Abnormal data identification method and related device

Abstract

The invention discloses an abnormal data identification method and a related device, and relates to the field of data exception identification, and the method comprises the steps: carrying out the preprocessing of to-be-identified data, and obtaining the preprocessing data in a tensor form; inputting the preprocessed data in the tensor form into an abnormal data identification model based on an improved CNN-Transform to obtain abnormal data and an abnormal category in the data to be identified; the abnormal data recognition model based on the improved CNN-Transform comprises an input processing module, a multi-scale feature extraction module, a dynamic feature fusion module, an enhanced attention module and an output module which are sequentially connected in series. According to the method, the abnormal data identification model is constructed by using the improved CNN-Transform, so that the real-time performance and the detection precision of abnormal data identification are improved.

Description

Technical Field

[0001] The present application relates to the field of data anomaly identification, and in particular to an abnormal data identification method and related devices. Background Art

[0002] With the rapid development of 5G technology, the Internet of Things (IoT) and edge computing, the number of devices and sensors in the global network has increased dramatically, generating massive and complex data flows. These data are widely used in smart cities, industrial automation, smart transportation and other fields. However, in the fog computing environment, data transmission and processing face multiple challenges such as delay, instability and security. In particular, the rapid and accurate identification of abnormal data is crucial to the stable operation and security of the system.

[0003] Traditional methods for identifying abnormal data mainly rely on rules or statistical methods, which show obvious limitations when dealing with high-dimensional, nonlinear, and diverse data. In recent years, with the rise of deep learning, convolutional neural networks (CNNs) and Transformer models have shown great potential in complex feature extraction and contextual relationship modeling. However, in fog computing environments, these models are difficult to achieve efficient and accurate abnormal data identification in resource-limited environments. Summary of the invention

[0004] The purpose of this application is to provide an abnormal data identification method and related devices, and to use an improved CNN-Transformer to construct an abnormal data identification model, thereby improving the real-time performance and detection accuracy of abnormal data identification.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides a method for identifying abnormal data, comprising:

[0007] Preprocess the data to be identified to obtain preprocessed data in tensor form;

[0008] The preprocessed data in tensor form is input into an abnormal data recognition model based on an improved CNN-Transformer to obtain abnormal data and abnormal categories in the data to be recognized; the abnormal data recognition model based on the improved CNN-Transformer includes an input processing module, a multi-scale feature extraction module, a dynamic feature fusion module, an enhanced attention module and an output module which are connected in series in sequence.

[0009] In a second aspect, the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned abnormal data identification method.

[0010] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the above-mentioned abnormal data identification method when executed by a processor.

[0011] In a fourth aspect, the present application provides a computer program product, including a computer program, which implements the above-mentioned abnormal data identification method when executed by a processor.

[0012] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0013] The present application provides an abnormal data identification method and related devices, which introduce a multi-scale feature extraction mechanism into the abnormal data identification model to enhance the model's ability to capture abnormal features at different scales, introduce a dynamic feature fusion mechanism to dynamically integrate local and global information to improve the robustness of the model, and introduce an improved attention mechanism to combine spatial attention with channel attention to more accurately locate abnormal points in the data. In addition, the abnormal data identification model constructed by the present invention is more lightweight, which can reduce the computational complexity of the model and make it more adaptable to the actual application requirements in the fog computing environment. Therefore, the identification of abnormal data based on the abnormal data identification model constructed by the present invention can ensure the accuracy and real-time performance of the identification. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0015] Figure 1 This is an application environment diagram of an abnormal data identification method in an embodiment of the present application;

[0016] Figure 2 A flowchart of an abnormal data identification method provided in one embodiment of the present application;

[0017] Figure 3 A schematic diagram of the structure of an abnormal data recognition model based on an improved CNN-Transformer provided in an embodiment of the present application;

