Weak supervision anomaly detection method and system based on variational auto-encoder

Abstract

The invention discloses a weak supervision anomaly detection method and system based on a variational auto-encoder, and belongs to electric digital data processing. Firstly, in a data input stage, a mix algorithm is introduced into a normal sample and an abnormal sample of input data, training of a model is enhanced by generating a pseudo sample, the generalization ability and robustness of the model are improved, and therefore the performance of anomaly detection is improved; secondly, in the feature extraction stage, a variational auto-encoder is introduced to serve as a depth generation model, and the idea of the auto-encoder and the concept of a probability graph model are combined; meanwhile, a self-attention mechanism is introduced to an encoder and a decoder, the model can be helped to better pay attention to the features of abnormal samples, input data are reconstructed more accurately, and the feature extraction capacity is further improved. Experimental results on a data set covering a plurality of fields show that the method provided by the invention can effectively improve the detection precision in an anomaly detection task.

Description

Technical Field

[0001] The present invention belongs to the field of electrical digital data processing, and in particular relates to a weakly supervised anomaly detection method and system based on a variational autoencoder. Background Art

[0002] Anomaly detection is an important and fundamental task for many fields such as network anomaly detection, financial fraud detection, and video surveillance. It has been well studied in many application scenarios, and many algorithms have shown good performance on relevant public datasets. However, it is difficult to obtain anomaly samples with annotations, which requires a lot of manpower and resources. It is still a challenge to perform anomaly detection using a small number of anomaly samples with annotations and a large number of normal samples.

[0003] In recent years, with the development of deep learning, deep learning-based methods have opened up new avenues for anomaly detection. Deep learning-based methods are mainly divided into supervised learning methods, unsupervised learning methods, and weakly supervised learning methods. Supervised anomaly detection methods aim to use labeled data to train anomaly detectors to predict normal and abnormal data. Since supervised learning requires a large amount of labeled normal and abnormal data to ensure that the two types of data remain relatively balanced during training, and the labeling of data sets requires a lot of manpower and time costs. Therefore, when performing anomaly detection, most researchers use unsupervised or weakly supervised learning methods. Unsupervised anomaly detection methods aim to use unlabeled data to train a generative model to approximate the distribution of normal samples, which can detect abnormal samples as outliers of the generative model. However, due to the lack of information about abnormal data during training, unsupervised learning models often have low interpretability, which limits their usability in practical applications. Weakly supervised anomaly detection methods aim to use limited, noisy or inaccurately labeled data for model training, successfully solving the problems of scarce labeled data and data imbalance faced in anomaly detection tasks. These methods usually map normal samples and limited abnormal samples into their own unique distributions, thereby efficiently utilizing limited anomaly detection resources. However, building such anomaly detectors faces a significant challenge: the model can easily over-focus on the limited number of abnormal samples and cause overfitting.

[0004] Therefore, how to achieve accurate and efficient anomaly detection has become the current research focus. The existing technology has the problem of overfitting when using data with extremely unbalanced data distribution for anomaly detection. Summary of the invention

[0005] In order to overcome the shortcomings of the above-mentioned prior art, the present invention provides a weakly supervised anomaly detection method and system based on variational autoencoder, which uses variational autoencoder to extract features for anomaly detection, thereby solving the problem of extremely unbalanced data distribution and limited label data in weakly supervised anomaly detection.

[0006] In order to achieve the above-mentioned purpose, the present invention adopts the following technical scheme: a weakly supervised anomaly detection method based on a variational autoencoder, which specifically includes the following steps: Step 1: Through a data processing module, normal samples and abnormal samples in the input data are respectively enhanced; Step 2: Through a detection module, the enhanced data is input into a trained anomaly detection model based on a feature encoding strategy, and the variational autoencoder in the anomaly detection model is used to extract features from the input data for anomaly detection.

