Asset detection method and device and related equipment

Abstract

The invention relates to the technical field of fault detection, in particular to an asset detection method and device and related equipment. The method comprises the steps of obtaining current fingerprint data of a target asset; the fingerprint data comprises feature data corresponding to asset features of the target assets; determining current asset information of the target asset through an isolated tree model according to the current fingerprint data; wherein the asset information is asset abnormal information or asset normal information; the isolated tree model detects the feature data through a detection rule and a current rule threshold; the detection rule is preset; the current rule threshold value is determined according to the historical asset abnormal information of the target asset and the historical rule threshold value. According to the asset detection method provided by the invention, the current rule threshold value is determined according to the historical asset abnormal information and the historical rule threshold value, so that the isolated tree model applying the rule threshold value capable of being updated can sensitively capture the change condition of the asset characteristics of the target asset in the use process.

Description

Technical Field

[0001] The present application relates to the technical field of fault detection, and in particular to an asset detection method, device and related equipment. Background Art

[0002] In production and life, in order to determine whether network assets have potential operational risks, it is usually necessary to perform asset anomaly detection based on the fingerprint data of the network assets; among them, network assets include at least servers and network devices, and fingerprint data is the characteristic data of network assets, which indicates accounts, ports, processes or software applications, etc.

[0003] In the prior art, an isolation forest model is usually used for asset anomaly detection. The trained isolation forest model includes multiple isolated trees. When the target fingerprint data is input into the model, the isolated trees in the model recursively segment the data corresponding to multiple features in the target fingerprint data through multiple preset detection rules and randomly generated rule thresholds corresponding to each detection rule to obtain segmentation results. Subsequently, the anomaly detection results of the target fingerprint data are determined based on the segmentation results of the multiple isolated trees.

[0004] In practical applications, since the training method of the isolation forest model is unsupervised training, the rule threshold that it relies on for segmenting the target fingerprint data is randomly generated; when the target fingerprint data includes a large amount of data and the gap between abnormal data and normal data is not very obvious, its sensitivity to abnormal data will decrease significantly, resulting in a large number of false positives and false negatives in its segmentation results, which ultimately leads to the low accuracy of the isolation forest model in asset anomaly detection. Summary of the invention

[0005] In view of this, the purpose of the present application is to provide an asset detection method, device and related equipment to solve the problem in the prior art that the use of the isolation forest model for asset anomaly detection may result in low accuracy.

[0006] In a first aspect, the present application provides an asset detection method, the method comprising:

[0007] Get the current fingerprint data of the target asset;

[0008] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments;

[0009] Determine the current asset information of the target asset through an isolation tree model according to the current fingerprint data;

[0010] Among them, the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolated tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset.

[0011] In a second aspect, the present application provides an asset detection device, the device comprising: a data module and a detection module;

[0012] The data module is used to obtain the current fingerprint data of the target asset;

[0013] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments;

[0014] The detection module is used to determine the current asset information of the target asset through an isolation tree model according to the current fingerprint data;

[0015] Among them, the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolated tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset.

[0016] In a third aspect, the present application provides an electronic device, comprising a processor and a memory, wherein the memory is used to store software programs, and the processor runs or executes the software programs stored in the memory so that the electronic device implements the above-mentioned asset detection method.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes include methods for implementing the above-mentioned asset detection method.

[0018] Beneficial effects:

[0019] The present application provides an asset detection method, the method comprising: obtaining current fingerprint data of a target asset; wherein the fingerprint data comprises feature data corresponding to M asset features of the target asset; according to the current fingerprint data, determining the current asset information of the target asset through an isolation tree model; wherein the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that abnormal data does not exist in the fingerprint data; the isolation tree model detects the feature data through a detection rule and a current rule threshold; the detection rule is preset; the current rule threshold is determined according to the historical asset abnormality information and the historical rule threshold of the target asset;

[0020] In summary, the asset detection method provided by the present application determines the current rule threshold corresponding to each detection rule before the isolation tree model performs asset anomaly detection on the target asset. The current rule threshold is determined based on the historical rule threshold and the historical asset anomaly information. Therefore, the isolation tree model that uses the rule threshold that can be determined can sensitively capture the changes in the asset characteristics of the target asset during use, so that the isolation tree model can perform asset anomaly detection on the target asset according to the actual situation of the target asset, and the asset anomaly information obtained by the isolation tree model can better reflect the actual degree of anomaly of the target asset. Therefore, the present application can solve the problem in the prior art that the use of the isolation forest model for asset anomaly detection may result in low accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments of the present application will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0022] Figure 1 A flowchart of an asset detection method provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a first update of the current rule threshold provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of a second update of the current rule threshold provided in an embodiment of the present application;

