Model training method and device, equipment, program product and storage medium

Abstract

The invention discloses a model training method and device, equipment, a program product and a storage medium, and the method comprises the steps: obtaining time sequence data of N terminals, the time sequence data comprising network index data corresponding to a plurality of times; for each terminal in the N terminals, processing the time sequence data of the terminal through a feature extractor to obtain an embedded vector of the terminal; processing the embedded vector of the terminal through a backbone network to obtain a feature vector of the terminal; calculating a loss value of the backbone network based on the feature vector of the terminal and the difference feature vector of the terminal, and performing parameter updating on the backbone network based on the loss value; wherein for the first type of terminals in the N terminals, the feature vectors of the first type of terminals are generated based on the proprietary feature vectors and the shared feature vectors of the first type of terminals; for a second type of terminals in the N terminals, the feature vectors of the second type of terminals are proprietary feature vectors of the second type of terminals; the shared feature vector is generated based on the time sequence data of the N terminals.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a model training method and apparatus, equipment, program product, and storage medium. Background Art

[0002] For anomaly detection technology, several types of existing technical solutions include joint learning methods. Joint learning is a form of multi-task learning. For anomaly detection methods combined with multi-task learning, in actual operations in the park, the workload of each terminal is different, and the network quality data of terminals with small workloads in the same period of time is also small. When the model is self-iterated in the original solution, because the amount of training data for individual terminals is small in the same time period, it is difficult to learn its characteristics during the model training process, resulting in low accuracy of anomaly detection for these terminals. Summary of the invention

[0003] In order to solve the above technical problems, the present application provides a model training method and device, equipment, program product, and storage medium.

[0004] The model training method provided in this application includes:

[0005] Obtain time series data of N terminals, where the time series data includes network indicator data corresponding to multiple times, and N is a positive integer greater than 1;

[0006] For each of the N terminals, the time series data of the terminal is processed by the feature extractor to obtain the embedding vector of the terminal; the embedding vector of the terminal is processed by the backbone network to obtain the feature vector of the terminal; the loss value of the backbone network is calculated based on the feature vector of the terminal and the difference feature vector of the terminal, and the parameters of the backbone network are updated based on the loss value;

[0007] Among them, for the first type of terminals among N terminals, the feature vector of the first type of terminals is generated based on the exclusive feature vector and shared feature vector of the first type of terminals; for the second type of terminals among the N terminals, the feature vector of the second type of terminals is the exclusive feature vector of the second type of terminals; the shared feature vector is generated based on the time series data of the N terminals.

[0008] The model training device provided in this application comprises:

[0009] An acquisition unit, used to acquire time series data of N terminals, where the time series data includes network indicator data corresponding to multiple times, and N is a positive integer greater than 1;

[0010] A processing unit is used to process the time series data of each terminal among N terminals through a feature extractor to obtain an embedding vector of the terminal; process the embedding vector of the terminal through a backbone network to obtain a feature vector of the terminal; calculate the loss value of the backbone network based on the feature vector of the terminal and the difference feature vector of the terminal, and update the parameters of the backbone network based on the loss value; wherein, for a first type of terminal among the N terminals, the feature vector of the first type of terminal is generated based on a proprietary feature vector and a shared feature vector of the first type of terminal; for a second type of terminal among the N terminals, the feature vector of the second type of terminal is a proprietary feature vector of the second type of terminal; and the shared feature vector is generated based on the time series data of the N terminals.

[0011] The model training device provided in the present application includes: a processor and a memory, the memory is used to store a computer program, and the processor is used to call and run the computer program stored in the memory to execute the above-mentioned model training method.

[0012] A computer program product provided by the present application includes: a computer program, and the computer program implements any one of the above methods when executed by a processor.

[0013] The computer-readable storage medium provided in the present application is used to store a computer program, and the computer program enables a computer to execute any one of the above methods.

[0014] In the technical solution of the present application, time series data of N terminals are obtained, and the time series data include network indicator data corresponding to multiple times, where N is a positive integer greater than 1; for each terminal among the N terminals, the time series data of the terminal is processed by a feature extractor to obtain an embedding vector of the terminal; the embedding vector of the terminal is processed by a backbone network to obtain a feature vector of the terminal; the loss value of the backbone network is calculated based on the feature vector of the terminal and the difference feature vector of the terminal, and the parameters of the backbone network are updated based on the loss value; wherein, for a first type of terminal among the N terminals, the feature vector of the first type of terminal is generated based on a proprietary feature vector and a shared feature vector of the first type of terminal; for a second type of terminal among the N terminals, the feature vector of the second type of terminal is a proprietary feature vector of the second type of terminal; and the shared feature vector is generated based on the time series data of the N terminals. In this way, multiple terminals use the same feature extractor and backbone network training. For the first type of terminals, shared feature vectors and proprietary feature vectors are used for training, and for the second type of terminals, proprietary feature vectors are used for training. This solves the problem of huge differences in the amount of training data for different terminals in the same area. That is, multiple terminals in the same area are jointly trained to obtain anomaly detection models corresponding to multiple terminals, which improves the efficiency, accuracy, interpretability and reliability of network quality detection in the park. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] Figure 1 This is a schematic diagram of the process of the model training method provided in the embodiment of the present application. Figure 1 ;

[0016] Figure 2 This is a flow chart of the model training method provided in the embodiment of the present application. Figure 2 ;

[0017] Figure 3 It is a schematic diagram of a timing patch provided in an embodiment of the present application;

[0018] Figure 4 It is a schematic diagram of an algorithm flow of a terminal with more or less training data in a multi-terminal joint learning algorithm provided in an embodiment of the present application;

[0019] Figure 5 It is a schematic diagram of the structural composition of the model training device provided in an embodiment of the present application;

[0020] Figure 6 is a schematic structural diagram of a model training device provided in an embodiment of the present application;

[0021] Figure 7 It is a schematic structural diagram of the chip of an embodiment of the present application. DETAILED DESCRIPTION

[0022] The following will describe the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] In the following description, reference is made to “some embodiments”, which describe a subset of all possible embodiments, but it will be understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0024] It should also be pointed out that the terms "first\second\third" involved in the embodiments of the present application are only used to distinguish similar objects and do not represent a specific ordering of the objects. It can be understood that "first\second\third" can be interchanged in a specific order or sequence where permitted, so that the embodiments of the present application described here can be implemented in an order other than that illustrated or described here.

