result; perform a linear conversion operation on the second output feedforward sub-result through the output linear layer in the first feedforward module to obtain a regularized third output feedforward sub-result; and process the third output feedforward sub-result using the output feedforward activation function to obtain the target detection result.

[0012] Optionally, the device is used to perform a vectorization operation on the time series data in the following manner to obtain an initial input vector, concatenate the initial input vector and a memory tag vector, and obtain a target input vector: obtain the sequence length of the initial input vector and the initial memory tag vector, wherein the sequence length of the initial memory tag vector is the same as the sequence length; adjust the sequence length of the initial memory tag vector based on the data resources and data volume of the time series data to obtain the memory tag vector.

[0013] According to another aspect of the embodiments of the present application, a computer-readable storage medium is provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned data processing method when running.

[0014] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the above data processing method.

[0015] According to another aspect of the embodiments of the present application, there is further provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the data processing method through the computer program.

[0016] In an embodiment of the present application, by introducing trainable memory markers into the anomaly detection model and combining convolutional neural networks with a multi-head self-attention mechanism, the purpose of efficiently and accurately processing local and global dependencies in time series data is achieved, which not only optimizes the anomaly detection model's understanding and reasoning capabilities of complex contexts, but also enhances its sensitivity to local and long-range abnormal patterns; thereby, achieving the technical effect of significantly improving the accuracy and response speed of abnormal data detection, and further solving the technical problem of low data processing accuracy due to insufficient capture of local dependencies and long-range dependencies by existing anomaly detection models during data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0018] Figure 1 is a schematic diagram of an application environment of an optional data processing method according to an embodiment of the present application;

[0019] Figure 2 is a flowchart of an optional data processing method according to an embodiment of the present application;

[0020] Figure 3 is a schematic diagram of a model architecture of an optional data processing method according to an embodiment of the present application;

[0021] Figure 4 is a schematic diagram of a feedforward module of another optional data processing method according to an embodiment of the present application;

[0022] Figure 5 is a schematic diagram of a multi-head self-attention module according to another optional data processing method of an embodiment of the present application;

[0023] Figure 6is a schematic diagram of a convolution module of an optional data processing method according to an embodiment of the present application;

[0024] Figure 7 is a schematic structural diagram of an optional data processing device according to an embodiment of the present application;

[0025] Figure 8 is a schematic diagram of the structure of an optional data processing product according to an embodiment of the present application;

[0026] Fig. 9 It is a schematic diagram of the structure of an optional electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] The present application is described below in conjunction with embodiments:

[0030] According to one aspect of an embodiment of the present application, a data processing method is provided. Optionally, in this embodiment, the data processing method can be applied to Figure 1 In the hardware environment composed of the server 101 and the terminal device 103 shown in FIG. Figure 1As shown, the server 101 is connected to the terminal 103 via a network, and can be used to provide services for the terminal device or an application 107 installed on the terminal device. The application can be a video application, an instant messaging application, a browser application, an educational application, a game application, etc. A database 105 may be set up on the server or independently of the server to provide data storage services for the server 101, for example, a game data storage server. The above-mentioned network may include, but is not limited to, a wired network and a wireless network, wherein the wired network includes, for example, a local area network, a metropolitan area network, and a wide area network; the wireless network includes, for example, Bluetooth, WIFI, and other networks that implement wireless communication; the terminal device 103 may be a terminal configured with an application program, and may include, but is not limited to, at least one of the following: a mobile phone (such as an Android phone, an iOS phone, etc.), a laptop computer, a tablet computer, a PDA, a MID (Mobile Internet Devices), a PAD, a desktop computer, a smart TV, an intelligent voice interaction device, a smart home appliance, a vehicle-mounted terminal, an aircraft, a virtual reality (VR) terminal, an augmented reality (AR) terminal, a mixed reality (MR) terminal, and other computer devices; the above-mentioned server may be a single server, a server cluster consisting of multiple servers, or a cloud server.

[0031] Combination Figure 1 As shown, the above data processing method can be executed by an electronic device, which can be a terminal device or a server. The above data processing method can be implemented by the terminal device or the server respectively, or by the terminal device and the server together.

[0032] The above is only an example and is not specifically limited in this embodiment.

[0033] Optionally, as an optional implementation, as Figure 2 As shown, the above data processing method includes:

[0034] S202, acquiring time series data, wherein the time series data is used to represent the operating status of the target device within a preset time period;

[0035] Optionally, in an embodiment of the present application, acquiring time series data refers to collecting and processing continuous status records of the above-mentioned target device within a preset time period, and the above-mentioned time series data can reflect the dynamic characteristics of the operation of the target device.

[0036] Specifically, taking the target device as an aircraft as an example, the time series data includes but is not limited to the periodic broadcast information of the target device, such as the flight status data in the ADS-B (Automatic Dependent Surveillance-Broadcast) system. The time series data contains key parameters such as the aircraft's latitude and longitude, altitude, speed, etc., which change continuously over time and are used to monitor the flight status in real time.

[0037] Exemplarily, first, the ADS-B (Automatic Dependent Surveillance-Broadcast) system collects time series data of the target device within a preset time period in real time. The time series data can come from a variety of sensors or information sources, such as aircraft position and speed information in the ADS-B system.

[0038] S204, performing a vectorization operation on the time series data to obtain an initial input vector, concatenating the initial input vector and the memory tag vector to obtain a target input vector, wherein the memory tag vector is used to store local information and global information of the time series data;

[0039] Optionally, in an embodiment of the present application, performing a vectorization operation on time series data refers to converting the original time series data that may contain multiple types and formats into the form of a numerical vector for processing and analysis by a machine learning model. The above-mentioned initial input vector includes but is not limited to quantizing and encoding various parameters in the time series data, such as longitude and latitude, altitude, speed, etc., to form a vector format that can be input into the model; and the above-mentioned concatenation of the initial input vector and the memory tag vector to obtain the target input vector means adding a specific memory tag "[mem]" to the initial input vector representation, which is used to store and enhance the model's understanding and memory ability of the local features and global dependencies of the time series data, that is, the above-mentioned memory tag vector includes a certain number of memory tags "[mem]".

[0040] Exemplarily, first, the original time series data is an ADS-B message, which is converted into an initial input vector after preprocessing and vectorization; then, in order to enhance the model's capture of historical information and contextual dependencies, the initial input vector is concatenated with a predefined memory tag vector to form a target input vector.