[0025] Figure 4 A simplified schematic diagram of the correspondence between the target asset, asset features and feature data provided in the embodiment of the present application;

[0026] Figure 5 A schematic diagram of the structure of an asset detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In enterprise operations and equipment management, anomaly detection of network assets helps to promptly determine whether an asset has a fault and the cause of the fault, allowing staff to quickly repair the asset based on the cause of the fault to ensure the normal operation of the asset.

[0028] In practical applications, it is usually necessary to perform asset anomaly detection based on the fingerprint data of the target assets; the target assets include at least servers and network devices, and the fingerprint data is the target feature data, which can be an account, port, process or software application.

[0029] In the prior art, the isolation forest model is usually used for asset anomaly detection. When training, the isolation forest model will specifically set the number of detection rules, the number of isolated trees, and the training stop condition. The trained isolation forest model includes multiple isolated trees. Although the multiple detection rules applied by the multiple isolated trees are the same, the order of the detection rules applied by each isolated tree when applying multiple detection rules to recursively segment the target fingerprint data input to the model is usually different.

[0030] Among them, the number of detection rules is determined according to the number of asset features possessed by the data in the training data set, and each feature is set with a corresponding detection rule; the detection rule is used to determine whether the feature data corresponding to the feature in the target fingerprint data is abnormal data (that is, whether the feature data is determined as a leaf node of the isolated tree) according to the randomly generated rule threshold, and the detection rule and the rule threshold are in one-to-one correspondence.

[0031] When the target fingerprint data is input into the isolation forest model, the isolated trees in the isolation forest model use multiple detection rules and randomly generated rule thresholds to perform anomaly detection (i.e., recursive segmentation) on the target fingerprint data to obtain anomaly detection results (i.e., segmentation results); for example, assuming that the isolation forest model has R isolated trees, isolated tree C r For the preset detection rule A m The randomly generated rule threshold is If input to the isolated tree C r The target fingerprint data corresponds to detection rule A m Asset Characteristics B m Characteristic data Greater than or equal to Isolated Tree C r The feature data Confirm as abnormal data (that is, the characteristic data Determined as the leaf node of the isolated tree); 0≤m≤M, M represents the total number of detection rules and asset features.

[0032] In practical applications, although the isolation forest model can detect asset anomalies, since the training method of the isolation forest model is unsupervised training, its segmentation of target fingerprint data is highly dependent on randomly generated rule thresholds, resulting in its inability to detect based on the actual situation of the asset;

[0033] For example, suppose the isolation forest model has R isolated trees, C isolated trees r The detection rule A preset in m Used to identify asset feature B in target fingerprint data m Characteristic data Conduct detection; feature data The number of is 10, which are 1, 2, ..., 10, and the isolated tree C r According to the random generation rule threshold in [1,10] In actual implementation, due to the isolation tree C m Generated rule thresholds is random, and can be considered as the generated M is evenly distributed in [1,10]. Based on this, it is inferred that R isolated trees will identify 5 feature data as abnormal data. However, according to the actual situation of the asset, when the target fingerprint data corresponds to asset feature B m Characteristic data When it is greater than or equal to 8, the characteristic data will be confirmed are abnormal data, but in fact only 3 feature data are abnormal data.

[0034] The above-mentioned error phenomenon for asset anomaly detection is caused by the corresponding asset feature B in the target fingerprint data. m Characteristic data As the number of is increased, it becomes more obvious. It can be seen that since the rule threshold that the isolation forest model relies on to segment the target fingerprint data is randomly generated, when the target fingerprint data includes a large amount of data, its sensitivity to abnormal data will decrease significantly, resulting in a large number of false positives and false negatives in its segmentation results, and ultimately causing the accuracy of the isolation forest model in asset anomaly detection to drop significantly.