[0025] It should also be noted that the term "and / or" in this article is only a description of the association relationship of associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the character " / " in this article generally indicates that the objects associated before and after are in an "or" relationship. It should also be understood that the "indication" mentioned in the embodiments of the present application can be a direct indication, an indirect indication, or an indication of an association relationship. For example, A indicates B, which can mean that A directly indicates B, for example, B can be obtained through A; it can also mean that A indirectly indicates B, for example, A indicates C, and B can be obtained through C; it can also mean that there is an association relationship between A and B. It should also be understood that the "correspondence" mentioned in the embodiments of the present application can mean that there is a direct or indirect correspondence relationship between the two, or it can mean that there is an association relationship between the two, or it can mean a relationship between indication and being indicated, configuration and being configured, etc.

[0026] To facilitate understanding of the technical solutions of the embodiments of the present application, the relevant technologies of the embodiments of the present application are described below. The following related technologies can be arbitrarily combined with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application.

[0027] For anomaly detection technology, there are several types of technical solutions:

[0028] (1) Reconstruction-based algorithms train the model with normal data, use the reconstruction error as the anomaly score, and attribute higher scores to anomalous data during the test phase.

[0029] (2) Based on the prediction algorithm, the future time series is predicted and the error between the true value and the predicted value is calculated as the basis for abnormal judgment.

[0030] (3) Generative adversarial learning, using generative models to learn the distribution of normal data and using discriminators to detect anomalies.

[0031] (4) Transformer-based methods.

[0032] (5) Based on contrastive learning methods, robust representation for anomaly detection is obtained.

[0033] (6) Diffusion-based techniques use the diffusion process to capture the propagation of anomalies in complex networks and time series.

[0034] (7) Large model anomaly detection.

[0035] Joint learning is a form of multi-task learning. For anomaly detection methods combined with multi-task learning, in one technical solution, a new domain adaptation window normalization method is disclosed to reduce the distribution difference of anomaly scores between training sets and test sets, and an unsupervised multi-task learning framework is established by optimizing the joint loss function. In another technical solution, a cross-domain multi-graph representation method is disclosed. By analyzing data of different dimensions, the cross-domain features between data of different dimensions are represented on a multi-graph structure, providing more comprehensive information for subsequent anomaly detection models.

[0036] The existing 5G private network management platform configures thresholds based on manual experience to identify abnormal network quality data of terminals. However, due to differences in services, network quality data values ​​vary greatly in different private network parks, and thresholds need to be configured one by one. Currently, unsupervised abnormality detection is mainly performed on each terminal in each park through AI intelligent algorithms.

[0037] This includes the identification of network quality anomalies for each terminal: in the same business scenario (such as browsing and downloading scenarios), by learning the network quality data of different terminals in the same area (park), the normal (no network quality complaints) operation mode of the terminal is identified. When the network quality data for a certain time period does not meet the characteristics during training, it is judged as an anomaly (pattern anomaly). It also includes model self-iteration: if the anomaly is not handled within the recovery period (such as 2 weeks), the anomaly detection model uses the data set containing the anomaly data as training data, retrains the anomaly detection model, and relearns the network quality change pattern of the terminal operation.

[0038] However, the current solution has the following technical difficulties: During actual operation in the park, the workload of each terminal is different, and the network quality data of terminals with small workloads in the same period of time is also small. In the original solution, when the model is self-iterated, because the amount of training data of individual terminals is small in the same time period, it is difficult to learn its characteristics during the model training process, resulting in low accuracy of abnormal detection of these terminals. The multi-task learning framework proposed in one of the technical solutions cannot solve the problem of different training data volumes, and requires separate prediction and reconstruction tasks, which increases complexity and errors.

[0039] Therefore, how to solve the different amounts of terminal training data and improve the accuracy of model anomaly detection becomes a problem that needs to be considered. To this end, the following technical solutions of the embodiments of the present application are proposed.

[0040] To facilitate understanding of the technical solutions of the embodiments of the present application, the technical solutions of the present application are described in detail below through specific embodiments. The above related technologies can be combined arbitrarily with the technical solutions of the embodiments of the present application as optional solutions, and they all belong to the protection scope of the embodiments of the present application. The embodiments of the present application include at least part of the following contents.

[0041] Figure 1This is a flow chart of the model training method provided in the embodiment of the present application. Figure 1 ,like Figure 1 As shown, the model training method includes the following steps:

[0042] Step 101: Obtain time series data of N terminals, where the time series data includes network indicator data corresponding to multiple times, and N is a positive integer greater than 1.

[0043] In some implementations, the time series data of the N terminals are network quality data of different terminals in the same area arranged in chronological order.

[0044] In some implementations, the network indicators include transmission control protocol (TCP) link establishment delay, first packet delay, hypertext transfer protocol (HTTP) response delay, and other indicators.

[0045] In some implementations, these indicator data are separated at minute granularity according to different terminals and input into the feature extractor in the form of a combination of one or more indicators. For example, Table 1 is an example of inputting a multivariate indicator.

[0046] Table 1 Example of multivariate indicator input

[0047]

[0048] Step 102: For each of the N terminals, the time series data of the terminal is processed by a feature extractor to obtain an embedding vector of the terminal; the embedding vector of the terminal is processed by a backbone network to obtain a feature vector of the terminal; the loss value of the backbone network is calculated based on the feature vector of the terminal and the difference feature vector of the terminal, and the parameters of the backbone network are updated based on the loss value.

[0049] Among them, for the first type of terminals among N terminals, the feature vector of the first type of terminals is generated based on the exclusive feature vector and shared feature vector of the first type of terminals; for the second type of terminals among the N terminals, the feature vector of the second type of terminals is the exclusive feature vector of the second type of terminals; the shared feature vector is generated based on the time series data of the N terminals.

[0050] In some implementations, the backbone network is a neural network for network anomaly detection.