[0041] It can be understood that the addition of the above-mentioned memory tag vector is equivalent to providing an auxiliary memory mechanism for the model, allowing the model to store and retrieve local and global information in time series data, so that when processing long sequence data, it can more effectively overcome the problem of information ambiguity and improve the performance of anomaly detection. Furthermore, through this vectorization operation and splicing strategy, the anomaly detection model can perform anomaly detection in a more refined data representation form, ensuring the accurate identification of potential anomalies in time series data.

[0042] S206, input the target input vector into the anomaly detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the time series data is abnormal data, and the anomaly detection model includes a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module arranged in series, the multi-head self-attention module is used to capture the global correlation in the time series data based on global information, and the convolution module is used to capture the local correlation in the time series data based on local information.

[0043] Optionally, in an embodiment of the present application, the above-mentioned anomaly detection model may include but is not limited to an end-to-end unsupervised deep learning model, such as a Transformer model, etc. The above-mentioned target detection results include but are not limited to the anomaly probability or anomaly classification output by the above-mentioned anomaly detection model, which is used to determine whether there is an anomaly in the time series data. The architecture of the anomaly detection model includes multiple modules arranged in series, specifically, a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module; the first feedforward module, the multi-head self-attention module, the convolution module and the second feedforward module can work together to achieve a comprehensive analysis of the time series data.

[0044] Exemplarily, the initial input vector is fed into the above-mentioned anomaly detection model together with the memory tag vector. The anomaly detection model first processes the input through the first feedforward module. Subsequently, the multi-head self-attention module captures the long-range dependencies in the time series data based on global information, so that the anomaly detection model can understand the complex associations between the data; then, the convolution module captures the short-term changes and local correlations in the time series data based on local information, ensuring the sensitivity of the anomaly detection model to local features; finally, after further processing by the second feedforward module, the anomaly detection model generates the final output, i.e., the target detection result, which is used to indicate whether the time series data contains abnormal data.

[0045] In an exemplary embodiment, Figure 3 : is a schematic diagram of a model architecture of an optional data processing method according to an embodiment of the present application, wherein the ADS-B abnormal data detection model based on the convolution enhanced memory Transformer is as follows: Figure 3 As shown in the figure, taking the application scenario of flight data anomaly detection in the ADS-B system as an example, when the aircraft continuously broadcasts its flight status information during flight, this information is collected and forms time series data:

[0046] The target input vector x becomes the memory tag vector x mem and the original ADS-B input tag vector x seq Concatenation of (the above initial input vector):

[0047] x=[x mem ;xseq ]∈R (n+m)×d ,x mem ∈R m×d ,x seq ∈R n×d ;

[0048] Where R represents the real vector space, n represents the length of the original input ADS-B sequence, m represents the number of special [mem] tags added to the front of the input sequence, and d represents the dimension of the vector.

[0049] After the data is vectorized, it is concatenated with the memory tag vector to form a target input vector. This target input vector is then fed into the anomaly detection model, which analyzes the local and global dependencies in the data through the first feedforward module, the self-attention module and the convolution module, and the second feedforward module in series, and finally generates a target detection result, indicating whether there are anomalies in the broadcasted flight data, such as sudden irregular changes in the aircraft's position, altitude or speed.

[0050] It should be noted that although the example uses flight data anomaly detection as the main application background, this technical solution is also applicable to other types of time series anomaly detection, such as equipment operation status monitoring, financial transaction anomaly identification, etc. As long as the time series data can reflect the operation status of the target equipment and the anomaly detection model can effectively identify the abnormal patterns in these data, this application does not limit this, that is, it is not limited to specific application scenarios or data types. The module design and processing flow of the anomaly detection model can be adjusted and optimized accordingly according to the characteristics of different time series data to meet the needs of various anomaly detection.

[0051] Through the embodiments of the present application, by introducing trainable memory markers into the anomaly detection model and combining convolutional neural networks with a multi-head self-attention mechanism, the purpose of efficiently and accurately processing local and global dependencies in time series data is achieved, which not only optimizes the anomaly detection model's understanding and reasoning capabilities of complex contexts, but also enhances its sensitivity to local and long-range abnormal patterns; thereby, achieving the technical effect of significantly improving the accuracy and response speed of abnormal data detection, and further solving the technical problem of low data processing accuracy due to insufficient capture of local dependencies and long-range dependencies by existing anomaly detection models during data processing.

[0052] As an optional solution, the target input vector is input into the anomaly detection model to obtain the target detection result, including: inputting the target input vector into the anomaly detection model, performing an input conversion operation on the target input vector by a first feedforward module to obtain a first intermediate vector, wherein the first intermediate vector represents the target input vector after linear mapping and nonlinear transformation; performing an attention aggregation operation on the first intermediate vector by a multi-head self-attention module to obtain a second intermediate vector, wherein the second intermediate vector represents the first intermediate vector after global dependency modeling; performing a local feature extraction operation on the second intermediate vector by a convolution module to obtain a third intermediate vector, wherein the third intermediate vector represents the second intermediate vector after local dependency modeling of relative position; performing an output conversion operation on the third intermediate vector by a second feedforward module to obtain the target detection result.

[0053] Optionally, in an embodiment of the present application, the above-mentioned input conversion operation refers to adjusting the representation of the target input vector through linear mapping and nonlinear transformation to adapt to the processing requirements of subsequent modules, including but not limited to using Swish activation function and layer normalization to enhance the training stability of the model and the representation ability of the output features; the attention aggregation operation of the above-mentioned multi-head self-attention module is based on global information, and the elements in the first intermediate vector are weighted summed to capture the long-range dependencies of the time series data, including but not limited to using a multi-head mechanism for parallel computing to improve the processing efficiency of the anomaly detection model and the ability to capture global features; the local feature extraction operation of the above-mentioned convolution module models the local time correlation represented in the second intermediate vector through one-dimensional convolution and gating mechanism, including but not limited to using deep separable convolution to reduce computational complexity while maintaining sensitivity to local dependencies; the output conversion operation of the above-mentioned second feedforward module is to further linearly map and nonlinearly transform the third intermediate vector after processing by the convolution module to generate the final output of the model, including but not limited to applying a normalization layer to ensure the stability of the output, and using an appropriate activation function to produce target detection results.