[0035] In order to solve the above technical problems, the present application proposes an asset anomaly detection solution, which is executed based on a trained isolation tree model, which is optimized for an isolation forest model; wherein the differences between the isolation tree model and the existing isolation forest model include: ① the current rule threshold used in each asset anomaly detection process is not randomly generated during the detection process, but is determined before the detection process begins;

[0036] The method for determining the current rule threshold can be manually defined, but in order to make the current rule threshold adapt to the changes in the asset characteristics of the target asset during use, the current rule threshold used in each asset anomaly detection process is determined based on the historical asset anomaly information and historical rule threshold of the previous asset anomaly detection process; to a certain extent, the current rule threshold determined in each asset anomaly detection process can reflect the usage performance of the asset characteristics of the target asset.

[0037] In addition, since the current rule threshold in the isolation tree model is not randomly generated, there is no need to train multiple isolated trees to adapt to the distribution characteristics of different feature data like the isolation forest model, so usually only one isolated tree needs to be trained; in actual implementation, for the purpose of verifying asset abnormality information, an isolated tree can be set in addition to the isolated tree used for asset anomaly detection to verify asset abnormality information; from the above, it can be seen that the differences between the isolation tree model and the existing isolation forest model also include: ② The number of isolated trees in the isolation tree model usually only includes 1.

[0038] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present application.

[0039] First, the embodiment of the present application provides an asset detection method, such as Figure 1 As shown, Figure 1 A flowchart of an asset detection method provided in an embodiment of the present application, the method comprising:

[0040] S110: Acquire current fingerprint data of the target asset;

[0041] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments.

[0042] Specifically, in enterprise operations and equipment management, asset anomaly detection for target assets is usually performed multiple times at intervals of a preset period, so the feature data includes both feature data collected at the current moment and feature data collected at at least one historical moment; the current fingerprint data is the fingerprint data required for the current t-th asset anomaly detection; wherein M and t are both positive integers. In the embodiment of the present application, the fingerprint data is a data matrix; each row of data in the fingerprint data indicates feature data of multiple asset features of the target asset at a detection moment, and the asset features corresponding to each column of data in the fingerprint data are the same.

[0043] In one implementation, S110 includes: Step (1) to Step (2), the details of which are as follows:

[0044] Step (1): Obtain feature data of M asset features of multiple target assets at the current moment.

[0045] Among them, each target asset corresponds to at least one asset feature. Specifically, in the embodiment of the present application, the asset features of each target asset among multiple target assets are uniformly detected, and there is no need to execute an asset anomaly detection process once for each target asset, which can effectively improve the asset anomaly detection process of the target asset; in actual operation, the M asset features can be arranged in a preset order, and asset features located at different positions are used to correspond to different target assets.

[0046] Step (1) includes: Step (1.1) to Step (1.4), the details of which are as follows:

[0047] Step (1.1): Collect the original data of the target asset;

[0048] M asset features B can be automatically collected through scripts or applications installed in the target asset m The raw data at the current moment;

[0049] Step (1.2): Determine the reference data of the target asset;

[0050] The control data indicates asset characteristics B m Characteristic data under ideal conditions. In practical applications, the "ideal conditions" should be determined in combination with actual factors such as the service life and frequency of use of the target asset. The control data can be determined based on experience or by the average value of the original data. This application does not make specific restrictions on this. The control data can be inserted into the fingerprint data as characteristic data at the time of detection. Among them, steps (1.1) and (1.2) are executed in no order;

[0051] Step (1.3): Process missing values ​​for original data and control data;

[0052] Check the original data and the control data to see if there are any null values, special characters or NaN (Not a Number, undefined value) attributes. In actual execution, if the detection rule A m The corresponding asset characteristics B m At the current moment, there are missing values ​​in the original data, and the detection rule A m The corresponding asset characteristics B m The characteristic data at p historical moments are deleted respectively, and then the data matrix of the fingerprint data needs to be filled.

[0053] Step (1.4): Convert the original data and control data into vectors;

[0054] The original data and reference data are converted into vectors to obtain feature data. In actual implementation, the original data needs to be collected for each asset anomaly detection, and the reference data can be collected according to actual needs. When it is believed that the asset characteristics of the target asset have changed significantly during use, the reference data can be determined accordingly. This application does not make any specific limitations on this.

[0055] Step (2): Merge the feature data of the M asset features at the current moment and the feature data at p historical moments in time sequence to obtain the current fingerprint data.