[0018] Figure 4A schematic diagram of the structure of a computer device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0019] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0020] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0021] The abnormal data identification method provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal communicates with the server through the network. The data storage system can store the data that the server needs to process. The data storage system can be set up separately, integrated on the server, or placed on the cloud or other servers. The terminal can send the data to be identified to the server. After the server receives the data to be identified, the server pre-processes the data to be identified to obtain the pre-processed data in the form of a tensor; the pre-processed data in the form of a tensor is input into the abnormal data recognition model based on the improved CNN-Transformer to obtain the abnormal data and abnormal categories in the data to be identified. The server can feed back the obtained abnormal data and abnormal categories to the terminal. In addition, in some embodiments, the abnormal data recognition method can also be implemented by a server or a terminal alone, such as the terminal can directly identify the abnormal data for the data to be identified, or the server can obtain the data to be identified from the data storage system and identify the abnormal data.

[0022] The terminals may be, but are not limited to, various desktop computers, laptops, smart phones, tablet computers, IoT devices and portable wearable devices. IoT devices may be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices may be smart watches, smart bracelets, head-mounted devices, etc. The server may be implemented as an independent server or a server cluster consisting of multiple servers, or a cloud server.

[0023] In an exemplary embodiment, Figure 2As shown, a method for identifying abnormal data is provided, and in particular, a method for identifying abnormal data based on CNN-Transformer in a fog computing environment is provided. The method is executed by a computer device, and specifically can be executed by a computer device such as a terminal or a server alone, or can be executed by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server in the example is used to illustrate, including the following steps 101 to 102. Among them:

[0024] Step 101 , preprocessing the data to be identified in the fog computing environment to obtain preprocessed data in the form of tensors.

[0025] Step 102, input the preprocessed data in tensor form into the abnormal data recognition model based on the improved CNN-Transformer to obtain the abnormal data and abnormal categories in the data to be identified; the abnormal data recognition model based on the improved CNN-Transformer includes an input processing module, a multi-scale feature extraction module, a dynamic feature fusion module, an enhanced attention module and an output module connected in series in sequence.

[0026] In the fog computing environment, the existing convolutional neural network (CNN) and Transformer models still face problems such as insufficient multi-scale feature extraction, difficulty in fusing local and global features, and high computational complexity, making it difficult to achieve efficient and accurate abnormal data recognition in a resource-limited environment. To solve the above problems, the above steps 101 to 102 are implemented. First, the multi-scale feature extraction module is used to perform deep feature extraction, which can capture local details and global context information of the data at the same time; secondly, the dynamic feature fusion module is used to adaptively fuse the local features extracted by the convolutional neural network (CNN) with the global features modeled by the Transformer according to the characteristics of the input data, thereby improving the accuracy of feature expression; finally, the enhanced attention module is used to further optimize the important information in the feature map, so that the model can more accurately identify and classify abnormal data. This method is suitable for processing time series data, high-dimensional feature data, and data containing complex spatiotemporal information, especially in real-time anomaly detection of network traffic data. This method significantly improves the detection accuracy and robustness of the model through multiple analyses of data in time and space dimensions.

[0027] Specifically, the present invention introduces a multi-scale feature extraction module that can simultaneously capture local detail information and global context information of the data, avoiding the problem of insufficient feature extraction of the traditional single convolution layer at different scales. Compared with the traditional single-scale convolutional network, the multi-scale feature extraction module of the present invention can more comprehensively mine the spatiotemporal characteristics of the data and improve the feature expression ability of the model. The dynamic feature fusion mechanism proposed in the present invention realizes the dynamic weighting and effective fusion of different feature information by combining the local feature extraction ability of CNN and the global relationship modeling ability of Transformer. Compared with the fixed feature fusion strategy used in traditional methods, the dynamic feature fusion mechanism of the present invention can more flexibly adapt to the diversity of data features and improve the classification accuracy and adaptability of the model. In addition, the abnormal data recognition model based on the improved CNN-Transformer proposed in the present invention is more lightweight in structure while maintaining high feature extraction capabilities, reducing computational complexity, making it more suitable for operation in a fog computing environment with limited resources. Compared with the traditional CNN-LSTM hybrid model, the present invention combines pure convolutional CNN and Transformer to fully utilize the advantages of both in feature extraction and context modeling, avoiding the gradient vanishing problem that may occur when LSTM processes long sequence data, thereby improving the training efficiency and robustness of the model.