[0054] Exemplarily, the target input vector is first fed into the first feedforward module, and a first intermediate vector is formed through linear mapping and nonlinear transformation, thereby adjusting the feature representation of the target input vector to make it more suitable for subsequent processing; subsequently, the multi-head self-attention module performs attention aggregation on the first intermediate vector, and generates a second intermediate vector through modeling of global dependencies, thereby enhancing the model's understanding of long-range dependencies in time series data; the convolution module then performs local feature extraction on the second intermediate vector, and obtains a third intermediate vector through modeling of local dependencies of relative positions, thereby ensuring that the model can accurately capture short-term changes and local anomalies; finally, the third intermediate vector generates a target detection result through the output conversion operation of the second feedforward module, indicating whether the time series data contains anomalies.

[0055] In an exemplary embodiment, taking the abnormal detection of aircraft operation status in the ADS-B system as an example, when the ADS-B data continuously broadcast during the flight of the aircraft is converted into a vector form and concatenated with memory tags, the target input vector formed will be fed into the abnormal detection model. The first feedforward module of the model first performs the input conversion operation and adjusts the data representation. Then the multi-head self-attention module performs global dependency modeling on the converted data, and the convolution module focuses on local feature extraction. Finally, the second feedforward module generates the final target detection result, which is used to indicate whether there is abnormal behavior in the aircraft operation status data, such as sudden heading or altitude changes.

[0056] It should be noted that although the embodiments of the present application describe the typical steps of the model processing time series data, in actual applications, the parameter settings of each module of the above-mentioned anomaly detection model, the selection of activation functions, the implementation details of the attention mechanism, etc. may vary due to specific tasks and data characteristics. This application does not limit this, that is, it allows appropriate adjustments and optimizations to the model architecture and processing flow without changing the basic principles.

[0057] Through the embodiments of the present application, a first feedforward, self-attention, convolution module and a second feedforward module in a serial combination are used to achieve the technical effect of effectively capturing local and global dependencies in time series data, thereby achieving the purpose of improving the accuracy and response speed of anomaly detection.

[0058] As an optional scheme, the target input vector is input into the anomaly detection model, and the first feedforward module performs an input conversion operation on the target input vector to obtain a first intermediate vector, including: performing a layer normalization operation on the target input vector to obtain a first input feedforward sub-result; performing a linear mapping operation on the first input feedforward sub-result through the input linear layer and the input activation function in the first feedforward module to obtain a regularized second input feedforward sub-result; performing a linear conversion operation on the second input feedforward sub-result through the output linear layer in the first feedforward module to obtain a first intermediate vector.

[0059] Optionally, in an embodiment of the present application, the above-mentioned layer normalization operation refers to adjusting the mean and variance of the above-mentioned target input vector to ensure that each feature of the target input vector is in a similar numerical range, thereby optimizing model learning, including but not limited to using layer normalization technology to stabilize the model training process, and the above-mentioned linear mapping operation refers to processing the normalized first input feedforward sub-result through linear transformation and nonlinear activation function to extract more complex feature representations, including but not limited to using Swish activation function to enhance the nonlinear expression ability of the model; the above-mentioned linear conversion operation includes but is not limited to mapping the second input feedforward sub-result that has undergone nonlinear transformation to a new feature space again, thereby obtaining a first intermediate vector that combines linear and nonlinear features.

[0060] For example, Figure 4 is a schematic diagram of a feedforward module of another optional data processing method according to an embodiment of the present application, wherein the first feedforward module is as follows Figure 4 As shown, the target input vector is first sent to the layer normalization layer, and after data normalization processing, the first input feedforward sub-result is obtained. Subsequently, the input linear layer and input activation function in the first feedforward module perform linear mapping and nonlinear transformation on the first input feedforward sub-result to generate a regularized second input feedforward sub-result. Finally, the second input feedforward sub-result is mapped to the new feature space through the linear transformation operation of the output linear layer to form the first intermediate vector, which contains richer and more complex feature representations, which is convenient for subsequent model processing.

[0061] In an exemplary embodiment, the target input vector is represented as x, which is processed by the first feedforward module to output a first intermediate vector for:

[0062]

[0063] Among them, FFN refers to the feed-forward module.

[0064] It should be noted that in actual applications, the specific parameters and implementation details of layer normalization, linear mapping, nonlinear transformation and linear conversion may vary due to data characteristics and model requirements, such as the choice of activation function, weight initialization of linear layer, etc. This application does not limit this, that is, it allows adjustments according to actual conditions during model design and implementation.

[0065] Through the embodiments of the present application, a combination of layer normalization, linear mapping and nonlinear transformation is adopted to achieve effective preprocessing of the target input vector, ensure the stability of the anomaly detection model in processing the target input vector, and achieve the purpose of improving the model learning efficiency and anomaly detection accuracy.

[0066] As an optional scheme, a multi-head self-attention module is used to perform an attention aggregation operation on the first intermediate vector to obtain a second intermediate vector, including: using relative sinusoidal position coding to perform position encoding on the first intermediate vector to obtain a first aggregated sub-result; performing a layer normalization operation on the first aggregated sub-result to obtain a regularized second intermediate vector.

[0067] Optionally, in an embodiment of the present application, the above-mentioned position encoding of the first intermediate vector using relative sine position encoding refers to adding position information to the above-mentioned first intermediate vector through sine and cosine functions to ensure that the anomaly detection model can distinguish the relative positions of elements in the sequence, including but not limited to adopting the relative position encoding strategy proposed in Transformer-XL to enhance the model's adaptability to changes in the length of the input sequence; the above-mentioned layer normalization operation on the first aggregated sub-result refers to standardizing the output through layer normalization technology after attention aggregation to ensure the stability of the model output, including but not limited to applying a layer normalization layer to adjust the mean and variance of the output so that the features are at the same scale, which is conducive to the processing of subsequent modules.

[0068] For example, Figure 5 is a schematic diagram of a multi-head self-attention module according to another optional data processing method according to an embodiment of the present application. The multi-head self-attention module is as follows Figure 5 As shown, the first intermediate vector is firstly added with position information through relative sinusoidal position coding to obtain the first aggregate sub-result, thereby realizing clear marking of the relative positions of elements in the time series data; then, a layer normalization operation is performed on the first aggregate sub-result, and the regularized second intermediate vector is obtained through standardization processing.

[0069] In an exemplary embodiment, the first intermediate vector is represented as x~, and after being processed by the multi-head self-attention module, the output second intermediate vector is:

[0070] x′=x~+MHSA(x~)

[0071] Among them, MHSA refers to the Multi-Head Self-Attention Module.

