Asset detection method, device and related equipment

Abstract

The present application relates to the field of fault detection technology, and in particular to an asset detection method, device and related equipment. The method includes: obtaining the current fingerprint data of the target asset; the fingerprint data includes feature data corresponding to the asset characteristics of the target asset; according to the current fingerprint data, determining the current asset information of the target asset through an isolation tree model; wherein the asset information is asset abnormality information or asset normal information; the isolation tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset. The current rule threshold in the asset detection method provided by the present application is determined based on historical asset abnormality information and historical rule thresholds, so the isolation tree model that applies an updateable rule threshold can sensitively capture changes in the asset characteristics of the target asset during use.

Description

Technical Field

[0001] The present application relates to the field of fault detection technology, and in particular to an asset detection method, device and related equipment. Background Art

[0002] In production and life, in order to determine whether network assets have potential operational risks, it is usually necessary to perform asset anomaly detection based on the fingerprint data of the network assets; among them, network assets include at least servers and network devices, and fingerprint data is the characteristic data of network assets, which indicates accounts, ports, processes or software applications, etc.

[0003] In existing technology, the isolation forest model is commonly used for asset anomaly detection. A trained isolation forest model consists of multiple isolation trees. When the target fingerprint data is input into the model, the isolation trees in the model recursively segment the data corresponding to multiple features in the target fingerprint data using multiple preset detection rules and randomly generated rule thresholds corresponding to each detection rule. The segmentation results of the multiple isolation trees are then used to determine the anomaly detection result for the target fingerprint data.

[0004] In practical applications, since the isolation forest model is trained in an unsupervised manner, the rule thresholds on which it relies for segmenting the target fingerprint data are randomly generated. When the target fingerprint data includes a large amount of data and the gap between abnormal data and normal data is not very obvious, its sensitivity to abnormal data will decrease significantly, resulting in a large number of false positives and missed negatives in its segmentation results, which ultimately leads to the low accuracy of the isolation forest model in asset anomaly detection. Summary of the Invention

[0005] In view of this, the purpose of this application is to provide an asset detection method, device and related equipment to solve the problem in the prior art that the use of the isolation forest model for asset anomaly detection may result in low accuracy.

[0006] In a first aspect, the present application provides an asset detection method, the method comprising:

[0007] Get the current fingerprint data of the target asset;

[0008] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments;

[0009] Determining the current asset information of the target asset using an isolation tree model based on the current fingerprint data;

[0010] Among them, the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolated tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset.

[0011] In a second aspect, the present application provides an asset detection device, the device comprising: a data module and a detection module;

[0012] The data module is used to obtain the current fingerprint data of the target asset;

[0013] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments;

[0014] The detection module is configured to determine the current asset information of the target asset through an isolation tree model based on the current fingerprint data;

[0015] Among them, the asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolated tree model detects the feature data through detection rules and current rule thresholds; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule thresholds of the target asset.

[0016] In a third aspect, the present application provides an electronic device, which includes a processor and a memory, wherein the memory is used to store software programs, and the processor runs or executes the software programs stored in the memory so that the electronic device implements the above-mentioned asset detection method.

[0017] In a fourth aspect, the present application provides a computer-readable storage medium, which is used to store program codes executed by a processor, wherein the program codes include code for implementing the above-mentioned asset detection method.

[0018] Beneficial effects:

[0019] The present application provides an asset detection method, comprising: obtaining current fingerprint data of a target asset; wherein the fingerprint data includes feature data corresponding to M asset features of the target asset; determining current asset information of the target asset using an isolation tree model based on the current fingerprint data; wherein the asset information is asset abnormality information or asset normal information, wherein the asset abnormality information indicates the presence of abnormal data in the fingerprint data, and the asset normal information indicates the absence of abnormal data in the fingerprint data; the isolation tree model detects the feature data using a detection rule and a current rule threshold; the detection rule is preset; and the current rule threshold is determined based on historical asset abnormality information of the target asset and a historical rule threshold;

[0020] In summary, the asset detection method provided by the present application determines the current rule threshold corresponding to each detection rule before the isolation tree model performs asset anomaly detection on the target asset. The current rule threshold is determined based on the historical rule threshold and historical asset anomaly information. Therefore, the isolation tree model that uses the rule threshold that can be determined can sensitively capture the changes in the asset characteristics of the target asset during use, so that the isolation tree model can perform asset anomaly detection on the target asset according to the actual situation of the target asset, and the asset anomaly information obtained by the isolation tree model can better reflect the actual degree of anomaly of the target asset. Therefore, the present application can solve the problem in the prior art that the use of the isolation forest model for asset anomaly detection may result in low accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A flowchart of an asset detection method provided in an embodiment of the present application;