[0007] Preferably, the anomaly detection model includes data preprocessing, a feature encoder and an anomaly score generator; the data preprocessing adopts a mixup network and is configured to perform data enhancement on the input data; the feature encoder adopts a variational autoencoder and is configured to extract features from the input data; the anomaly score generator adopts a multilayer perceptron and is configured to calculate the anomaly score of each input sample.

[0008] Preferably, the anomaly detection model adopts the structure of a variational autoencoder and is jointly optimized through a two-stage training process, including pre-training and end-to-end training. The pre-training process aims to maximize the variational lower bound and obtain a basic encoding strategy for the subsequent end-to-end training of the entire network. The end-to-end training process aims to minimize the reconstruction error of the variational autoencoder for normal data and ensure the ability of the anomaly score to distinguish between normal and abnormal data, construct a loss function to constrain the training process, and continuously reduce the difference between the input data and the reconstructed data until the conditions for stopping training are met.

[0009] Preferably, the loss function includes a variational lower bound loss, a reconstruction error loss, and an anomaly score loss; corresponding to the normal distribution in the variational autoencoder, the input vector and reconstruction vector of the variational autoencoder, and the anomaly score generator, respectively; wherein,

[0010] The variational lower bound loss, including reconstruction error loss and KL divergence, is used to reduce the difference between the input sample and the reconstructed sample and make the normal distribution of the encoder output approach the standard normal distribution; the reconstruction error loss sets a threshold, expecting the reconstruction error of the abnormal sample to significantly exceed this threshold, and distinguishing normal samples from abnormal samples; the anomaly score loss expects the anomaly score of the normal sample to conform to the prior distribution, while the anomaly score of the abnormal sample deviates from the prior distribution.

[0011] A weakly supervised anomaly detection system based on a variational autoencoder comprises a data processing module and a detection module; wherein the data processing module is configured to perform data enhancement on normal samples and abnormal samples in input data respectively; and the detection module is configured to input the enhanced data into a trained anomaly detection model based on a feature encoding strategy to detect whether an anomaly occurs.

[0012] An electronic device comprises a memory, a processor, and computer-readable instructions stored in the memory and executable on the processor; wherein the memory is configured to store computer-readable instructions non-temporarily; and the processor is configured to execute computer-readable instructions; wherein when the computer-readable instructions are executed by the processor, the steps in the weakly supervised anomaly detection method based on a variational autoencoder as described above are executed.

[0013] A storage medium non-temporarily stores computer-readable instructions, wherein when the computer-readable instructions are executed by a computer, the steps in the weakly supervised anomaly detection method based on a variational autoencoder as described above are performed.

[0014] The beneficial technical effects brought by the present invention are as follows: the anomaly detection model based on feature encoding strategy proposed by the present invention, firstly, in the data input stage, the mixup algorithm is introduced for the normal samples and abnormal samples of the input data respectively, and the mixup network is used to realize data enhancement of the input data to reduce overfitting; the training of the model is enhanced by generating pseudo samples, and the generalization ability and robustness of the model are improved, thereby improving the performance of anomaly detection; secondly, in the feature extraction stage, the variational autoencoder is introduced as a deep generation model, which combines the idea of ​​the autoencoder and the concept of the probabilistic graph model; the variational autoencoder is used to realize effective extraction of the input data features, further reducing the overfitting problem; by introducing probabilistic latent variables and using the mechanism of variational inference, the model has a stronger modeling ability for data distribution in the latent space, better adapts to complex and changeable data, and shows a stronger generalization ability; finally, a multi-layer perceptron is used to calculate an anomaly score for each input sample, detect whether the input sample is abnormal, and improve the detection accuracy of the model; the self-attention mechanism is introduced in both the encoder and the decoder, which can help the model pay more attention to the characteristics of the abnormal samples, reconstruct the input data more accurately, and further improve the feature extraction ability.