[0072] It should be noted that in practical applications, the specific implementation of the above-mentioned relative sinusoidal position coding parameters and layer normalization may be adjusted according to different time series data characteristics, such as the coding frequency, amplitude, etc., as well as the parameter setting of the normalization layer. This application does not limit this.

[0073] Through the embodiments of the present application, a combination of relative sinusoidal position encoding and layer normalization technology is adopted to achieve clear labeling of element position information in time series data and standardization of output features, thereby achieving the purpose of improving the anomaly detection model's ability to capture time dependencies and output stability, thereby enhancing the accuracy and reliability of detecting abnormal data.

[0074] As an optional scheme, a convolution module is used to perform a local feature extraction operation on the second intermediate vector to obtain a third intermediate vector, including: performing a layer normalization operation on the second intermediate vector to obtain a first local vector; performing a point convolution operation, a convolution activation function processing, and a one-dimensional depth convolution operation on the first local vector in sequence to obtain a second local vector; performing a batch normalization operation on the second local vector to obtain a third local vector; performing a point convolution operation on the third local vector to obtain a regularized third intermediate vector.

[0075] Optionally, in an embodiment of the present application, after the point convolution operation, the first local vector is further nonlinearly transformed through convolution activation function processing, including but not limited to using a gated linear unit (GLU) activation function to enhance the expression of local features. The one-dimensional deep convolution operation performs deep feature extraction on the first local vector, including but not limited to using a deep separable convolution technique to reduce computational complexity while maintaining sensitivity to local dependencies on time series data to generate the second local vector. The batch normalization operation adjusts the eigenvalues ​​of the second local vector to stabilize the training process, including but not limited to applying batch normalization immediately after the convolution operation to ensure that the second local vector has good statistical properties before entering the next processing stage to obtain the third local vector. Finally, the point convolution operation is applied again to the third local vector to complete the final linear mapping to obtain the regularized third intermediate vector.

[0076] For example, Figure 6 is a schematic diagram of a convolution module of another optional data processing method according to an embodiment of the present application, wherein the convolution module is as follows: Figure 6 As shown in the figure, the second intermediate vector is processed by layer normalization to obtain the first local vector, ensuring the stability and comparability of the second intermediate vector in the convolution module. Subsequently, the first local vector is processed by point convolution operation and convolution activation function to effectively extract the local features of the second intermediate vector, and further enhance the ability to capture short-term patterns in time series data through one-dimensional deep convolution operation to generate the second local vector. The batch normalization operation is then applied to the second local vector to stabilize the training process by adjusting the feature values ​​to obtain the third local vector. Finally, the third local vector is once again subjected to the point convolution operation to complete the final adjustment and regularization of the features, and obtain the regularized third intermediate vector as the input for subsequent processing of the anomaly detection model.

[0077] In an exemplary embodiment, the second intermediate vector is represented as x′, and the third intermediate vector x″ after being processed by the convolution module is as follows:

[0078] x″=x′+Conv(x′)

[0079] Among them, Conv refers to the convolution module.

[0080] It should be noted that in actual applications, the kernel size of the point convolution, the depth and width of the depth convolution, the specific parameters of the batch normalization operation, etc. may vary according to the characteristics of different time series data, and this application does not limit this.

[0081] Through the embodiments of the present application, a combination of layer normalization, point convolution, convolution activation function, one-dimensional deep convolution, batch normalization and other technologies is adopted to achieve deep feature extraction and regularization processing of the second intermediate vector, significantly improving the ability of the anomaly detection model to capture local dependencies in time series data, thereby achieving the purpose of enhancing the local sensitivity and global stability of the anomaly detection model.

[0082] As an optional scheme, the second feedforward module is used to perform an output conversion operation on the third intermediate vector to obtain a target detection result, including: performing a layer normalization operation on the third intermediate vector to obtain a first output feedforward sub-result; performing a linear mapping operation on the first output feedforward sub-result through the input linear layer and input activation function in the first feedforward module to obtain a regularized second output feedforward sub-result; performing a linear conversion operation on the second output feedforward sub-result through the output linear layer in the first feedforward module to obtain a regularized third output feedforward sub-result; and processing the third output feedforward sub-result using the output feedforward activation function to obtain a target detection result.

[0083] Optionally, in an embodiment of the present application, the first output feedforward sub-result refers to a vector after layer normalization, which is the starting point of the second feedforward module processing, including but not limited to being the input of the input linear layer for further feature mapping, performing a linear mapping operation on the first output feedforward sub-result through the input linear layer and the input activation function, referring to processing the first output feedforward sub-result using a linear transformation and a nonlinear activation function to extract a more complex feature representation, including but not limited to using a Swish activation function to enhance the nonlinear expression capability of the model, and generating a regularized second output feedforward sub-result, the output linear layer performs a linear transformation operation on the second output feedforward sub-result, referring to linearly combining the feature vectors through a weight matrix to form a regularized third output feedforward sub-result, including but not limited to using a linear transformation to map the features to a suitable space, the third output feedforward sub-result is processed using the output feedforward activation function, referring to converting the regularized vector into the final output of the model, i.e., the target detection result, through a nonlinear transformation, which includes but is not limited to using activation functions such as Sigmoid or Softmax to map the output to a probability space, for indicating whether the time series data is abnormal data.

[0084] Exemplarily, the second feedforward module can be as follows Figure 4 As shown, the third intermediate vector is firstly processed by layer normalization to ensure the stability and consistency of the characteristic value of the first output feedforward sub-result when entering the feedforward module, and the first output feedforward sub-result is obtained; then, the input linear layer and the Swish activation function in the first feedforward module perform linear mapping and nonlinear transformation on the first output feedforward sub-result to obtain a regularized second output feedforward sub-result, and then, the second output feedforward sub-result is linearly transformed by the output linear layer to obtain a regularized third output feedforward sub-result, so as to adjust the dimension and distribution of the second output feedforward sub-result to make it more suitable for the final output, and finally, the output feedforward activation function processes the third output feedforward sub-result, maps the vector to the probability space, and generates a target detection result, indicating whether the time series data contains abnormal information.