[0056] Specifically, the example form of fingerprint data can be as follows:

[0057]

[0058] in, Indicates the mth asset feature B required for the current tth asset anomaly detection m In actual implementation, the number of rows and columns of the data matrix can be based on the asset characteristics B m The number of target assets and the number of detection moments are determined, and this application does not make any specific limitations on this; it should be noted that the number of target assets can be multiple and the types of target assets can be multiple.

[0059] In actual implementation, detection rule A m With asset characteristics B m There is a one-to-one correspondence, but asset characteristic B m Can include multiple asset sub-characteristics B' m , provided that the detection rule A m is a logical operation rule; in detail, when multiple asset sub-features B′ m When the corresponding detection rules are all logical operation rules, multiple asset sub-features B′ with the same operation results can be m The integration into one asset feature B m; The asset feature B referred to in the embodiment of this application m For integrated.

[0060] S120: Determine the current asset information of the target asset through an isolated tree model according to the current fingerprint data;

[0061] Among them, the asset information is asset abnormality information or asset normal information. The asset abnormality information indicates that there is abnormal data in the fingerprint data, and the asset normal information indicates that there is no abnormal data in the fingerprint data; the isolated tree model detects the fingerprint data through the detection rules and the current rule threshold; the detection rules are preset, and the current rule threshold is determined according to the historical asset abnormality information and the historical rule threshold of the target asset.

[0062] Specifically, the current fingerprint data is input into the isolation tree model, and the isolation tree model is based on the detection rule A. m and the current rule threshold S t,m , for the corresponding asset characteristics B m (p+1) feature data at (p+1) detection moments (including the current moment and p historical moments) Detection is used to detect The corresponding current rule threshold S t,m The arithmetic operation relationship or logical operation relationship between them determines the characteristic data Whether it is abnormal data.

[0063] In the embodiments of the present application, Figure 2 As shown, Figure 2 The first update diagram of the current rule threshold value provided in the embodiment of the present application is as follows: after the current anomaly score is obtained in the current t-th asset anomaly detection, it is considered that the current t-th asset anomaly detection is completed. After the current t-th asset anomaly detection is completed, it is also necessary to determine the target rule threshold value S for performing the (t+1)-th asset anomaly detection. t+1,m ; Before performing the (t+1)th asset anomaly detection, set the target rule threshold S t+1,m Update to the current rule threshold S t+1,m , which can be used for the (t+1)th asset anomaly detection.

[0064] In one implementation, the current asset anomaly information includes: a current anomaly score, which indicates the degree of anomaly of the current fingerprint data.

[0065] Specifically, the value of the anomaly score can reflect the degree of anomaly of the fingerprint data;

[0066] The calculation formula of the anomaly score is as follows:

[0067]

[0068] In the formula, Anomaly Score represents the anomaly score; h(y) represents the path length of the fingerprint data on the isolated tree, y represents the node; c(n) represents the expected average path length, and n represents the number of sample fingerprint data used to determine c(n).

[0069] In one implementation, if the current asset information is current asset abnormality information, after S120, the method further includes: step (3), the details of which are as follows:

[0070] Step (3): Determine the target rule threshold based on the current anomaly score, the current rule threshold and the threshold update formula;

[0071] The target rule threshold is used to update the current rule threshold in the isolated tree model; the threshold update formula is as follows:

[0072] S t+1,m =S t,m +Q t+1,m (P t -S t,m );

[0073] In the formula, S t+1,m Indicates the target rule threshold corresponding to the mth detection rule to be used when performing the (t+1)th asset anomaly detection on the target asset;

[0074] S t,m Indicates the current rule threshold corresponding to the mth detection rule used when performing the current tth asset anomaly detection on the target asset;

[0075] Q t+1,m Indicates the threshold S corresponding to the target rule t+1,m The target adjustment coefficient of

[0076] P t Indicates the current anomaly score obtained by performing the t-th asset anomaly detection on the target asset.

[0077] Specifically, if the current asset information is current asset abnormality information, it indicates that abnormal data exists in the feature data of the M asset features at the current moment and the feature data at p historical moments respectively.