[0015] Experimental results on data sets covering multiple fields show that the method proposed in this paper can effectively improve the detection accuracy in anomaly detection tasks; the anomaly detection model of the present invention shows excellent detection effect in anomaly detection based on variational autoencoder, and can well solve the problem of insufficient number of anomaly samples with annotations. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is the overall framework diagram of the model of the first embodiment; Figure 2 The mixup schematic diagram of the first embodiment; Figure 3 It is the principle diagram of the variational autoencoder of the first embodiment; Figure 4 This is a data preprocessing flow chart of the first embodiment. DETAILED DESCRIPTION

[0017] The present invention is further described in detail below in conjunction with the accompanying drawings and specific embodiments: It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as those commonly understood by ordinary technicians in the technical field to which the present application belongs.

[0018] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0019] Embodiment 1: An embodiment disclosed in the present invention provides a weakly supervised anomaly detection method based on a variational autoencoder, comprising the following steps: inputting data into a trained anomaly detection model to identify whether an anomaly occurs; wherein the anomaly detection model adopts the structure of a variational autoencoder and is jointly optimized through a two-stage training process, including pre-training and end-to-end training. The pre-training process aims to maximize the variational lower bound and obtain a basic encoding strategy for subsequent end-to-end training of the entire network. The end-to-end training process aims to minimize the reconstruction error of the variational autoencoder for normal data and ensure the ability of the anomaly score to distinguish between normal and abnormal data, construct a loss function to constrain the training process, and continuously reduce the difference between the input data and the reconstructed data until the conditions for stopping training are met.

[0020] The anomaly detection model includes data preprocessing, a feature encoder and an anomaly score generator; the data preprocessing adopts a mixup network to perform data enhancement on the input data; the feature encoder adopts a variational autoencoder to extract features from the input data; the anomaly score generator adopts a multilayer perceptron to calculate the anomaly score of each input sample.

[0021] The loss function includes a variational lower bound loss, a reconstruction error loss, and anomaly score loss, which correspond to the normal distribution in the variational autoencoder, the input vector and reconstruction vector of the variational autoencoder, and the anomaly score generator, respectively; wherein the variational lower bound loss includes a reconstruction error loss and a KL divergence, which are respectively used to reduce the difference between the input sample and the reconstructed sample and make the normal distribution of the encoder output approach the standard normal distribution; the reconstruction error loss sets a threshold, and it is expected that the reconstruction error of the abnormal sample can significantly exceed this threshold, thereby effectively distinguishing normal samples from abnormal samples; the anomaly score loss expects that the anomaly score of the normal sample conforms to the prior distribution, while the anomaly score of the abnormal sample deviates from the prior distribution.

[0022] The following describes in detail the implementation process of a weakly supervised anomaly detection method based on a variational autoencoder in this embodiment.

[0023] This embodiment selects multiple public data sets and a human behavior recognition data set collected by itself; constructs a weakly supervised anomaly detection model based on a variational autoencoder; uses the data set to train and test the model, solves the problem of insufficient number of anomaly samples with annotations, effectively utilizes data resources in different application scenarios, and achieves accurate and efficient anomaly detection.

[0024] The specific steps are as follows: S1: Introduction to experimental data; multiple public datasets, including different application scenarios such as network security, financial fraud detection, medical diagnosis, and self-collected human behavior recognition (HAR) datasets are used for evaluation. Among them, NSL-KDD is a dataset from the field of network security, and network attacks are regarded as anomalies in this dataset. Spambase and Arrhythmia are two datasets from the UCI machine learning repository. Spam samples are regarded as anomalies in the Spambase dataset, and the classes with the smallest number of samples, namely 3, 4, 5, 7, 8, 9, 14, and 15, are combined as anomalies in the Arrhythmia dataset. Fraud is a dataset from Kaggle for detecting credit card fraud, in which credit fraud transactions are regarded as anomalies. The other four datasets, namely Cardio, Shuttle, Satellite, and Mammography, are from the ODDS library. Cardio is a heart disease detection dataset, in which patients detected as having the disease are regarded as anomalies. The Shuttle, Satellite, and Mammography datasets regard the smallest category as anomalies. The Storm Event Imagery (Sevir) dataset is a labeled, curated, and spatiotemporally aligned dataset. This dataset contains weather images sampled and aligned by radar (NEXRAD weatherradars) and satellite (GOES-16). Each event in this dataset consists of an image sequence with a resolution of 384km x 384km, a time increment of five minutes, and a time span of 4 hours. This paper uses the first two hours of each event as input data, and uses the last frame of the last two hours to determine whether it is storm weather. The HAR dataset uses a WiFi data collection platform to collect ten daily behaviors such as bending, running, falling, sitting down, and standing up, among which the falling action is considered an abnormality.