[0051] In some implementations, the final model obtained by training the backbone network is an anomaly detection model for each terminal.

[0052] In some embodiments, the method further includes: sorting N terminals in order of the amount of data of their timing data from large to small; classifying the terminals whose data amount is less than or equal to a first quantity threshold among the S terminals ranked later in the N terminals as first-category terminals, where S is a positive integer and the first quantity threshold is determined based on the amount of data of the terminal ranked in the middle among the N terminals; and classifying the terminals other than the first-category terminals among the N terminals as second-category terminals.

[0053] Exemplarily, the amount of training data of each terminal in the same area is sorted, and the terminals at the end of the sorting sequence and whose number is less than 1 / 2 of the midpoint of the sorting sequence are terminals with a small number of training data, that is, first-category terminals, and the rest are terminals with a large number of training data, that is, second-category terminals.

[0054] In some embodiments, the timing data of the terminal is processed by a feature extractor to obtain an embedding vector of the terminal, including: processing the timing data of the terminal by a feature extractor as follows: extracting feature data of the timing data, the feature data including trend feature data and / or time feature data; constructing a first data table based on the timing data and the feature data; normalizing the data in the first data table to obtain a second data table; generating M embedding vectors based on the second data table, where M is a positive integer greater than 1; the M embedding vectors correspond to the M timing patches.

[0055] In some embodiments, the time series data is decomposed into a trend term, a cycle, and a residual, wherein the time series data is y t , the trend term is T t , that is, trend characteristic data, with a period of S t , the residual is R t , where t is the time point, and the period refers to the pattern that repeats in a fixed or non-fixed period in the time series, usually manifested as repeated highs and lows over a period of time. The residual is the part left after decomposing the time series data into trends and periods. It can also be considered as just statistical noise, or the impact of temporary events. The specific representation of time series data is as follows:

[0056] y t =T t +S t +R t

[0057] The trend term T t Add a data table, where the trend item T t The calculation formula is as follows:

[0058]

[0059] Where v represents the average value of all observations in time series v, v(j) represents the observation value at the jth time point in time series v, represents the average value of all time points in the time series v, α0 represents the trend constant, α1 is the slope of the trend; t(j) represents the time point corresponding to the jth observation value. In some embodiments, a trend term is calculated for each indicator, or a trend term is calculated for all indicators, which can be determined according to actual conditions, and this application does not make specific limitations on this.

[0060] In some implementations, the time series data may be decomposed into trend terms, cycles, and residuals using the STL decomposition method.

[0061] In some embodiments, the following method can be used to extract time features from time series data: x is the week number, y is the week feature, y=x / 7, and the y value generally retains two decimal places, such as Monday is 0.14. The week feature is used as time feature data and added to the data table. At the same time, the time is converted into a timestamp format. For example, Table 2 is a data table with time feature data added.

[0062] Table 2 Data table with time characteristic data added

[0063]

[0064] The data table to which trend characteristic data and / or time characteristic data are added is the first data table, which can be represented by z. In this case, z is the data table to be normalized. The data is preprocessed. Specifically, each data except the time column in the data table z is normalized to obtain z1. The specific normalization method is as follows:

[0065]

[0066] Among them, z1 is the normalized data table, z is the data table to be normalized, and z min is the minimum value in the data table, z max is the maximum value in the data table. For example, z1 is the normalized data, z is the data to be normalized, and z min is the minimum value of the index of the data to be normalized, z max It is the maximum value among the indicators of the data to be normalized.

[0067] In some embodiments, the normalized data table is divided into data batches and dimensionally converted to obtain z'1. For example, if the training set length is 70589, there are three columns (time column, http response delay column, week column), the batch size is set to 128, the window length is 2048, and z'1 is a three-dimensional matrix with a shape of (128, 2048, 3).

[0068] In some embodiments, the normalized data table is vectorized and positionally encoded by a neural network embedding layer, wherein the position encoding is calculated as follows:

[0069]

[0070] Among them, pos is equivalent to the position of each value in the time series in the entire time series, 2i refers to the even dimension in the vector dimension, 2i+1 is the odd dimension in the vector dimension, and d represents the output dimension of the neural network embedding layer (such as 512).

[0071] In some implementations, the time series is divided into M Patches, and the sequence within each Patche uses a fully connected layer to obtain a corresponding patch embedding vector, and each patch is regarded as a whole and input into a subsequent model.

[0072] In some implementations, the embedding vectors are positionally encoded.

[0073] In some embodiments, a backbone network includes an encoder and a first fully connected layer; the encoder includes multiple attention modules and a second fully connected layer; the embedding vector of the terminal is processed through the backbone network to obtain a feature vector of the terminal, including: for a first type of terminal among N terminals, the embedding vector of the first type of terminal is processed through multiple attention modules to obtain an attention vector; the attention vector is dimensionally converted through the second fully connected layer to obtain a first unique feature vector of the first type of terminal; the first feature vector of the first type of terminal is generated based on the first unique feature vector and the shared feature vector of the first type of terminal; the first feature vector is normalized through the first fully connected layer to obtain a second feature vector of the terminal; for a second type of terminal among N terminals, the embedding vector of the second type of terminal is processed through multiple attention modules to obtain an attention vector; the attention vector is dimensionally converted through the second fully connected layer to obtain a second unique feature vector of the second type of terminal, and the second unique feature vector of the second type of terminal is used as the first feature vector of the second type of terminal; the first feature vector is normalized through the first fully connected layer to obtain a second feature vector of the second type of terminal.

[0074] In some embodiments, the backbone network includes an encoder and a first fully connected layer, wherein the encoder includes multiple attention blocks and a second fully connected layer, wherein the second fully connected layer is a single fully connected layer, and the first fully connected layer includes two fully connected layers, and the two fully connected layers form a feedforward network.

[0075] In some embodiments, the attention module is calculated as follows:

[0076]

[0077] The same input is calculated through different fully connected layers to obtain vectors Q, K, and V, where dk is the dimension of the K vector and softmax normalizes the vector.