[0078] It should be emphasized that in the threshold update formula, the target rule threshold S t+1,m , Current rule threshold S t,m It is the quantity used when processing the input data when performing asset anomaly detection on the target asset; the current anomaly score P t is the output data after asset anomaly detection for the target asset; target adjustment coefficient Qt+1,m Not directly involved in asset anomaly detection for target assets.

[0079] Current rule threshold S t,m The update is based on the detection rule A m That is, each detection rule A m The current rule thresholds of are determined independently of each other; Figure 3 As shown, Figure 3 This is a schematic diagram of the second update of the current rule threshold provided in the embodiment of the present application. After the current t-th asset anomaly detection, the current anomaly score P can be obtained. t , target adjustment coefficient Q t+1,m ; Followed by the current abnormal score P t , target adjustment coefficient Q t+1,m and the current rule threshold S t,m , determine the target rule threshold S t+1,m , multiple target rule thresholds S t+1,m are determined independently of each other.

[0080] In one implementation, the current asset abnormality information also includes: the current abnormal data ratio corresponding to the abnormal asset feature including abnormal data in the feature data, and the current abnormal data ratio is the abnormal asset feature B in the current fingerprint data. m The number of abnormal data corresponding to m The ratio between the number of corresponding feature data (p+1); the current abnormal data ratio is used to update the target adjustment coefficient Q t+1,m After S120, the method further includes: Step (4) to Step (6), the details of which are as follows:

[0081] Step (4): Determine whether there is a current abnormal data proportion among the M current abnormal data proportions whose value is greater than or equal to the corresponding first proportion threshold.

[0082] Specifically, Figure 4 As shown, Figure 4 A simplified schematic diagram of the correspondence between the target asset, asset features and feature data provided in the embodiment of the present application. If there is abnormal data in the feature data of the asset feature at the current moment and the feature data at the historical moment, then the asset feature is an abnormal asset feature. If at least one asset feature corresponding to the target asset includes an abnormal asset feature, then the target asset is an abnormal asset.

[0083] In actual operation, since the multiple feature data corresponding to each asset feature are determined at the current moment and multiple historical moments respectively, the number of multiple feature data corresponding to each asset feature is the number of detection moments (including the current moment and p historical moments).

[0084] In the embodiment of the present application, the purpose of determining the current abnormal data ratio is to update the target adjustment coefficient Q in the subsequent steps. t+1,m .

[0085] Step (5): Increase the current adjustment coefficient corresponding to the current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold value to obtain the corresponding target adjustment coefficient.

[0086] Step (6): Update the current adjustment coefficient corresponding to the remaining current abnormal data ratio to the target adjustment coefficient.

[0087] Specifically, the current anomaly score P t It can indicate the abnormality of the current fingerprint data, but the current abnormality score P t Indicates the current fingerprint data corresponding to all asset features B m Characteristic data The degree of abnormality of the individual asset characteristics B m The corresponding feature data The abnormality level does not have a clear indication, so when updating the rule threshold, it depends on the current abnormality score P. t , but it is more necessary to be able to clearly indicate the individual asset characteristics B m The corresponding feature data The abnormal degree of the target adjustment coefficient Q is constructed in the embodiment of the present application. t+1,m .

[0088] Target adjustment coefficient Q t+1,m Corresponding to detection rule A m and asset characteristics B m According to the detection rule A m The corresponding feature data The target adjustment coefficient Q t+1,m It can indicate the degree of adjustment when updating the target rule threshold, and to some extent, it can also indicate the current anomaly score P t Target adjustment coefficient Q t+1,m The degree of influence; in the current abnormal score P t , Current rule threshold S t,m When the target adjustment coefficient Q is kept constant, t+1,m The larger the target rule threshold S is, the t+1,m It will be correspondingly larger.

[0089] In practical applications, since the target adjustment coefficient Q is required t+1,m Ability to clearly indicate individual asset characteristics B mThe corresponding feature data Therefore, the present embodiment adjusts the current adjustment coefficient Q by the abnormal data ratio. t,m Update to get the target adjustment coefficient Q t+1,m .

[0090] The proportion of abnormal data can indicate the asset characteristics B m The corresponding feature data In practical applications, when asset feature B m When the corresponding abnormal data accounts for a large proportion, it indicates that in addition to fault repair, other methods may need to be taken to reduce the abnormal data proportion.