[0085] In an exemplary embodiment, taking the abnormal detection of the aircraft operation status in the ADS-B system as an example, in the final stage of the abnormal detection model processing flow, the third intermediate vector (the vector obtained after the convolution module processing) is firstly normalized by the layer normalization operation to adjust the statistical characteristics of the feature, ensure the stability of the data when entering the feedforward module, and obtain the first output feedforward sub-result. Subsequently, this vector is further converted and enhanced by the input linear layer and the Swish activation function to form a regularized second output feedforward sub-result. This step performs a nonlinear transformation on the feature to make it more suitable for the decision-making process of the model. Next, the second output feedforward sub-result is mapped to a new feature space by the output linear layer processing to obtain a regularized third output feedforward sub-result. This vector contains a feature representation that is more suitable as the final output. Finally, the output feedforward activation function, such as Softmax, converts the third output feedforward sub-result into an abnormal probability, and obtains a target detection result of 0.99. For example, it is pre-set that the time series data corresponding to the target detection result higher than 90% is abnormal. It should be noted that the specific value conditions for determining whether it is abnormal data can be flexibly set, and this application does not limit this.

[0086] In yet another exemplary embodiment, y represents the target detection result, and x" represents the third intermediate vector:

[0087]

[0088] Among them, Layernorm represents layer normalization, FFN represents feedforward module, and softmax represents output feedforward activation function.

[0089] It should be noted that in actual applications, the weights of the linear layer, the choice of activation function, layer normalization, and the specific parameters of the output feedforward activation function may vary depending on the characteristics of the time series data and model requirements, and this application does not limit this.

[0090] Through the embodiments of the present application, a combination of layer normalization, linear layer mapping, nonlinear activation, and output feedforward activation function is adopted to achieve deep processing and standardization of time series data features, significantly improve the accuracy and interpretability of the anomaly detection model output, and achieve the purpose of optimizing the prediction performance and decision-making ability of the anomaly detection model.

[0091] As an optional solution, a vectorization operation is performed on the time series data to obtain an initial input vector, and the initial input vector and the memory tag vector are concatenated to obtain a target input vector, including: obtaining the sequence length of the initial input vector and the initial memory tag vector, wherein the sequence length of the initial memory tag vector is the same as the sequence length; adjusting the sequence length of the initial memory tag vector based on the data resources and data volume of the time series data to obtain the memory tag vector.

[0092] Optionally, in an embodiment of the present application, the sequence length of the above-mentioned initial input vector refers to the number of elements in the time series data, including but not limited to the number of consecutive messages for analyzing the time series data, providing a basis for setting the dimension of the model input; the above-mentioned initial memory tag vector refers to an additional vector in the model used to assist in capturing long-range dependencies, and its sequence length is the same as the initial input vector, including but not limited to creating memory tags equal to the length of the input data to ensure that the model can access the corresponding memory information when processing the data at each time point; the number of memory tags can be dynamically adjusted according to the length of the actual input sequence to adapt to time series data of different lengths, including but not limited to increasing or decreasing the number of memory tags accordingly when the length of the input sequence changes, so as to maintain the model's ability and efficiency in processing long sequences.

[0093] Exemplarily, the sequence length of the time series data is first determined, and then an initial memory marker vector equal to the length is created. Next, the number of memory markers is dynamically adjusted according to the specific circumstances of the time series data, such as the amount of data and resource conditions, to ensure that the above-mentioned anomaly detection model can effectively process the long-range dependencies in the input sequence and generate a memory marker vector as an important component of the subsequent processing of the anomaly detection model.

[0094] In an exemplary embodiment, taking the anomaly detection of the aircraft operating status in the ADS-B system as an example, when processing ADS-B data, the anomaly detection model first obtains the number of messages broadcast in a single flight, that is, the sequence length, and then initializes the same number of memory tag vectors based on this length. In practical applications, such as when processing ADS-B data of short-distance flights, the model may adjust the number of memory tags based on a smaller number of messages, while when processing long-distance flights or high-frequency broadcast data, it may be necessary to increase the number of memory tag vectors to fully extract and utilize long-range dependency information.

[0095] It should be noted that the sequence length adjustment strategy of the above-mentioned memory tag vector may vary depending on the specific application environment and data characteristics. For example, when data resources are limited or the amount of data is particularly large, different adjustment mechanisms may need to be adopted. This application does not limit this, that is, it allows the number and processing strategies of memory tag vectors to be flexibly adjusted according to actual needs.

[0096] Through the embodiments of the present application, a method of dynamically adjusting the length of the memory tag vector sequence is adopted to realize the capture and utilization of long-range dependencies in time series data by the anomaly detection model. Even when data resources are limited or the amount of data is huge, the effectiveness and processing efficiency of the model can be maintained, thereby achieving the purpose of enhancing the accuracy and adaptability of ADS-B anomaly data detection.

[0097] In an exemplary embodiment, taking the data business field as an example, through the above-mentioned data processing method, the embodiment of the present application realizes an automatic detection method of ADS-B abnormal data based on convolution enhanced memory Transformer to improve the accuracy and response speed of aviation safety monitoring. This method can effectively identify and analyze abnormal patterns in data from the ADS-B system, thereby timely discovering potential safety risks.

[0098] It should be noted that the Automatic Dependent Surveillance-Broadcast (ADS-B) technology allows the Air Traffic Control (ATC) center and aircraft in adjacent airspace to periodically broadcast key flight information, such as latitude and longitude, altitude and speed, through the global satellite navigation system and ground-to-air and sky-to-air data link communications. It can be used as a key data source in the aviation information system. The accuracy and security of ADS-B data are crucial to flight interval management, air traffic flow control, and collision avoidance systems.

[0099] Exemplarily, the embodiment of the present application is aimed at the shortcomings of the existing abnormal data detection method in capturing the local dependence and long-range dependence in the ADS-B message sequence, and the problem of low recognition accuracy. A method for detecting abnormal data of ADS-B based on convolution-enhanced memory Transformer is proposed. By adding a trainable memory tag to the Transformer model, the local and global information of the sequence is selectively stored, and a memory Transformer model (the above-mentioned abnormal detection model) is constructed, which effectively overcomes the problem of information ambiguity of the traditional Transformer when processing long sequences, and enhances the model's understanding and reasoning ability of complex contexts. In addition, a novel self-attention and convolution combination method is introduced, which is located between two feedforward modules, wherein the self-attention module is used to process global interactions, and the convolution module focuses on capturing local correlations based on relative offsets. It is possible to maximize the capture of local features and global representations, thereby significantly improving recognition performance. In practical applications, it may include but is not limited to developing relevant software through this method and integrating it in the ADS-B visualization system, and installing it on an aircraft (for example, in the form of certification software for electronic flight bags) or a ground base station.