[0028] In another exemplary embodiment of the present application, step 101 is to pre-process the data to be identified (data in the fog computing environment), wherein the pre-processing includes:

[0029] 1.1 Data Cleaning

[0030] First, the raw data (data to be identified) collected from the fog computing nodes is cleaned. For records containing a large number of blank values ​​or noise, missing data are filled using missing value processing methods (such as mean filling or interpolation). For data rows with a high proportion of blank values, they are directly deleted to reduce the impact of data anomalies.

[0031] 1.2 Data Normalization

[0032] For numerical data (such as traffic, temperature, delay, etc.), Min-Max normalization or Z-score normalization method is used for normalization processing, and the values ​​are uniformly scaled to a specified range (such as [0, 1] or a mean of 0 and a standard deviation of 1) to reduce the differences between different feature dimensions and improve the convergence speed and stability of the model.

[0033] 1.3 Character feature processing

[0034] For categorical or character data (such as device ID, protocol type, etc.), one-hot encoding is performed to convert each categorical feature into a binary vector. This process converts character features into numerical features, enhancing the model's ability to recognize these features.

[0035] 1.4 Data Slicing

[0036] Set the sliding window hyperparameter T to slice the continuous time series data. The specific operation is:

[0037] 1.4.1 The size of the sliding window is T, and the window is moved with a step size of 1 to divide the original data sequence into multiple subsequences of (T×N) size, where N is the number of feature dimensions.

[0038] 1.4.2 The shape of each segmented data slice is (1×T×N), which means a sequence of T time steps, each time step has N features.

[0039] 1.4.3 Convert these data slices into tensor format as data samples for subsequent model input.

[0040] The preprocessed data is converted into tensor (feature map) form and input into the abnormal data recognition model, so that the convolutional neural network (CNN) can process time series or other multidimensional data like image features, thereby identifying abnormal points in the data.

[0041] In another exemplary embodiment of the present application, in step 102, the input processing module includes a first convolution layer. The first convolution layer is specifically a 1×1 convolution layer, which first performs preliminary processing on the input data in the form of a tensor through a 1×1 convolution layer, and the number of output channels is set to 16, and other numbers of output channels can be set as required. The convolution operation is used to expand the channels of the input feature map to ensure that the model can effectively process multi-dimensional feature data while reducing computational overhead.

[0042] In another exemplary embodiment of the present application, in step 102, in order to fully extract the multi-scale feature information in the input data, a multi-scale feature extraction module is designed. The module includes multiple parallel convolution layers, each using different convolution kernel sizes (such as Figure 31×1, 3×3, 5×5) as shown in the figure, in order to extract features in different spatial ranges. Among them, 1×1 convolution is used to extract fine-grained local features, reducing dimensions while retaining key information. 3×3 convolution is used to extract medium-scale features, taking into account both local details and overall information. 5×5 convolution is used to extract large-scale features and capture broader contextual information in the data. Finally, the outputs of each convolution layer are combined through the concatenation operation to form a feature map containing multi-scale features. Therefore, as Figure 3 As shown, the multi-scale feature extraction module includes a splicing layer and multiple parallel second convolutional layers; the input of each of the second convolutional layers is the output of the input processing module, the outputs of multiple second convolutional layers are used as the input of the splicing layer, and the output of the splicing layer is the output of the multi-scale feature extraction module.

[0043] In another exemplary embodiment of the present application, in step 102, after extracting the multi-scale features, a dynamic feature fusion mechanism is used to fuse the local features extracted by CNN with the global features extracted by Transformer. First, the CNN module extracts local spatial features through convolution operations to reflect the local change patterns of the data. Next, the extracted multi-scale features are input into the Transformer module to perform global contextual relationship modeling, and the global feature associations in the data are captured through a multi-head self-attention mechanism. Finally, the dynamic feature fusion mechanism is used to adaptively adjust the weight distribution of CNN and Transformer features according to the different characteristics of the data, and the two features are fused by weighted sum to form the final feature representation, so as to enhance the model's ability to express complex patterns. Therefore, Figure 3 As shown, the dynamic feature fusion module includes a fusion module, a third convolutional layer and a Transformer layer connected in parallel. The inputs of the third convolutional layer and the Transformer layer are both the outputs of the multi-scale feature extraction module, the outputs of the third convolutional layer and the Transformer layer are the inputs of the fusion module, and the output of the fusion module is the output of the dynamic feature fusion module.