[0025] Before using these datasets for anomaly detection, each dataset is preprocessed. First, the missing values ​​are filled with the mean of the corresponding attribute; then, all categorical attributes are encoded once; finally, each attribute is normalized to [0,1]. The details of the datasets are shown in Table 1. D is the dimension of the preprocessed data. N is the number of instances in the dataset. Represents the percentage of labeled anomalies in the training dataset.

[0026] Table 1: Details of the dataset

[0027] .

[0028] S2: Dataset division: The data set in S1 is divided according to a certain ratio, with one part used as a training set to train the model and the other part used as a test set to test the optimization degree of the model. Specifically, the abnormal samples and normal samples of the data set of each application scenario are divided into training set and test set in a ratio of 8:2.

[0029] S3: Construct a weakly supervised anomaly detection model based on a variational autoencoder and perform training and testing. The overall structure of the anomaly detection model designed in this embodiment is as follows: Figure 1 As shown in the figure, the main modules include data preprocessing, feature encoder and anomaly score generator; the model is jointly optimized through a two-stage training process, including a pre-training process and an end-to-end training process, to better detect whether a sample is an abnormal sample.

[0030] The following is an explanation of each module: 1. Data preprocessing: As a key link, one of the core goals of data preprocessing is to optimize the input data to effectively solve the problem of unbalanced data distribution. The present invention introduces the mixup algorithm to preprocess the input data. The algorithm uses linear interpolation technology to finely process the original data to generate new synthetic samples. This process not only enriches the diversity of the training data set, but also significantly expands its scale. Figure 2 As shown, for two samples and And the corresponding tags and , a new synthetic sample will be generated through mixup: in, is a parameter randomly sampled from the Beta distribution, which is used to control the degree of linear combination of two samples. The corresponding synthetic label is: In this way, by linearly combining the original samples, mixup can generate new samples and corresponding labels.

[0031] 2. Feature Encoder: Variational Autoencoder (VAE) is a generative deep learning model that combines the ideas of autoencoders and probabilistic graphical models. It introduces a probabilistic modeling strategy based on the traditional autoencoder architecture. This change not only retains the data reconstruction capability, but also gives the model powerful data generation potential. The principle of VAE is as follows Figure 3 As shown in Figure 1, the input data X is first converted into the parameters of the latent space, namely the mean and variance, through the encoder, which define a normal distribution. Then, using the reparameterization technique, the latent variables are sampled from this distribution , and generates Z by adding noise. Then, the decoder converts Z back to data space to generate reconstructed data , the goal is to make As close as possible to the original input X. During training, the model is optimized by minimizing the KL divergence between the latent distribution and the prior distribution, so that the mean tends to 0 and the variance tends to 1 to learn an effective representation of the data and maintain the continuity of the latent space.

[0032] The present invention uses VAE to extract three factors, namely, latent space, reconstructed residual vector and reconstruction error, as new representations. In order to further improve the feature extraction capability of the model, this paper introduces a self-attention mechanism in the encoder and decoder to replace the traditional multi-layer perceptron (MLP).