[0100] Specifically, if Figure 3As shown in Figure 1, the anomaly detection model can adopt an end-to-end unsupervised deep learning architecture, where the encoder first processes the input through a convolutional downsampling layer and then further processes it using multiple convolutional enhanced memory Transformer blocks.

[0101] Exemplarily, m special [mem] tags are introduced into the standard ADS-B sequence input and processed by a convolution-enhanced Transformer block to effectively capture local and global dependencies in the sequence and significantly improve the accuracy of anomaly detection, wherein the convolution-enhanced Transformer block consists of four modules stacked together, namely, a first feedforward module, a self-attention module, a convolution module, and a second feedforward module, including but not limited to:

[0102] S1, [mem] tag enhanced input:

[0103] Due to the limitation of Transformer in integrating local and global information in the same vector, the decentralized storage of global features leads to information “blurring” and makes it more difficult to access this information. In addition, considering the insufficient scalability of Transformer’s attention range, which limits its effectiveness in processing long sequences, in order to optimize the model’s performance in storing and utilizing local and global information, given a standard ADS-B input vector x seq , the present invention adds m special [mem] tags to the standard input, which is then processed in the standard way, and the target input vector x becomes the memory tag vector x mem (the above memory marker vector) and the original ADS-B input vector x seq Concatenation of (the above initial input vector):

[0104] x=[x mem ;x seq ]∈R (n+m)×d ,x mem ∈R m×d ,x seq ∈R n×d

[0105] Where R represents the real vector space, n represents the length of the original input ADS-B sequence, m represents the number of special [mem] tags added to the front of the input sequence, and d represents the dimension of the vector. The anomaly detection model does not treat the [mem] tag differently from other input elements, allowing the model to utilize both memory and input information when processing the input.

[0106] S2, the first feedforward module processes:

[0107] The first feed-forward module follows the design of the pre-normalized residual unit, applies layer normalization within the residual unit and on the input before the first linear layer, and uses the Swish activation function and dropout technology to help regularize the network and prevent overfitting. The structure of the feed-forward (FFN) module is as follows: Figure 4 shown.

[0108] Given an input x, after being processed by the first feedforward module, the output for:

[0109]

[0110] Among them, FFN refers to the feed-forward module.

[0111] S3, multi-head self-attention module processing:

[0112] The multi-head self-attention mechanism (MHSA) is used in the multi-head self-attention module, and the relative sinusoidal position encoding in Transformer-XL is integrated, so that the self-attention module can more effectively normalize the probability at different input lengths, and enhance the robustness of the encoder to changes in sequence length. In addition, the multi-head self-attention module also uses residual units with dropout to facilitate the training and regularization of deeper models. Figure 5 Shows the structure of the multi-head self-attention module.

[0113] The output after processing by the first feed-forward module After passing through the multi-head self-attention module, it becomes x′:

[0114]

[0115] Among them, MHSA refers to the Multi-Head Self-Attention Module.

[0116] S4, convolution module processing:

[0117] The above convolutional module is opened with a gating mechanism, including a point convolution and a gated linear unit (GLU). After that, a one-dimensional deep convolution layer is used for further processing. In order to facilitate the training of deep models, batch normalization (Batchnorm) is applied immediately after the convolution is completed. Figure 6 The structure of the convolutional module is shown in detail.

[0118] The output x′ of the previous module and the output x″ after processing by the convolution module are as follows:

[0119] x″=x′+Conv(x′)

[0120] Among them, Conv refers to the convolution module.

[0121] S5, the second feedforward module processes:

[0122] The second feedforward module may have the same structure as the first feedforward module, and is followed by a normalization layer and an activation function layer. After this processing step, the final output y of the module (the target detection result) is:

[0123]

[0124] Among them, Layernorm represents layer normalization, FFN represents feedforward module, and softmax represents activation function.

[0125] In general, the embodiments of the present application include [mem] tag enhanced input: embedding the [mem] tag in the ADS-B input sequence as an auxiliary memory mechanism of the anomaly detection model, so that the anomaly detection model combines additional memory information when processing data, optimizes the capture and utilization of long-range dependencies, and provides richer context support for subsequent processing; convolution enhanced Transformer block: based on the memory information provided by the [mem] tag, the convolution enhanced Transformer block captures the global interaction in the sequence through the self-attention mechanism, and uses the convolutional network to capture local time correlation, which solves the deficiency of the existing model in integrating local and global information. The convolution enhanced Transformer block includes: a first feedforward module is used to improve the stability and training depth of the model; a multi-head self-attention module is used to integrate relative sinusoidal position encoding to enhance the model's ability to capture input sequences of different lengths and global features; a convolution module is used to capture local correlation through one-dimensional convolution and gating mechanism, effectively identify short-term changes in flight data, and improve local anomaly detection accuracy; a second feedforward module is used to further process the output, and a normalization layer is applied to ensure output stability.

[0126] Through the embodiments of the present application, in view of the shortcomings of the existing abnormal data detection methods in capturing local dependencies and long-range dependencies in ADS-B message sequences, as well as the technical problem of low recognition accuracy, an ADS-B abnormal data detection method based on a convolution-enhanced memory Transformer is implemented. First, in view of the information "fuzziness" or "confusion" problem that the existing Transformer model may encounter when processing long sequences, by adding trainable memory tags to the abnormal detection model, the model can simultaneously consider additional memory information when processing the input sequence, thereby effectively storing and representing global features related to the input sequence; this not only enhances the memory capacity of the model, but also improves its ability to capture long-range dependencies, thereby improving the understanding and reasoning ability of complex contexts. On the other hand, considering that local features in ADS-B data are crucial for accurately identifying small changes in flight data, the convolutional neural network is effectively combined with the Transformer to model local and global dependencies in the ADS-B sequence, making full use of the advantages of the convolutional neural network and the Transformer, significantly improving the accuracy of the abnormal detection model in abnormal data detection, and providing strong technical support for more efficient and accurate identification of ADS-B abnormal data.