[0044] In addition, when implementing the dynamic feature fusion mechanism, the process of adaptively adjusting weights includes the following steps:

[0045] 1) Feature extraction: First, use CNN to extract local features and Transformer to extract global features. CNN captures the fine-grained spatial features of the input data through convolution operations, while Transformer captures the global contextual relationship through the self-attention mechanism.

[0046] 2) Feature representation: The extracted local features and global features are mapped to the same dimension for subsequent fusion operations. This is achieved through linear transformations (such as fully connected layers).

[0047] 3) Calculate weights: In order to achieve the function of adaptively adjusting weights, a set of weight calculation mechanisms are introduced. This involves the following methods:

[0048] Attention mechanism: After CNN and Transformer feature extraction, the attention mechanism is introduced to calculate the weight of the feature. The weight coefficient can be generated based on the distribution of the input features through a small neural network (such as a multi-layer perceptron), or the self-attention mechanism can be used directly to calculate the weight based on the relationship between the features.

[0049] Feature importance evaluation: Dynamically evaluate the importance of each feature based on its contribution to the classification task. This can be achieved by monitoring the performance indicators of the model during training (such as loss function or accuracy).

[0050] 3) Weighted fusion: Once the weights are obtained, local features and global features can be fused by weighted sum. That is, the final feature representation can be expressed by the following formula:

[0051] F final =α·F CNN +β·F Transformer ;

[0052] Among them, F CNN is the local feature extracted by CNN, F Transformer is the global feature extracted by Transformer, α and β are dynamically calculated weights, and α+β=1.

[0053] Dynamic adjustment means that during the model training process, as the data changes and the model parameters are optimized, the weights α and β can be adaptively adjusted to better adapt to the characteristics of the current data. This enables the model to more effectively utilize the features of CNN and Transformer in different situations, thereby improving the ability to express complex patterns. Therefore, the mechanism of adaptive weight adjustment enables the model to continuously learn and optimize when facing diverse data, thereby improving the accuracy and robustness of abnormal data identification.

[0054] In another exemplary embodiment of the present application, in step 102, the attention mechanism in the Transformer is improved, and an enhanced attention mechanism combining space and channels is introduced. The spatial attention mechanism is used to calculate the attention weights in the spatial dimension of each feature map, emphasizing the important areas in the feature map and ignoring irrelevant information. The channel attention mechanism is used to calculate the attention weights in the channel dimension of each feature map, dynamically adjust the importance of different channels, and ensure that the model pays more attention to key feature channels. Finally, the spatial and channel attention weights are element-wise multiplied with the feature map to obtain an enhanced feature representation, thereby improving the model's ability to identify outliers in complex data. Therefore, Figure 3 As shown, the enhanced attention module includes a multiplication layer, a spatial attention mechanism layer and a channel attention mechanism layer connected in parallel. The inputs of the spatial attention mechanism layer and the channel attention mechanism layer are the outputs of the dynamic feature fusion module, the outputs of the spatial attention mechanism layer and the channel attention mechanism layer are the inputs of the multiplication layer, and the output of the multiplication layer is the output of the enhanced attention module. The output of the spatial attention mechanism layer is a feature map weighted by the spatial dimension, and the output of the channel attention mechanism layer is a feature map weighted by the channel dimension. Finally, the outputs of the two attention mechanism layers are weighted and fused:

[0055] F f ' inal =α′·F c +β′·F s ;

[0056] Among them, α′ and β′ are adjustable parameters, which control the weights of channel attention and spatial attention respectively, or use the adaptive weight generation mechanism to dynamically adjust α′ and β′. c and F s They represent the feature maps output by the spatial attention mechanism layer and the feature maps output by the channel attention mechanism layer respectively.