[0091] In one implementation, if the current asset information is current asset abnormality information, after S120, the method further includes: step (7) to step (8), the details of which are as follows:

[0092] Step (7): Determine the target asset corresponding to the abnormal asset feature as an abnormal asset.

[0093] Specifically, Figure 4 As shown, after performing asset anomaly detection on the current fingerprint data of multiple target assets, it is ultimately necessary to determine the abnormal asset features. In actual operation, the abnormal assets can be determined again based on the abnormal asset features.

[0094] Step (8): Issue an alarm for abnormal assets and abnormal asset characteristics.

[0095] Specifically, once an abnormal asset is identified, an alarm can be issued for the current asset abnormal information and abnormal assets, so that the staff can perform fault repairs in a timely manner based on the abnormal asset characteristics of the abnormal asset to ensure the normal operation of the target asset.

[0096] Step (9): Perform a verification process for abnormal assets at a preset interval until T ′ The second verification process obtains the abnormal assets T ′ Current asset information.

[0097] Among them, the verification process is the process of determining the current asset information of abnormal assets through the isolation tree model.

[0098] Specifically, after the abnormal asset is repaired, since the abnormal asset has a history of failure, it is necessary to focus on monitoring its operation process. In the embodiment of the present application, in addition to the basic asset abnormality detection, T is also performed on the abnormal asset. ′ Verification process to obtain the T of abnormal assets ′ Current asset information.

[0099] In each verification process, feature data of at least one asset feature of the abnormal asset at the current moment when the process is executed is obtained, and then the current asset information of the abnormal asset is determined through an isolation tree model based on the feature data of at least one asset feature of the abnormal asset at the current moment and the feature data at p historical moments.

[0100] It should be emphasized that T ′ The verification process is usually carried out between two adjacent asset anomaly detections; it should also be emphasized that the verification process is aimed at abnormal assets, that is, only the characteristic data of at least one asset characteristic of the abnormal assets needs to be counted in the verification process.

[0101] Step (10): Determine T ′ The number of abnormal current asset information in the current asset information is T ′ The ratio between them is used to obtain the current abnormal asset information ratio of abnormal assets.

[0102] Specifically, when T is conducted on abnormal assets ′ After a verification process, you can get T ′ Current asset information, which needs to be determined later ′ The number of current abnormal asset information in the current asset information, and then count the number of current abnormal asset information and T ′ The ratio between can be used to obtain the current abnormal asset information ratio of abnormal assets; where T ′ It can be determined according to actual needs, and this application does not make any specific limitations on this.

[0103] In actual operation, the current proportion of abnormal asset information can effectively measure the possibility that the abnormal asset has been successfully repaired. The larger the current proportion of abnormal asset information, the smaller the possibility that the repair of the abnormal asset based on the alarm is successful. The smaller the current proportion of abnormal asset information, the greater the possibility that the repair of the abnormal asset based on the alarm is successful.

[0104] In practical applications, by performing T ′ The reason is that the probability that the abnormal asset has been successfully repaired is measured by the proportion of the current abnormal asset information obtained in the second verification process, rather than determining whether the abnormal asset has been successfully repaired by only performing the verification process once to obtain the current asset information. ′ The multi-verification process can effectively reduce detection errors and human operation errors. It should be noted that performing multiple asset anomaly detections on at least one target asset can also reduce detection errors and human operation errors.

[0105] Step (11): If the current abnormal asset information ratio is greater than or equal to the second ratio threshold, an alarm is issued again for the abnormal assets.

[0106] Specifically, if the current abnormal asset information ratio is greater than or equal to the second ratio threshold, it means that the possibility of successful repair of the abnormal asset based on the alarm is very small, and it can be considered that the abnormal asset has not been repaired, so an alarm is needed again.

[0107] In actual operation, when an alarm is sounded again, step (9) can be repeated until the current abnormal asset information is less than the second percentage threshold; wherein, the second percentage threshold can be determined according to actual needs, and this application does not make any specific limitations on this.

[0108] In summary, the asset detection method provided in the embodiment of the present application determines the current rule threshold S corresponding to each detection rule before the isolated tree model performs asset anomaly detection on the target asset. t,m , current rule threshold S t,m It is determined based on historical rule thresholds and historical asset anomaly information. In addition, since the current fingerprint data used in the embodiment of the present application is a data matrix including feature data at multiple detection moments, the isolation tree model that applies the rule threshold that can be determined can sensitively capture the changes in the asset characteristics of the target asset during use, so that the isolation tree model can perform asset anomaly detection on the target asset based on the actual situation of the target asset, so that the asset anomaly information obtained by the isolation tree model can better reflect the actual degree of abnormality of the target asset.