[0127] It is understandable that in the specific implementation of this application, related data such as user information is involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

[0128] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0129] According to another aspect of the embodiment of the present application, a data processing device for implementing the above data processing method is also provided. Figure 7 As shown, the device comprises:

[0130] An acquisition module 702 is used to acquire time series data, wherein the time series data is used to represent the operating status of the target device within a preset time period;

[0131] A concatenation module 704 is used to perform a vectorization operation on the time series data to obtain an initial input vector, and to concatenate the initial input vector and the memory tag vector to obtain a target input vector, wherein the memory tag vector is used to store local information and global information of the time series data;

[0132] Processing module 706 is used to input the target input vector into the anomaly detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the time series data is abnormal data. The anomaly detection model includes a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module arranged in series. The multi-head self-attention module is used to capture the global correlation in the time series data based on global information, and the convolution module is used to capture the local correlation in the time series data based on local information.

[0133] As an optional solution, the above-mentioned device is used to input the target input vector into an anomaly detection model in the following manner to obtain a target detection result: input the target input vector into the anomaly detection model, and the first feedforward module performs an input conversion operation on the target input vector to obtain a first intermediate vector, wherein the first intermediate vector represents the target input vector after linear mapping and nonlinear transformation; uses a multi-head self-attention module to perform an attention aggregation operation on the first intermediate vector to obtain a second intermediate vector, wherein the second intermediate vector represents the first intermediate vector after global dependency modeling; uses a convolution module to perform a local feature extraction operation on the second intermediate vector to obtain a third intermediate vector, wherein the third intermediate vector represents the second intermediate vector after local dependency modeling of relative position; uses the second feedforward module to perform an output conversion operation on the third intermediate vector to obtain a target detection result.

[0134] As an optional solution, the above-mentioned device is used to input the target input vector into the anomaly detection model in the following manner, and the first feedforward module performs an input conversion operation on the target input vector to obtain a first intermediate vector: performs a layer normalization operation on the target input vector to obtain a first input feedforward sub-result; performs a linear mapping operation on the first input feedforward sub-result through the input linear layer and input activation function in the first feedforward module to obtain a regularized second input feedforward sub-result; performs a linear conversion operation on the second input feedforward sub-result through the output linear layer in the first feedforward module to obtain a first intermediate vector.

[0135] As an optional solution, the above-mentioned device is used to perform an attention aggregation operation on the first intermediate vector using a multi-head self-attention module in the following manner to obtain a second intermediate vector: position-encode the first intermediate vector using relative sinusoidal position coding to obtain a first aggregated sub-result; perform a layer normalization operation on the first aggregated sub-result to obtain a regularized second intermediate vector.

[0136] As an optional solution, the above-mentioned device is used to perform a local feature extraction operation on the second intermediate vector using a convolution module in the following manner to obtain a third intermediate vector: perform a layer normalization operation on the second intermediate vector to obtain a first local vector; perform a point convolution operation, a convolution activation function processing, and a one-dimensional depth convolution operation on the first local vector in sequence to obtain a second local vector; perform a batch normalization operation on the second local vector to obtain a third local vector; perform a point convolution operation on the third local vector to obtain a regularized third intermediate vector.

[0137] As an optional scheme, the above-mentioned device is used to perform an output conversion operation on the third intermediate vector using the second feedforward module in the following manner to obtain a target detection result: perform a layer normalization operation on the third intermediate vector to obtain a first output feedforward sub-result; perform a linear mapping operation on the first output feedforward sub-result through the input linear layer and input activation function in the first feedforward module to obtain a regularized second output feedforward sub-result; perform a linear conversion operation on the second output feedforward sub-result through the output linear layer in the first feedforward module to obtain a regularized third output feedforward sub-result; and process the third output feedforward sub-result using the output feedforward activation function to obtain a target detection result.

[0138] As an optional solution, the above-mentioned device is used to perform vectorization operations on time series data in the following manner to obtain an initial input vector, concatenate the initial input vector and the memory tag vector, and obtain a target input vector: obtain the sequence length of the initial input vector and the initial memory tag vector, wherein the sequence length of the initial memory tag vector is the same as the sequence length; adjust the sequence length of the initial memory tag vector based on the data resources and data volume of the time series data to obtain a memory tag vector.

[0139] In the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program with a predetermined function, and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories) or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0140] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0141] According to one aspect of the present application, a computer program product is provided. The computer program product includes a computer program.

[0142] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0143] Figure 8 The structure block diagram of a computer system for implementing an electronic device according to an embodiment of the present application is schematically shown.

[0144] It should be noted that Figure 8 The computer system 800 of the electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0145] like Figure 8 As shown, the computer system 800 includes a central processing unit 801 (CPU), which can perform various appropriate actions and processes according to the program stored in the read-only memory 802 (ROM) or the program loaded from the storage part 808 to the random access memory 803 (RAM). Various programs and data required for system operation are also stored in the random access memory 803. The central processing unit 801, the read-only memory 802 and the random access memory 803 are connected to each other through a bus 804. The input / output interface 805 (Input / Output interface, i.e., I / O interface) is also connected to the bus 804.

[0146] The following components are connected to the input / output interface 805: an input section 806 including a keyboard, a mouse, etc.; an output section 807 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker; a storage section 808 including a hard disk, etc.; and a communication section 809 including a network interface card such as a local area network card, a modem, etc. The communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to the input / output interface 805 as needed. A removable medium 811, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 810 as needed so that a computer program read therefrom is installed into the storage section 808 as needed.

[0147] In particular, according to an embodiment of the present application, the process described in each method flow chart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program carried on a computer readable medium, and the computer program contains a program code for executing the method shown in the flow chart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processor 801, various functions defined in the system of the present application are executed.

[0148] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 809, and / or installed from the removable medium 811. When the computer program is executed by the central processor 801, various functions provided by the embodiment of the present application are performed.

[0149] According to another aspect of the embodiment of the present application, an electronic device for implementing the above data processing method is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a terminal device as an example. Fig. 9 As shown, the electronic device includes a memory 902 and a processor 904. The memory 902 stores a computer program, and the processor 904 is configured to execute the steps in any of the above method embodiments through the computer program.

[0150] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0151] Optionally, in this embodiment, the above-mentioned processor can be configured to execute the methods in each embodiment of the present application through a computer program.

[0152] Alternatively, a person skilled in the art may understand that: Fig. 9 The structure shown is for illustration only. Fig. 9 The structure of the electronic device is not limited. Fig. 9 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig. 9 Different configurations are shown.