[0078] In some implementations, the backbone network performs feature learning through an encoder to learn the multivariate data features or patterns of the current terminal. Each patch in the multivariate time series data of the training set is input into the encoder to extract the corresponding deep time series feature H t =[h1,h2,h3...h m ], the Attention block result is transformed by the second fully connected layer and then outputs the first feature vector, denoted as H t After the encoder, the first fully connected layer is used for layer normalization and the second feature vector is output, denoted as A t .

[0079] In some implementations, for the first type of terminal, i.e., the terminal with a small amount of training data, the data is processed by multiple attention modules to the embedded limit of the first type of terminal to obtain an attention vector, and the attention vector is dimensionally transformed by the second fully connected layer to obtain a first proprietary feature vector of the first type of terminal, that is, the data of the first type of terminal is passed through the backbone network to generate a first proprietary feature vector, which is recorded as H less After waiting for the shared vector of this iteration to be updated, a new terminal vector is calculated, that is, the first characteristic vector of the first type of terminal is generated based on the first exclusive characteristic vector and the shared characteristic vector of the first type of terminal, which is recorded as H l ' ess , which is the final H of this round t , the specific calculation method of the first eigenvector is: H′ less =Net(H less +H share ), where Net is the fully connected layer of the neural network, and the added matrix is ​​scaled to the sum of H less The same dimensions. t Input the first fully connected layer for layer normalization to obtain the second feature vector A for the first type of terminal t , H t and A t As the backbone network output for terminals with small amount of training data.

[0080] In some embodiments, the shared feature vector is obtained by the following steps: combining the time series data of N terminals into regional-level data; processing the regional-level data through a feature extractor to obtain a regional-level embedding vector; processing the regional-level embedding vector through a backbone network to obtain a shared feature vector.

[0081] In some implementations, each column of data of each terminal of the data source is averaged to an hourly granularity, and all terminal data are combined to form regional-level data, which are input into the terminal feature extractor for processing to obtain a regional-level embedding vector. In each iteration, the general features are extracted through the backbone network. Taking the first iteration as an example, in the first iteration of the backbone network (epoch), the general features are stored / updated in the shared feature vector after completing the first iteration, which is recorded as H. share and A share .

[0082] In some implementations, for the second type of terminal, the embedding vector of the second type of terminal is processed by multiple attention modules in the backbone network to obtain an attention vector; the attention vector is dimensionally transformed by the second fully connected layer to obtain a second specific feature vector of the second type of terminal, and the second specific feature vector of the second type of terminal is used as the first feature vector of the second type of terminal, denoted as H t ; The first eigenvector is normalized by the first fully connected layer to obtain the second eigenvector of the second type of terminal, denoted as A t .

[0083] In some embodiments, the method further includes: adding noise to the data in the second data table to obtain a third data table; processing the embedding vector corresponding to the third data table through a backbone network to obtain a first difference feature vector and a second difference feature vector of the terminal.

[0084] In some implementations, in order to obtain the abnormality detection model of the terminal, in addition to obtaining the first eigenvector and the second eigenvector, it is also necessary to obtain the first difference eigenvector and the second difference eigenvector of each terminal. Specifically, noise is added to each column of data (except the time column) of the normalized data table of each terminal to enhance the network feature discrimination ability. Exemplarily, the calculation formula is as follows:

[0085]

[0086] Wherein, z2 is the difference sample after adding noise, β is the correlation coefficient, which can be set to 1 / 3 for example, and can be set according to the actual situation. This application does not make specific restrictions on this. The current value of the time series is divided into pache according to the pache length. is the maximum value of the current pache, It is the minimum value of the current pache; Refers to a Gaussian distribution with a mean of 0 and a variance of 1. The difference samples of each terminal are input into the terminal feature extractor and the backbone network to obtain the first difference feature vector H of each terminal. t ' and the second difference eigenvector A t '.

[0087] In some embodiments, the method also includes: batch dividing the data in the second data table to obtain a first data vector; performing dimension conversion on the first data vector to obtain a second data vector; calculating the loss value of the backbone network based on the characteristic vector of the terminal and the difference characteristic vector of the terminal, including: calculating the first distance between the second data vector and the first characteristic vector; calculating the second distance between the second data vector and the first difference characteristic vector; calculating the third distance and the fourth distance between the second characteristic vector and the second difference characteristic vector; and calculating the loss value of the backbone network based on the first distance, the second distance, the third distance and the fourth distance.

[0088] In some implementations, the data in the second data table is batch-divided to obtain a first data vector, namely z'1, and the first data vector is dimensionally transformed to obtain a second data vector, namely H patch For example, z'1 is a three-dimensional matrix with a shape of (128, 2048, 3). The patch length is set to 32, H patch It is a three-dimensional matrix with a shape of (128, 2048 / 32, 2048*3 / (2048 / 32))=(128, 64, 96).

[0089] In some embodiments, the loss value of the backbone network is calculated based on the feature vector of the terminal and the difference feature vector of the terminal. Specifically, the first distance between the second data vector and the first feature vector is calculated; the second distance between the second data vector and the first difference feature vector is calculated; the third distance and the fourth distance between the second feature vector and the second difference feature vector are calculated; and the loss value of the backbone network is calculated based on the first distance, the second distance, the third distance and the fourth distance.

[0090] Exemplarily, according to the following formula, the loss of this round of training is calculated by the distribution distance between the original sample and the output feature of this round of training, the distribution distance between the original sample and the difference sample feature, and the gap between the output feature of this round of training and the difference sample feature:

[0091]

[0092]

[0093] LOSS=(dist t +dist t ')-δ(dist a +dist' a )

[0094] Among them, dist t is the first distance, dist' tis the second distance, dist a is the third distance, dist' a is the fourth distance, γ and δ are scaling factors, l t , l t '、l a , l' a is the vector H t , H t '、A t and A t ', scale the calculation results to the same order of magnitude, LOSS is the final loss function, back-propagates to the next round of iteration to optimize the model until the maximum number of iterations, and outputs N models corresponding to the number of N terminals.