[0033] First, the encoder transforms the input data from the original space Mapping to latent space The distribution parameters of ) and log variance ( ), these two parameters define a normal distribution in the latent space . Given an input sample , the potential space of the variational autoencoder can be expressed as: in, are the parameters of the encoder, and are the mean and logarithmic variance respectively. From formula 4, we can get the variance as .

[0034] The latent variables output by the encoder Follows a normal distribution: in, is the identity matrix, which means that the dimensions are independent of each other.

[0035] A normal distribution is obtained through the encoder, and the potential representation It obeys the normal distribution, that is, Therefore, to obtain the potential representation We need to sample from a normal distribution. We use the reparameterization trick and normalize with a normal distribution to get: Right now, It obeys the standard normal distribution with mean 0 and variance 1. Therefore, we introduce ,make , thus converting the original Sampling in The operation is converted from Sample one ,make .

[0036] Assume that the variational autoencoder is The resulting reconstructed vector is , through the decoder we can get: pass Two other factors of feature encoding can be obtained. The first is the reconstruction error, defined as: It is also often used as an indicator of abnormal samples. The second is the reconstructed residual vector, defined as: It is worth noting that the residual vector is normalized by the reconstruction error. Essentially, it represents the direction of the residual vector. In summary, , and As the feature representation of the input data, these three factors uniquely characterize the input sample.

[0037] 3. Anomaly score generator; The anomaly score generator uses the feature representation learned by the variational autoencoder to calculate the anomaly score of each input sample to quantitatively reflect the degree of its deviation from the normal data distribution, thereby efficiently indicating the possibility of sample anomaly. During the training phase, the anomaly score generator is trained so that the scores of normal samples obey the prior distribution, while the abnormal samples deviate from the prior distribution. We use a multi-layer perceptron (MLP) to map the three factors to a scalar. However, as a single-dimensional evaluation indicator, the influence of reconstruction error may be suppressed by the high-dimensional vectors of the other two factors when MLP processes high-dimensional vector data, resulting in its weight in the overall performance evaluation being relatively weakened. To overcome this problem, the reconstruction error is added as an additional dimension to each layer of the MLP, thereby emphasizing the importance of reconstruction error to anomaly detection. For each layer of the MLP, it is defined as: in, and Represents the first Layer and layer, and They are The weights and biases of the layer. is used as an extra dimension, is its corresponding weight. The first layer of MLP , for the last layer is the anomaly score .

[0038] 4. Model training and analysis of experimental results: Three goals should be achieved during the training process: (1) maximizing the variational lower bound (Evidence Lower Bound, ELBO); (2) minimizing the reconstruction error of the variational autoencoder for normal data; (3) ensuring the ability of the anomaly score to distinguish between normal and abnormal data.

[0039] First, maximizing ELBO is equivalent to minimizing the negative ELBO, that is: ELBO is a lower bound on the log-likelihood of the data, which consists of two parts: reconstruction error and KL divergence. KL divergence measures the difference between the potential distribution q(z|x) output by the encoder and the prior distribution p(z). In VAE, the prior distribution is usually assumed to be a standard normal distribution. .

[0040] The calculation formula of KL divergence is: (12); among them, represents the potential distribution encoded by the encoder; represents the standard normal distribution.

[0041] The loss function for maximizing ELBO is as follows: (13); Secondly, minimizing the reconstruction error is equivalent to minimizing At the same time, by setting a reasonable threshold and expecting the reconstruction error of abnormal samples to significantly exceed this threshold, normal samples and abnormal samples can be effectively distinguished. The loss function that minimizes the reconstruction error is as follows: (14);

[0042] in, Indicates whether the current sample is an abnormal sample ( is an abnormal sample); is the threshold set (set to 5 in the implementation); represents the reconstruction error.

[0043] Finally, it is expected that the anomaly score of normal samples conforms to the prior distribution, while the anomaly score of abnormal samples deviates from the prior distribution. Therefore, the following loss function is proposed: (15); among them, Represents the entire system.