[0057] The feature map F after weighted fusion of channel and spatial attention mechanism f ' inal , contains information that is more focused on important channels and spatial locations, enabling better anomaly detection.

[0058] In another exemplary embodiment of the present application, in step 102, the enhanced feature map is input into the fully connected layer for dimensionality reduction, and then the output is classified by the Softmax layer to identify the abnormal points in the input data. The final output is a prediction result containing the abnormal category label. The prediction result can contain both the abnormal points in the data and the abnormal category information. Therefore, Figure 3As shown, the output module includes a fully connected layer and a Softmax layer connected in series; the input of the fully connected layer is the output of the enhanced attention module.

[0059] In another exemplary embodiment of the present application, before executing the step of “inputting the preprocessed data in tensor form into the abnormal data recognition model based on the improved CNN-Transformer”, the abnormal data recognition method includes:

[0060] (1) Train and test the abnormal data recognition model based on the improved CNN-Transformer.

[0061] The preprocessed training data set is input into the constructed abnormal data recognition model based on the improved CNN-Transformer for model training. Among them, the optimizer (such as Adam), loss function (such as cross entropy loss), learning rate (such as 0.001), batch size (Batchsize, such as 64) and other hyperparameters for model training are set. Through iterative training, the weight parameters of the model are gradually adjusted to ensure that the model can accurately identify abnormal patterns in the training data. To avoid overfitting, early stopping (Early Stopping) or regularization (such as Dropout) technology can be used. During the training process, the model is evaluated through the validation set, and the hyperparameters are optimized to ensure the generalization performance of the model. After each iteration, the loss value and accuracy index on the training set and validation set are calculated to tune the model parameters.

[0062] (2) Selecting an abnormal data recognition model whose test result reaches a preset effect as the trained abnormal data recognition model.

[0063] Input the preprocessed test set into the trained model to identify and classify abnormal data and record the model's prediction results. Evaluate the performance of the model comprehensively, including accuracy, precision, recall, F1-score and other indicators. Evaluate the application effect of the model in the actual fog computing environment by comparing the actual labels and predicted labels. If the test results are not ideal, you can further fine-tune the model or optimize the preprocessing process to improve the recognition performance of the model.

[0064] (3) Using the trained abnormal data recognition model to perform abnormal data recognition in a fog computing environment.

[0065] Among them, the data set of the present invention can adopt the CIC-IDS2017 data set, which is a data set specially used for network security research provided by the Canadian Institute for Cybersecurity (CIC), and is widely used in the construction and evaluation of intrusion detection systems (IDS). The data set is generated by simulating the modern enterprise network environment, reflecting the common attack behaviors and normal traffic characteristics in the real network. The network traffic data in the data set are collected from July 3 to July 7, 2017, covering five days of network activities. The CIC-IDS2017 data set contains 80 features, which include information such as traffic statistics, time characteristics, protocol types, packet sizes, source and destination IP addresses, etc., which are intended to reflect the details of different network behaviors and help identify various types of intrusion. The attack types in the data set are rich and varied, covering DDoS (distributed denial of service attacks), Brute Force (brute force cracking), Botnet (botnet), WebAttacks (network attacks, such as SQL injection and cross-site scripting attacks), Infiltration (internal penetration), Heartbleed (exploiting OpenSSL vulnerability attacks) and PortScan (port scanning), etc. The existence of these types of attacks makes the CIC-IDS2017 dataset an important tool for studying and evaluating network security algorithms. In addition, the dataset also contains a large amount of normal traffic, simulating the network behavior of ordinary users, such as web browsing, file transfer, and email communication.

[0066] The CIC-IDS2017 dataset uses CSV format, and each line represents a network traffic record. The dataset can be used to train and test machine learning models, and is particularly suitable for research in areas such as anomaly detection and network security situation awareness. Due to its authenticity, completeness, and diversity, the CIC-IDS2017 dataset has become one of the standard test datasets in the field of network security, providing researchers with a comprehensive environment to deeply study the characteristics of various network attacks and develop more effective detection and defense mechanisms.