[0095] The technical solution of the embodiment of the present application obtains time series data of N terminals, where the time series data includes network indicator data corresponding to multiple times, where N is a positive integer greater than 1; for each terminal among the N terminals, the time series data of the terminal is processed by a feature extractor to obtain an embedding vector of the terminal; the embedding vector of the terminal is processed by a backbone network to obtain a feature vector of the terminal; the loss value of the backbone network is calculated based on the feature vector of the terminal and the difference feature vector of the terminal, and the parameters of the backbone network are updated based on the loss value; wherein, for a first type of terminal among the N terminals, the feature vector of the first type of terminal is generated based on a proprietary feature vector and a shared feature vector of the first type of terminal; for a second type of terminal among the N terminals, the feature vector of the second type of terminal is a proprietary feature vector of the second type of terminal; and the shared feature vector is generated based on the time series data of the N terminals. In this way, multiple terminals use the same feature extractor and backbone network training. For the first type of terminals, shared feature vectors and proprietary feature vectors are used for training, and for the second type of terminals, proprietary feature vectors are used for training. This solves the problem of huge differences in the amount of training data for different terminals in the same area. That is, multiple terminals in the same area are jointly trained to obtain anomaly detection models corresponding to multiple terminals, which improves the efficiency, accuracy, interpretability and reliability of network quality detection in the park.

[0096] The technical solution of the embodiment of the present application is illustrated below with reference to specific application examples.

[0097] The existing 5G private network management platform configures thresholds based on manual experience to identify abnormal network quality data of terminals. However, due to differences in services, the network quality data values ​​of different private network parks vary greatly, and thresholds need to be configured one by one. Usually, unsupervised anomaly detection is performed on each terminal in each park through AI intelligent algorithms. Specifically, identification of abnormal network quality of each terminal: In the same business scenario (such as browsing and downloading scenario), by learning the network quality data of different terminals in the same area (park) during operation, the normal (no network quality complaint) operation mode of the terminal is identified. When the network quality data of a certain time period does not meet the characteristics during training, it is judged as abnormal (pattern abnormality). Model self-iteration: If the anomaly is not processed within the recovery period (such as 2 weeks), the anomaly detection model uses the data set containing the abnormal data as training data, retrains the anomaly detection model, and relearns the network quality change pattern of the terminal operation. However, in actual operation of the park, the operation volume of each terminal is different, and the network quality data of the terminal with a small operation volume in the same time period is also small. When the model is self-iterated in the original solution, due to the small amount of training data of individual terminals in the same time period, it is difficult to learn its characteristics during the model training process, resulting in low accuracy of abnormal detection of these terminals. Therefore, the technical solution of the embodiment of the present application is based on the transformer method and comparative learning, which solves the problem of the difference in the amount of training data of each terminal during the self-training of the anomaly detection model of the communication private network, and proposes a joint learning method in which each terminal shares common features. That is, a joint learning method for multiple terminals in the same area, in which multiple terminals use the same feature extractor and backbone network to simultaneously train the anomaly detection model. However, in each round of iteration (epoch), the common features of the park are extracted and shared with the terminals with less data to enter the next round of iterative learning.

[0098] Figure 2 This is a flow chart of the model training method provided in the embodiment of the present application. Figure 2 ;like Figure 2 As shown, first obtain the time series indicators of terminal A, terminal B and terminal C, respectively pass through the terminal feature extractor and the backbone network, and obtain anomaly detection model A, anomaly detection model B and anomaly detection model C for multi-terminal joint learning. The specific instructions are as follows:

[0099] 1. Data Source

[0100] The data source (equivalent to the aforementioned time series data) is the network quality data of different terminals in the same area arranged in chronological order, such as TCP link establishment delay, first packet delay, HTTP response delay and other indicators. These indicator data are separated according to the minute granularity of different terminals and input into the feature extractor in the form of a single or multiple indicator combination. The specific terminal multiple indicator input example is shown in Table 1 above, which will not be repeated here.

[0101] 2. Terminal Feature Extractor

[0102] 1) Trend feature extraction

[0103] The original time series (y t ) is decomposed into trend terms (T t ), cycle (S t ) and residual (R t ), t is the time point, where the cycle refers to a pattern that repeats in a fixed or non-fixed period in a time series, usually manifested as repeated highs and lows over a period of time. The residual is what is left after decomposing the time series data into trends and cycles. It can also be considered as just statistical noise or the impact of temporary events. The STL decomposition method can be used to decompose the time series data into trend terms, cycles, and residuals. The specific representation of time series data is as follows:

[0104] y t =T t +S t +R t

[0105] The trend term (T t )Add to the data table, T t The calculation formula is as follows:

[0106]

[0107] in represents the average value of all observations in the time series v, v(j) represents the observation value at the jth time point in the time series v, represents the average value of all time points in the time series v, α0 represents the trend constant, α1 is the slope of the trend; t(j) represents the time point corresponding to the jth observation.

[0108] 2) Temporal feature extraction

[0109] x is the week number, y is the week feature, y=x / 7, and the y value is rounded to two decimal places, such as 0.14 for Monday. Add the week feature to the data table, and convert the time to a timestamp. The specific data table for adding time feature data is shown in Table 2 above, and will not be repeated here.

[0110] 3) Data preprocessing

[0111] Normalize the data in the data table (except the time column). The normalization of each value is calculated as follows:

[0112]

[0113] Among them, z1 is the normalized data table, z is the data table to be normalized, and z min is the minimum value of the index of the data to be normalized, z maxis the maximum value of the indicator of the data to be normalized. The normalized data table is divided into data batches and the dimension is converted to obtain z'1. For example: the training set length is 70589, there are three columns (time column, http response delay column, week column), the batch size is set to 128, the window length is 2048, and z'1 is a three-dimensional matrix with a shape of (128, 2048, 3).

[0114] 4) Location information embedding:

[0115] The normalized data table (v z ) to perform vector conversion and position encoding. The position encoding is calculated as follows:

[0116]

[0117] Among them, pos is equivalent to the position of each value in the time series in the entire time series, 2i refers to the even dimension in the vector dimension, 2i+1 is the odd dimension in the vector dimension, and d represents the output dimension of the neural network embedding layer (such as 512).

[0118] 5) Timing Patching

[0119] The time series is divided into m Patches, and the sequence in each Patche uses a fully connected layer to obtain the corresponding patch embedding vector. Each patch is regarded as a whole and input into the subsequent model. Figure 3 This is a schematic diagram of the timing patch provided in an embodiment of the present application.