[0153] Among them, the memory 902 can be used to store software programs and modules, such as program instructions / modules corresponding to the data processing method and device in the embodiments of the present application. The processor 904 executes various functional applications and data processing by running the software programs and modules stored in the memory 902, that is, realizing the above-mentioned data processing method. The memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 902 may further include a memory remotely located relative to the processor 904, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 902 can be specifically, but not limited to, used to store information such as the above-mentioned time series data. As an example, such as Fig. 9 As shown, the memory 902 may include but is not limited to the acquisition module 702, the splicing module 704 and the processing module 706 in the data processing device. In addition, it may also include but is not limited to other module units in the data processing device, which will not be repeated in this example.

[0154] Optionally, the transmission device 906 is used to receive or send data via a network. Specific examples of the above-mentioned network may include a wired network and a wireless network. In one example, the transmission device 906 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 906 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0155] In addition, the electronic device further includes: a display 908 for displaying the target detection result; and a connection bus 910 for connecting various module components in the electronic device.

[0156] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. The nodes may form a peer-to-peer network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the peer-to-peer network.

[0157] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the data processing method provided in various optional implementations of the above-mentioned data processing aspects.

[0158] Optionally, in this embodiment, the above-mentioned computer-readable storage medium can be configured to store data for executing the methods in various embodiments of the present application.

[0159] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk, etc.

[0160] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0161] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for one or more electronic devices to execute all or part of the steps of the methods described in each embodiment of the present application.

[0162] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0163] In the several embodiments provided in the present application, it should be understood that the disclosed application can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0164] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0165] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0166] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A data processing method, characterized in that: include: Acquire time series data, wherein the time series data is used to represent the operating status of the target device within a preset time period; Performing a vectorization operation on the time series data to obtain an initial input vector, and concatenating the initial input vector and a memory tag vector to obtain a target input vector, wherein the memory tag vector is used to store local information and global information of the time series data; The target input vector is input into an anomaly detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the time series data is abnormal data. The anomaly detection model includes a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module arranged in series, the multi-head self-attention module is used to capture the global correlation in the time series data based on the global information, and the convolution module is used to capture the local correlation in the time series data based on the local information.

2. The method according to claim 1, characterized in that The step of inputting the target input vector into an anomaly detection model to obtain a target detection result includes: The target input vector is input into the anomaly detection model, and the first feedforward module performs an input conversion operation on the target input vector to obtain a first intermediate vector, wherein the first intermediate vector represents the target input vector after linear mapping and nonlinear transformation; Using the multi-head self-attention module to perform an attention aggregation operation on the first intermediate vector to obtain a second intermediate vector, wherein the second intermediate vector represents the first intermediate vector after global dependency modeling; Using the convolution module to perform a local feature extraction operation on the second intermediate vector to obtain a third intermediate vector, wherein the third intermediate vector represents the second intermediate vector modeled by a local dependency relationship of relative positions; The second feedforward module is used to perform an output conversion operation on the third intermediate vector to obtain the target detection result.

3. The method according to claim 2, characterized in that The step of inputting the target input vector into the anomaly detection model, and performing an input conversion operation on the target input vector by the first feedforward module to obtain a first intermediate vector, includes: Performing a layer normalization operation on the target input vector to obtain a first input feedforward sub-result; Performing a linear mapping operation on the first input feedforward sub-result through the input linear layer and the input activation function in the first feedforward module to obtain a regularized second input feedforward sub-result; A linear conversion operation is performed on the second input feedforward sub-result through the output linear layer in the first feedforward module to obtain a first intermediate vector.

4. The method according to claim 2, characterized in that: The using the multi-head self-attention module to perform an attention aggregation operation on the first intermediate vector to obtain a second intermediate vector includes: Performing position encoding on the first intermediate vector by using relative sinusoidal position encoding to obtain a first aggregated sub-result; A layer normalization operation is performed on the first aggregation sub-result to obtain a regularized second intermediate vector.

5. The method according to claim 2, characterized in that: The using the convolution module to perform a local feature extraction operation on the second intermediate vector to obtain a third intermediate vector includes: Performing a layer normalization operation on the second intermediate vector to obtain a first local vector; Performing a point convolution operation, a convolution activation function processing, and a one-dimensional depth convolution operation on the first local vector in sequence to obtain a second local vector; performing a batch normalization operation on the second local vector to obtain a third local vector; The point convolution operation is performed on the third local vector to obtain the regularized third intermediate vector.

6. The method according to claim 2, characterized in that The using the second feedforward module to perform an output conversion operation on the third intermediate vector to obtain the target detection result includes: Performing a layer normalization operation on the third intermediate vector to obtain a first output feedforward sub-result; Performing a linear mapping operation on the first output feedforward sub-result through the input linear layer and the input activation function in the first feedforward module to obtain a regularized second output feedforward sub-result; Performing a linear transformation operation on the second output feedforward sub-result through the output linear layer in the first feedforward module to obtain a regularized third output feedforward sub-result; The third output feedforward sub-result is processed using an output feedforward activation function to obtain the target detection result.

7. The method according to claim 1, characterized in that The performing of a vectorization operation on the time series data to obtain an initial input vector, and concatenating the initial input vector and a memory tag vector to obtain a target input vector, comprises: Acquire the sequence length of the initial input vector and the initial memory tag vector, wherein the sequence length of the initial memory tag vector is the same as the sequence length; The sequence length of the initial memory marker vector is adjusted based on the data resources and data volume of the time series data to obtain the memory marker vector.

8. A data processing device, characterized in that: include: An acquisition module, used to acquire time series data, wherein the time series data is used to represent the operating status of the target device within a preset time period; A splicing module, used to perform a vectorization operation on the time series data to obtain an initial input vector, and splice the initial input vector and a memory tag vector to obtain a target input vector, wherein the memory tag vector is used to store local information and global information of the time series data; A processing module is used to input the target input vector into an anomaly detection model to obtain a target detection result, wherein the target detection result is used to indicate whether the time series data is abnormal data, and the anomaly detection model includes a first feedforward module, a multi-head self-attention module, a convolution module and a second feedforward module arranged in series, the multi-head self-attention module is used to capture the global correlation in the time series data based on the global information, and the convolution module is used to capture the local correlation in the time series data based on the local information.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored computer program, wherein the computer program can be executed by an electronic device to perform the method described in any one of claims 1 to 7.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 7 are implemented.

11. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to execute the method according to any one of claims 1 to 7 through the computer program.

Images