[0067] Based on the CIC-IDS2017 dataset, the training dataset, validation dataset and test dataset are divided. Before model training, validation and testing, the dataset needs to be preprocessed. The model is trained, validated and tested based on the preprocessed dataset, so as to obtain an abnormal data recognition model with ideal test results.

[0068] The abnormal data identification method provided in this embodiment can be integrated into various hardware devices with data processing and analysis capabilities, such as intelligent gateways, network security devices, fog computing nodes, servers, etc. By embedding this method, these devices can perform real-time and in-depth analysis and processing of incoming data, thereby achieving efficient identification and timely warning of abnormal data and enhancing the security protection capabilities of the system. In addition, the method is suitable for various application scenarios that require large-scale data anomaly detection, including but not limited to industrial Internet of Things (IoT), intelligent transportation systems (ITS), cloud computing platforms, and smart cities, etc., providing efficient and reliable abnormal data detection and analysis solutions.

[0069] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 4 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store identified abnormal data and abnormal categories. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an abnormal data identification method is implemented.

[0070] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components. In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0071] In an exemplary embodiment, a computer-readable storage medium is provided, storing a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0072] In an exemplary embodiment, a computer program product is provided, including a computer program, and when the computer program is executed by a processor, the steps in the above method embodiments are implemented.

[0073] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0074] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0075] The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. The non-relational database may include a distributed database based on blockchain, etc., but is not limited thereto. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but is not limited thereto.

[0076] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0077] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for identifying abnormal data, characterized in that: The abnormal data identification method comprises: Preprocess the data to be identified to obtain preprocessed data in tensor form; The preprocessed data in tensor form is input into an abnormal data recognition model based on an improved CNN-Transformer to obtain abnormal data and abnormal categories in the data to be recognized; the abnormal data recognition model based on the improved CNN-Transformer includes an input processing module, a multi-scale feature extraction module, a dynamic feature fusion module, an enhanced attention module and an output module which are connected in series in sequence.

2. The abnormal data identification method according to claim 1, characterized in that: The input processing module includes a first convolutional layer.

3. The abnormal data identification method according to claim 1, characterized in that: The multi-scale feature extraction module includes a splicing layer and a plurality of parallel second convolutional layers; The input of each of the second convolutional layers is the output of the input processing module, the outputs of multiple second convolutional layers are used as the input of the splicing layer, and the output of the splicing layer is the output of the multi-scale feature extraction module.

4. The abnormal data identification method according to claim 1, characterized in that: The dynamic feature fusion module includes a fusion module, a third convolutional layer and a Transformer layer connected in parallel; The inputs of the third convolutional layer and the Transformer layer are both the outputs of the multi-scale feature extraction module, the outputs of the third convolutional layer and the Transformer layer are the inputs of the fusion module, and the output of the fusion module is the output of the dynamic feature fusion module.

5. The abnormal data identification method according to claim 1, characterized in that: The enhanced attention module includes a multiplication layer, a spatial attention mechanism layer and a channel attention mechanism layer connected in parallel; The inputs of the spatial attention mechanism layer and the channel attention mechanism layer are both the outputs of the dynamic feature fusion module, the outputs of the spatial attention mechanism layer and the channel attention mechanism layer are the inputs of the multiplication layer, and the output of the multiplication layer is the output of the enhanced attention module.

6. The abnormal data identification method according to claim 1, characterized in that: The output module includes a fully connected layer and a Softmax layer connected in series; the input of the fully connected layer is the output of the enhanced attention module.

7. The abnormal data identification method according to claim 1, characterized in that: Before executing the step of "inputting the preprocessed data in tensor form into the abnormal data recognition model based on the improved CNN-Transformer", the abnormal data recognition method includes: Train and test the abnormal data recognition model based on the improved CNN-Transformer; Selecting an abnormal data recognition model whose test result reaches a preset result as a trained abnormal data recognition model; Abnormal data recognition is performed using the trained abnormal data recognition model.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the abnormal data identification method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the abnormal data identification method described in any one of claims 1 to 7 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the abnormal data identification method described in any one of claims 1 to 7 is implemented.

Images