[0120] 3. Backbone network

[0121] The backbone network performs feature learning through an encoder to learn the multivariate data features or patterns of the current terminal. Each patch in the multivariate time series data of the training set is input into the encoder to extract the corresponding deep time series feature H t =[h1,h2,h3...h m ], the encoder consists of n layers of attention blocks connected in sequence and 1 fully connected layer. Each attention block is calculated as follows:

[0122]

[0123] The same input is calculated through different fully connected layers to obtain vectors Q, K, and V. dk is the dimension of the K vector, and softmax normalizes the vector. The Attention block result is converted to H after a fully connected layer. tAfter the encoder, two fully connected layers are used to form a feedforward network and perform layer normalization to output the feature vector A. t .

[0124] Among them, the backbone network is a neural network used for network anomaly detection, and the backbone network after training is the anomaly detection model of each terminal.

[0125] 4. Multi-terminal joint learning algorithm

[0126] Figure 4 is a schematic diagram of an algorithm flow of a terminal with more or less training data in a multi-terminal joint learning algorithm provided by an embodiment of the present application; Figure 4 As shown in the figure, for the original terminal samples with more training data, after the feature extractor and backbone network, H t and A t , and then get the difference sample feature H′ t and A′ t , and then the backbone network is calculated as a function, and it is iterated according to the epoch number setting, and finally the anomaly detection model for the terminal with more training data is obtained; for the original terminal sample with less training data, H is obtained through the feature extractor and the backbone network. t and A t For this type of terminal, it is also necessary to obtain the feature sharing vector, update the vector of this type of terminal, and obtain the final H t and A t , and then get the difference sample feature H t ' and A t ', and then the backbone network is calculated as a function, and iterated according to the epoch number setting, and finally the anomaly detection model for terminals with less training data is obtained. The specific description is as follows:

[0127] The training data amounts of the terminals in the same region are sorted. The terminals at the end of the sorting sequence and whose numbers are less than 1 / 2 of the midpoint of the sorting sequence are the terminals with small training numbers, and the rest are the terminals with large training numbers.

[0128] Feature Sharing

[0129] Shared vector extraction: average the data of each column of each terminal of the data source to the hourly granularity, combine all terminal data to form regional-level data, input the terminal feature extractor, and extract common features through the backbone network in each iteration. Taking the first iteration as an example, in the first iteration of the backbone network (epoch), the common features are stored / updated in the shared vector H after completing the first iteration. share and A share .

[0130] Terminal vector update: For terminals with small amount of training data, the data is generated by the backbone network Hless , wait for the shared vector of this iteration to be updated, and then calculate the new terminal vector: H l ' ess =Net(H less +H share ), where Net is the fully connected layer of the neural network, and the added matrix is ​​scaled to the sum of H less The same dimensions, where H′ less This is the final H of this round. t . t Input the feedforward network and normalize the layer to get A t , H t and A t As the backbone network output for terminals with small amount of training data.

[0131] Differential sample feature generation

[0132] Add noise to each column of data (except the time column) in the normalized data table (z1) of each terminal to enhance the ability to distinguish network features. The calculation formula is as follows:

[0133]

[0134] Among them, z2 is the difference sample after adding noise, β is the correlation coefficient, which can be 1 / 3 by default; the current value of the time series is divided into pache according to the pache length, is the maximum value of the current pache, It is the minimum value of the current pache; Refers to a Gaussian distribution with a mean of 0 and a variance of 1. The difference samples of each terminal are input into the terminal feature extractor and the backbone network to obtain the difference feature H of each terminal. t ' and A t '.

[0135] Backbone network loss function calculation

[0136] Convert the dimension of the data preprocessing result z'1 during terminal feature extraction into H patch For example, z'1 is a 3D matrix with a shape of (128, 2048, 3). The patch length is set to 32, H patch It is a three-dimensional matrix with a shape of (128, 2048 / 32, 2048*3 / (2048 / 32))=(128, 64, 96).

[0137] According to the following formula, the loss of this round of training is calculated by the distribution distance between the original sample and the output features of this round of training, the distribution distance between the original sample and the difference sample features, and the gap between the output features of this round of training and the difference sample features:

[0138]

[0139] LOSS=(dist t +dist t ')-δ(dist a +dist' a )

[0140] Where γ and δ are scaling factors, l t , l t '、l a , l' a is the vector H t , H t '、A t and A t ', scale the calculation results to the same order of magnitude, LOSS is the final loss function, back-propagates to the next round of iteration to optimize the model until the maximum number of iterations, and outputs N models corresponding to the number of N terminals.

[0141] The technical solution of the embodiment of the present application designs a multi-terminal joint learning algorithm to conduct joint learning (a form of multi-task learning) on ​​terminals in the same area (the park is a scenario) with huge differences in the amount of training data. Design a method for generating samples of industry network quality data differences and a loss function. Design a multi-terminal joint learning algorithm that pays attention to specific values ​​while paying attention to distribution differences. Design a method for generating samples of industry network quality data differences and a loss function, and use the concept of comparative learning to solve the problem of lack of labels for industry network park data. It can improve the accuracy, interpretability and reliability of anomaly detection,

[0142] Figure 5 Schematic diagram of the structure of the model training device provided in the embodiment of the present application. Figure 5 As shown, the model training device includes:

[0143] An acquisition unit 501 is used to acquire time series data of N terminals, where the time series data includes network indicator data corresponding to multiple times, and N is a positive integer greater than 1;

[0144] Processing unit 502 is used to process the time series data of each terminal among N terminals through a feature extractor to obtain an embedding vector of the terminal; process the embedding vector of the terminal through a backbone network to obtain a feature vector of the terminal; calculate the loss value of the backbone network based on the feature vector of the terminal and the difference feature vector of the terminal, and update the parameters of the backbone network based on the loss value; wherein, for a first type of terminal among the N terminals, the feature vector of the first type of terminal is generated based on a unique feature vector and a shared feature vector of the first type of terminal; for a second type of terminal among the N terminals, the feature vector of the second type of terminal is a unique feature vector of the second type of terminal; and the shared feature vector is generated based on the time series data of the N terminals.