[0044] According to equations 9 and 10, the joint loss is obtained: (16); among them, and are the model parameters of the feature encoder and anomaly score generator, respectively; is a hyperparameter used to balance the contribution of the two parts to the overall loss.

[0045] The training process is as follows: the model is jointly optimized through a two-stage training process, including pre-training and end-to-end training. Figure 4As shown in the figure, the pre-training process uses all unlabeled training samples and uses the maximum ELBO loss for pre-training to obtain a basic encoding strategy for the subsequent end-to-end training of the entire network. The end-to-end training process uses all unlabeled data and a small amount of labeled abnormal data on the basis of pre-training. During the training process, an oversampling operation is performed on the unlabeled data. Each batch contains half of the normal samples and abnormal samples, and the mixup algorithm is used for data enhancement. The entire network is jointly optimized end-to-end.

[0046] In the experiment of this embodiment, the proposed method is compared with the other three methods. Specifically, they include FEAWAD, PreNet, and OptlForest. Among these methods, FEAWAD uses an autoencoder for weakly supervised anomaly detection; PreNet uses pairwise relationship prediction for deep weakly supervised anomaly detection; OptlForest uses the optimal isolation forest for unsupervised anomaly detection. The AUC-ROC performance (mean ± standard deviation) of the algorithm of the present invention and the comparison algorithm is shown in Table 2. The AUC-PR performance (mean ± standard deviation) of the algorithm of the present invention and the comparison algorithm is shown in Table 3.

[0047] Table 2: AUC-ROC performance of the algorithm of the present invention and the comparative algorithm (mean ± standard deviation)

[0048] .

[0049] Table 3: AUC-PR performance of the algorithm of the present invention and the comparative algorithm (mean ± standard deviation)

[0050] .

[0051] As can be seen from Table 2 and Table 3, in AUC-ROC, the average performance of this method is 2.2% higher than that of weakly supervised anomaly detection by autoencoder (FEAWAD), 4% higher than that of deep weakly supervised anomaly detection by pairwise relationship prediction (PreNet), and 21.8% higher than that of unsupervised anomaly detection by optimal isolation forest (OptlForest). In AUC-PR, the average performance of this method is 2.4% higher than that of FEAWAD, 6.5% higher than that of PreNet, and 27.4% higher than that of OptlForest. In summary, this algorithm achieves the best average performance among all the compared algorithms.

[0052] In the experiment of this embodiment, ablation analysis is performed to explore the impact of different components on the performance of our proposed method. First, the encoder and decoder are replaced with MLP for comparison with the algorithm of the present invention. Second, the data enhancement is performed without using the mixup algorithm for comparison with the algorithm of the present invention. Finally, anomaly detection is performed using an autoencoder for comparison with the algorithm of the present invention. Table 4 shows the AUC-ROC performance of the ablation experiment; Table 5 shows the AUC-PR performance of the ablation experiment.

[0053] Table 4: AUC-ROC performance of ablation experiments

[0054] .

[0055] Table 5: AUC-PR performance of ablation experiments

[0056] .

[0057] The experimental results are shown in Tables 4 and 5: In AUC-ROC, the method of the present invention is 2.7% higher than the algorithm without self-attention mechanism, 1.2% higher than the algorithm without mixup for data enhancement, and 2.2% higher than the algorithm without variational autoencoder. In AUC-PR, the method of the present invention is 3.5% higher than the algorithm without self-attention mechanism, 1% higher than the algorithm without mixup for data enhancement, and 2.6% higher than the algorithm without variational autoencoder. In summary, the self-attention mechanism has the greatest impact on the performance of the method of the present invention, followed by the variational autoencoder, and finally the mixup algorithm has the least impact.

[0058] In summary, the weakly supervised anomaly detection algorithm proposed in this embodiment can effectively perform open set domain adaptive behavior recognition and is advanced.