[0109] Second, the embodiment of the present application provides an asset detection device, such as Figure 5 As shown, Figure 5 This is a schematic diagram of the structure of an asset detection device provided in an embodiment of the present application, the device includes: a data module 310 and a detection module 320;

[0110] Data module 310, used to obtain current fingerprint data of the target asset;

[0111] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments;

[0112] A detection module 320, for determining the current asset information of the target asset through an isolation tree model according to the current fingerprint data;

[0113] Among them, the asset information is asset abnormality information or asset normal information. The asset abnormality information indicates that there is abnormal data in the fingerprint data, and the asset normal information indicates that there is no abnormal data in the fingerprint data; the isolated tree model detects the feature data through the detection rules and the current rule threshold; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and the historical rule threshold of the target asset.

[0114] In one implementation, the data module 310 is further used to obtain feature data of M asset features of multiple target assets at the current moment;

[0115] Among them, each target asset corresponds to at least one asset feature;

[0116] The data module 310 is further used to merge the feature data of the M asset features at the current moment and the feature data at p historical moments in time sequence to obtain the current fingerprint data.

[0117] In one implementation, the current asset anomaly information includes: a current anomaly score, which indicates the degree of anomaly of the current fingerprint data; the data module 310 is also used to determine the target rule threshold based on the current anomaly score, the current rule threshold and the threshold update formula if the current asset information is the current asset anomaly information; wherein the target rule threshold is used to update the current rule threshold in the isolated tree model.

[0118] In one implementation, the threshold update formula used by the detection module 320 is as follows:

[0119] S t+1,m =S t,m +Q t+1,m (P t -S t,m );

[0120] In the formula, S t+1,m Indicates the target rule threshold corresponding to the mth detection rule to be used when performing the (t+1)th asset anomaly detection on the target asset;

[0121] S t,m Indicates the current rule threshold corresponding to the mth detection rule used when performing the current tth asset anomaly detection on the target asset;

[0122] Q t+1,m Indicates the threshold S corresponding to the target rule t+1,m The target adjustment coefficient of

[0123] P t Indicates the current anomaly score obtained by performing the t-th asset anomaly detection on the target asset.

[0124] In one implementation, the current asset abnormality information also includes: the current abnormal data ratio corresponding to the abnormal asset features including abnormal data in the feature data, and the current abnormal data ratio is the number q of abnormal data corresponding to the abnormal asset features in the current fingerprint data. m The ratio between the number of corresponding feature data (p+1); the current abnormal data ratio is used to update the target adjustment coefficient Q t+1,m .

[0125] In one implementation, the data module 310 is further used to determine whether there is a current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold value among the m current abnormal data proportions;

[0126] The data module 310 is further used to increase the current adjustment coefficient corresponding to the current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold value to obtain the corresponding target adjustment coefficient;

[0127] The data module 310 is further used to update the current adjustment coefficient corresponding to the remaining current abnormal data ratio to the target adjustment coefficient.

[0128] In one implementation, the apparatus further includes: a verification module;

[0129] The verification module is further used to determine the target asset corresponding to the abnormal asset feature as an abnormal asset if the current asset information is current asset abnormal information;

[0130] The verification module is also used to issue alerts for abnormal assets and abnormal asset characteristics;

[0131] The verification module is also used to perform a verification process for abnormal assets at a preset interval until T ′ The verification process obtains the abnormal assets T ′ Current asset information;

[0132] Among them, the verification process is the process of determining the current asset information of abnormal assets through the isolation tree model;

[0133] The verification module is also used to determine T ′ The number of abnormal current asset information in the current asset information is T ′ The ratio between them is used to obtain the current abnormal asset information ratio of abnormal assets;

[0134] The verification module is also used to issue another alarm for abnormal assets if the current abnormal asset information ratio is greater than or equal to a second ratio threshold.

[0135] Third, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements steps S110 to S120 provided in the above embodiment when executing the computer program.