[0145] In some embodiments, the processing unit 502 is also used to perform the following processing on the terminal's time series data through a feature extractor: extract feature data of the time series data, the feature data including trend feature data and / or time feature data; construct a first data table based on the time series data and the feature data; normalize the data in the first data table to obtain a second data table; generate M embedding vectors based on the second data table, where M is a positive integer greater than 1; the M embedding vectors correspond to the M time series patches.

[0146] In some embodiments, the backbone network includes an encoder and a first fully connected layer; the encoder includes multiple attention modules and a second fully connected layer; the processing unit 502 is used to process the embedding vector of the first type of terminal in the N terminals through multiple attention modules to obtain an attention vector; perform dimension conversion on the attention vector through the second fully connected layer to obtain a first unique feature vector of the first type of terminal; generate a first feature vector of the first type of terminal based on the first unique feature vector and the shared feature vector of the first type of terminal; normalize the first feature vector through the first fully connected layer to obtain a second feature vector of the terminal; for the second type of terminal in the N terminals, process the embedding vector of the second type of terminal through multiple attention modules to obtain an attention vector; perform dimension conversion on the attention vector through the second fully connected layer to obtain a second unique feature vector of the second type of terminal, and use the second unique feature vector of the second type of terminal as the first feature vector of the second type of terminal; normalize the first feature vector through the first fully connected layer to obtain a second feature vector of the second type of terminal.

[0147] In some embodiments, the processing unit 502 is also used to combine the time series data of N terminals into regional-level data; process the regional-level data through a feature extractor to obtain a regional-level embedding vector; and process the regional-level embedding vector through a backbone network to obtain a shared feature vector.

[0148] In some embodiments, the processing unit 502 is further used to add noise to the data in the second data table to obtain a third data table; and process the embedding vector corresponding to the third data table through the backbone network to obtain a first difference feature vector and a second difference feature vector of the terminal.

[0149] In some embodiments, the processing unit 502 is also used to batch divide the data in the second data table to obtain a first data vector; perform dimension conversion on the first data vector to obtain a second data vector; the processing unit 502 is also used to calculate the first distance between the second data vector and the first eigenvector; calculate the second distance between the second data vector and the first difference eigenvector; calculate the third distance and the fourth distance between the second eigenvector and the second difference eigenvector; and calculate the loss value of the backbone network based on the first distance, the second distance, the third distance, and the fourth distance.

[0150] In some embodiments, the processing unit 502 is further used to sort the N terminals in order of the amount of data of the timing data of the N terminals from large to small; classify the terminals whose data amount is less than or equal to a first quantity threshold among the S terminals ranked later in the N terminals as first-category terminals, where S is a positive integer and the first quantity threshold is determined based on the data amount of the terminal ranked in the middle among the N terminals; and classify the terminals other than the first-category terminals among the N terminals as second-category terminals.

[0151] In some implementations, the backbone network is a neural network for network anomaly detection.

[0152] Those skilled in the art should understand that Figure 5 The implementation functions of each unit in the model training device shown can be understood by referring to the relevant description of the aforementioned method. Figure 5 The functions of each unit in the model training device shown can be implemented by a program running on a processor, or by a specific logic circuit.

[0153] Figure 6 It is a schematic structural diagram of a model training device 600 provided in an embodiment of the present application. Figure 6 The model training device 600 shown includes a processor 610, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0154] Alternatively, if Figure 6 As shown, the model training device 600 may further include a memory 620. The processor 610 may call and run a computer program from the memory 620 to implement the method in the embodiment of the present application.

[0155] The memory 620 may be a separate device independent of the processor 610 , or may be integrated into the processor 610 .

[0156] Alternatively, if Figure 6 As shown, the model training device 600 may also include a transceiver 630, and the processor 610 may control the transceiver 630 to communicate with other devices. Specifically, it may send information or data to other devices, or receive information or data sent by other devices.

[0157] The transceiver 630 may include a transmitter and a receiver. The transceiver 630 may further include an antenna, and the number of the antennas may be one or more.

[0158] The model training device 600 can implement the corresponding processes implemented by the model training device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0159] Figure 7 It is a schematic structural diagram of the chip of an embodiment of the present application. Figure 7 The chip 700 shown includes a processor 710, which can call and run a computer program from a memory to implement the method in the embodiment of the present application.

[0160] Alternatively, if Figure 7 As shown, the chip 700 may further include a memory 720. The processor 710 may call and run a computer program from the memory 720 to implement the method in the embodiment of the present application.

[0161] The memory 720 may be a separate device independent of the processor 710 , or may be integrated into the processor 710 .

[0162] Optionally, the chip 700 may further include an input interface 730. The processor 710 may control the input interface 730 to communicate with other devices or chips, and specifically, may obtain information or data sent by other devices or chips.

[0163] Optionally, the chip 700 may further include an output interface 740. The processor 710 may control the output interface 740 to communicate with other devices or chips, and specifically, may output information or data to other devices or chips.

[0164] The chip can implement the corresponding processes implemented by the model training device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0165] It should be understood that the chip mentioned in the embodiments of the present application can also be called a system-level chip, a system chip, a chip system or a system-on-chip chip, etc.

[0166] It should be understood that the processor of the embodiment of the present application may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method embodiment can be completed by the hardware integrated logic circuit or software instructions in the processor. The above processor can be a general processor, a digital signal processor (Digital Signal Processor, DSP), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), a field programmable gate array (Field Programmable Gate Array, FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in the embodiment of the present application can be directly embodied as a hardware decoding processor to perform, or the hardware and software modules in the decoding processor are combined and performed. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, and other mature storage media in the art. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.

[0167] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DR RAM). It should be noted that the memory of the systems and methods described herein is intended to include, but is not limited to, these and any other suitable types of memory.

[0168] It should be understood that the above-mentioned memory is exemplary but not restrictive. For example, the memory in the embodiments of the present application may also be static random access memory (static RAM, SRAM), dynamic random access memory (dynamic RAM, DRAM), synchronous dynamic random access memory (synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (double data rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (synch link DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DR RAM), etc. That is to say, the memory in the embodiments of the present application is intended to include but not limited to these and any other suitable types of memory.