[0059] Embodiment 2: An embodiment disclosed in the present invention provides a weakly supervised anomaly detection system based on a variational autoencoder, including a data processing module and a detection module: the data processing module is configured to perform data enhancement on normal samples and abnormal samples in the input data respectively; the detection module is configured to input the enhanced data into a trained anomaly detection model based on a feature encoding strategy to detect whether it is an anomaly; wherein the anomaly detection model based on the feature encoding strategy adopts the structure of a variational autoencoder, with the goal of minimizing the reconstruction error of the variational autoencoder for normal data and ensuring the ability of anomaly scores to distinguish between normal and abnormal data, constructing a loss function to constrain the training process, and continuously reducing the difference between the input data and the reconstructed data until the conditions for stopping training are met.

[0060] Embodiment 3: The purpose of this embodiment is to provide a computer-readable storage medium; a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the steps in a weakly supervised anomaly detection method based on a variational autoencoder as described in the first aspect of the present invention.

[0061] Embodiment 4: The purpose of this embodiment is to provide an electronic device; the electronic device includes a memory, a processor, and a program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps in a weakly supervised anomaly detection method based on a variational autoencoder as described in the first aspect of the present invention are implemented.

[0062] Of course, the above description is not a limitation of the present invention, and the present invention is not limited to the above examples. Changes, modifications, additions or substitutions made by technicians in this technical field within the essential scope of the present invention should also fall within the protection scope of the present invention.

Claims

1. A weakly supervised anomaly detection method based on variational autoencoder, characterized by: The specific steps include: Step 1: Through the data processing module, the normal samples and abnormal samples in the input data are enhanced respectively; Step 2: Through the detection module, the enhanced data is input into the trained anomaly detection model based on feature encoding strategy, and the variational autoencoder in the anomaly detection model is used to extract features from the input data for anomaly detection.

2. The weakly supervised anomaly detection method based on variational autoencoder according to claim 1, characterized in that: Anomaly detection model, including data preprocessing, feature encoder, and anomaly score generator; Data preprocessing, using a mixup network, is configured to perform data augmentation on the input data; A feature encoder, using a variational autoencoder, is configured to extract features from input data; The anomaly score generator, using a multi-layer perceptron, is configured to calculate an anomaly score for each input sample.

3. The weakly supervised anomaly detection method based on variational autoencoder according to claim 1, characterized in that: The anomaly detection model adopts the structure of a variational autoencoder and is jointly optimized through a two-stage training process, including pre-training and end-to-end training. The pre-training process aims to maximize the variational lower bound and obtain a basic encoding strategy for the subsequent end-to-end training of the entire network. The end-to-end training process aims to minimize the reconstruction error of the variational autoencoder for normal data and ensure the ability of anomaly scores to distinguish between normal and abnormal data. A loss function is constructed to constrain the training process, continuously reducing the difference between input data and reconstructed data until the conditions for stopping training are met.

4. The weakly supervised anomaly detection method based on variational autoencoder according to claim 3 is characterized in that: Loss functions, including variational lower bound loss, reconstruction error loss, and anomaly score loss; The normal distribution in the variational autoencoder, the input vector and reconstruction vector of the variational autoencoder, and the anomaly score generator are respectively corresponded; wherein, The variational lower bound loss, including reconstruction error loss and KL divergence, is used to reduce the difference between input samples and reconstructed samples and make the normal distribution of the encoder output approach the standard normal distribution. Reconstruction error loss: a threshold is set, and it is expected that the reconstruction error of abnormal samples can significantly exceed this threshold to distinguish normal samples from abnormal samples; Anomaly score loss expects the anomaly scores of normal samples to conform to the prior distribution, while the anomaly scores of abnormal samples deviate from the prior distribution.

5. A weakly supervised anomaly detection system based on variational autoencoder, characterized by: It includes a data processing module and a detection module; wherein, A data processing module is configured to perform data enhancement on normal samples and abnormal samples in the input data respectively; The detection module is configured to input the enhanced data into a trained anomaly detection model based on a feature encoding strategy to detect whether an anomaly occurs.

Images