[0136] Fourth, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, steps S110 to S120 of the above embodiment are executed.

[0137] Fifth, the computer program product provided in the present application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method in the previous method embodiment. The specific implementation can refer to steps S110 to S120 of the method embodiment, which will not be repeated here.

[0138] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0139] In addition, the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] Furthermore, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist separately, or two or more modules may be integrated to form an independent part.

[0141] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can essentially be embodied in the form of a software product, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM) random access memory (RAM), disk or optical disk, and other media that can store program codes.

[0142] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0143] The above description is only an embodiment of the present application and is not intended to limit the protection scope of the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. An asset detection method, characterized in that: The method comprises: Get the current fingerprint data of the target asset; The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments; Determine the current asset information of the target asset through an isolation tree model according to the current fingerprint data; Among them, the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolated tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset.

2. The method according to claim 1, characterized in that The obtaining of the current fingerprint data of the target asset includes: Acquire feature data of M asset features of a plurality of target assets at a current moment; wherein each target asset corresponds to at least one asset feature; The feature data of the M asset features at the current moment and the feature data at p historical moments are combined in time sequence to obtain the current fingerprint data.

3. The method according to claim 1, characterized in that The current asset abnormality information includes: a current abnormality score, wherein the current abnormality score indicates the abnormality degree of the current fingerprint data; if the current asset information is the current asset abnormality information, after determining the current asset information of the target asset through an isolation tree model according to the current fingerprint data, the method further includes: Determine a target rule threshold according to the current anomaly score, the current rule threshold and a threshold update formula; The target rule threshold is used to update the current rule threshold in the isolated tree model.

4. The method according to claim 3, characterized in that The threshold update formula is as follows: S t+1,m =S t,m +Q t+1,m (P t -S t,m ); In the formula, the S t+1,m represents the target rule threshold corresponding to the mth detection rule to be used when performing the (t+1)th asset anomaly detection on the target asset; The S t,m represents the current rule threshold corresponding to the mth detection rule used when performing the current tth asset anomaly detection on the target asset; The Q t+1,m Indicates the threshold S corresponding to the target rule t+1,m The target adjustment coefficient of The P t represents the current anomaly score obtained by performing the t-th asset anomaly detection on the target asset.

5. The method according to claim 4, characterized in that The current asset abnormality information also includes: the current abnormal data proportion corresponding to the abnormal asset features including the abnormal data in the feature data, and the current abnormal data proportion is the number q of abnormal data corresponding to the abnormal asset features in the current fingerprint data. m The ratio between the number of the corresponding characteristic data (p+1); the current abnormal data ratio is used to update the target adjustment coefficient Q t+1,m .

6. The method according to claim 5, characterized in that Before determining the target rule threshold according to the current anomaly score, the current rule threshold and the threshold update formula, the method further includes: Increase the current adjustment coefficient corresponding to the current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold among the M current abnormal data proportions to obtain the corresponding target adjustment coefficient; The current adjustment coefficient corresponding to the remaining current abnormal data ratio is updated to the target adjustment coefficient.

7. The method according to claim 5, characterized in that If the current asset information is current asset abnormal information, after determining the current asset information of the target asset by using the isolation tree model, the method further includes: Determining the target asset corresponding to the abnormal asset feature as an abnormal asset; Producing an alarm for the abnormal assets and the abnormal asset features; At each preset time interval, the verification process is executed for the abnormal assets until T ′ The verification process obtains the abnormal asset T ′ The current asset information; Wherein, the verification process is a process of determining the current asset information of the abnormal asset through the isolation tree model; Determine T ′ The number of abnormal information about the current asset in the current asset information is equal to T ′ The ratio between them is used to obtain the current abnormal asset information ratio of the abnormal assets; If the current abnormal asset information ratio is greater than or equal to the second ratio threshold, an alarm is issued again for the abnormal assets.

8. An asset detection device, characterized in that: The device comprises: a data module and a detection module; The data module is used to obtain the current fingerprint data of the target asset; The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments; The detection module is used to determine the current asset information of the target asset through an isolation tree model according to the current fingerprint data; Among them, the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolated tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset.

9. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory is used to store software programs, and the processor runs or executes the software programs stored in the memory so that the electronic device implements the asset detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes include code for implementing the asset detection method according to any one of claims 1 to 7.

Images