[0169] An embodiment of the present application also provides a computer program product, including a computer program.

[0170] When the computer program is executed by the processor, it implements the corresponding processes implemented by the model training device in each method of the embodiments of the present application. For the sake of brevity, it will not be repeated here.

[0171] An embodiment of the present application also provides a computer-readable storage medium for storing a computer program.

[0172] The computer program enables the computer to execute the corresponding processes implemented by the model training device in each method of the embodiments of the present application. For the sake of brevity, they will not be repeated here.

[0173] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0174] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0175] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0176] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0177] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0178] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0179] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

Claims

1. A model training method, characterized in that: The method comprises: Obtaining time series data of N terminals, where the time series data includes network indicator data corresponding to multiple times, where N is a positive integer greater than 1; For each of the N terminals, the time series data of the terminal is processed by a feature extractor to obtain an embedding vector of the terminal; the embedding vector of the terminal is processed by a backbone network to obtain a feature vector of the terminal; the loss value of the backbone network is calculated based on the feature vector of the terminal and the difference feature vector of the terminal, and the parameters of the backbone network are updated based on the loss value; Among them, for the first type of terminals among the N terminals, the feature vector of the first type of terminals is generated based on the exclusive feature vector and shared feature vector of the first type of terminals; for the second type of terminals among the N terminals, the feature vector of the second type of terminals is the exclusive feature vector of the second type of terminals; and the shared feature vector is generated based on the timing data of the N terminals.

2. The method according to claim 1, characterized in that The step of processing the time series data of the terminal by a feature extractor to obtain an embedding vector of the terminal includes: The time series data of the terminal is processed as follows by the feature extractor: Extracting characteristic data of the time series data, wherein the characteristic data includes trend characteristic data and / or time characteristic data; Constructing a first data table based on the time series data and the feature data; Normalize the data in the first data table to obtain a second data table; M embedding vectors are generated based on the second data table, where M is a positive integer greater than 1; and the M embedding vectors correspond to the M timing patches.

3. The method according to claim 2, characterized in that The backbone network includes an encoder and a first fully connected layer; the encoder includes a plurality of attention modules and a second fully connected layer; The step of processing the embedded vector of the terminal through a backbone network to obtain a feature vector of the terminal includes: For a first type of terminal among the N terminals, the embedding vector of the first type of terminal is processed by the multiple attention modules to obtain an attention vector; the attention vector is dimensionally transformed by the second fully connected layer to obtain a first specific feature vector of the first type of terminal; a first feature vector of the first type of terminal is generated based on the first specific feature vector and the shared feature vector of the first type of terminal; the first feature vector is normalized by the first fully connected layer to obtain a second feature vector of the terminal; For the second type of terminals in the N terminals, the embedding vectors of the second type of terminals are processed by the multiple attention modules to obtain the attention vectors; the attention vectors are dimensionally transformed by the second fully connected layer to obtain the second proprietary feature vectors of the second type of terminals, and the second proprietary feature vectors of the second type of terminals are used as the first feature vectors of the second type of terminals; the first feature vectors are normalized by the first fully connected layer to obtain the second feature vectors of the second type of terminals.

4. The method according to claim 1, characterized in that: The method further comprises: Combining the time series data of the N terminals into regional level data; The region-level data is processed by the feature extractor to obtain a region-level embedding vector; and the region-level embedding vector is processed by the backbone network to obtain the shared feature vector.

5. The method according to claim 3, characterized in that: The method further comprises: Adding noise to the data in the second data table to obtain a third data table; The embedded vector corresponding to the third data table is processed through the backbone network to obtain a first difference feature vector and a second difference feature vector of the terminal.

6. The method according to claim 5, characterized in that The method further comprises: Batch-dividing the data in the second data table to obtain a first data vector; Performing dimension conversion on the first data vector to obtain a second data vector; The calculating the loss value of the backbone network based on the feature vector of the terminal and the difference feature vector of the terminal includes: calculating a first distance between the second data vector and the first feature vector; calculating a second distance between the second data vector and the first difference feature vector; calculating a third distance and a fourth distance between the second eigenvector and the second difference eigenvector; A loss value of the backbone network is calculated based on the first distance, the second distance, the third distance, and the fourth distance.

7. The method according to any one of claims 1 to 6, characterized in that The method further comprises: Sorting the N terminals in descending order of the amount of time series data of the N terminals; Classify the terminals whose data volumes are less than or equal to a first quantity threshold among the S terminals ranked later among the N terminals as the first category of terminals, where S is a positive integer and the first quantity threshold is determined based on the data volumes of the terminals ranked in the middle among the N terminals; Classify the terminals among the N terminals except the terminals of the first category as terminals of the second category.

8. The method according to any one of claims 1 to 6, characterized in that The backbone network is a neural network used for network anomaly detection.

9. A model training device, characterized in that: The device comprises: An acquisition unit, used to acquire time series data of N terminals, wherein the time series data includes network indicator data corresponding to multiple times, and N is a positive integer greater than 1; A processing unit is used to process the time series data of each terminal among the N terminals through a feature extractor to obtain an embedding vector of the terminal; process the embedding vector of the terminal through a backbone network to obtain a feature vector of the terminal; calculate the loss value of the backbone network based on the feature vector of the terminal and the difference feature vector of the terminal, and update the parameters of the backbone network based on the loss value; wherein, for a first type of terminal among the N terminals, the feature vector of the first type of terminal is generated based on a unique feature vector and a shared feature vector of the first type of terminal; for a second type of terminal among the N terminals, the feature vector of the second type of terminal is a unique feature vector of the second type of terminal; and the shared feature vector is generated based on the time series data of the N terminals.

10. A model training device, characterized in that: include: A processor and a memory, the memory being used to store a computer program, the processor being used to call and run the computer program stored in the memory to execute the method according to any one of claims 1 to 8.

11. A computer program product, characterized in that include: A computer program which, when executed by a processor, implements the method according to any one of claims 1 to 8.

12. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein the computer program causes a computer to execute the method according to any one of claims 1 to 8.

Images