[0023] Figure 2 A schematic diagram of a first update of the current rule threshold provided in an embodiment of the present application;

[0024] Figure 3 A schematic diagram of a second update of the current rule threshold provided in an embodiment of the present application;

[0025] Figure 4 A simplified schematic diagram of the correspondence between target assets, asset features, and feature data provided in an embodiment of the present application;

[0026] Figure 5 A schematic diagram of the structure of an asset detection device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0027] In enterprise operations and equipment management, anomaly detection of network assets helps to promptly determine whether an asset has a fault and the cause of the fault, allowing staff to quickly repair the asset based on the cause of the fault to ensure the normal operation of the asset.

[0028] In actual applications, it is usually necessary to perform asset anomaly detection based on the fingerprint data of the target assets; the target assets include at least servers and network devices, and the fingerprint data is the target feature data, which can be an account, port, process or software application.

[0029] In existing technology, the isolation forest model is commonly used for asset anomaly detection. During training, the isolation forest model specifies the number of detection rules, the number of isolated trees, and the training stop condition. A trained isolation forest model includes multiple isolated trees. While each tree applies the same detection rules, the order in which each tree applies these rules to recursively segment the target fingerprint data input to the model is typically different.

[0030] Among them, the number of detection rules is determined according to the number of asset features possessed by the data in the training data set, and each feature is correspondingly set with a detection rule; the detection rule is used to determine whether the feature data corresponding to the feature in the target fingerprint data is abnormal data (that is, whether the feature data is determined as a leaf node of the isolated tree) based on the randomly generated rule threshold, and the detection rule and the rule threshold are one-to-one corresponding.

[0031] When the target fingerprint data is input into the isolation forest model, the isolated trees in the isolation forest model perform anomaly detection (i.e., recursive segmentation) on the target fingerprint data through multiple detection rules and randomly generated rule thresholds to obtain anomaly detection results (i.e., segmentation results); for example, assuming that the isolation forest model has R isolated trees, isolated tree C r For the preset detection rule A m The randomly generated rule threshold is If input to the isolated tree C r The target fingerprint data corresponds to detection rule A m Asset Characteristics B m Feature data Greater than or equal to Isolated Tree C r The feature data Confirmed as abnormal data (that is, the characteristic data is determined as a leaf node of the isolated tree); 0≤m≤M, where M represents the total number of detection rules and asset features.

[0032] In practical applications, although the isolation forest model can detect asset anomalies, due to its unsupervised training method, its segmentation of target fingerprint data is highly dependent on randomly generated rule thresholds, resulting in its inability to detect based on the actual situation of the asset.

[0033] For example, suppose the isolation forest model has R isolated trees, and the isolated tree C r Preset detection rule A m Used to identify asset feature B in target fingerprint data m Feature data Conduct detection; feature data The number of isolated trees C is 10, which are 1, 2, ..., 10. r According to the random generation rule threshold in [1,10] In actual implementation, due to the isolation tree C m Generated rule thresholds is random, and can be considered as the generated M is evenly distributed in [1,10]. Based on this, it is inferred that R isolated trees will identify 5 feature data as abnormal data. However, according to the actual situation of the asset, when the target fingerprint data corresponds to asset feature B m Feature data When it is greater than or equal to 8, the characteristic data will be confirmed is abnormal data, but in fact only 3 feature data are abnormal data.

[0034] The above-mentioned error phenomenon in asset anomaly detection is caused by the asset feature B in the target fingerprint data. m Feature data This becomes increasingly apparent as the number of data increases. Therefore, we can see that because the isolation forest model relies on randomly generated rule thresholds for segmenting target fingerprint data, its sensitivity to abnormal data decreases significantly when the target fingerprint data contains a large amount of data, resulting in a large number of false positives and false negatives in its segmentation results, ultimately causing the isolation forest model's accuracy in asset anomaly detection to drop significantly.

[0035] To address the above technical issues, this application proposes an asset anomaly detection solution based on a trained isolation tree model, which is an optimization of the isolation forest model. The differences between the isolation tree model and the existing isolation forest model include: ① The current rule threshold used in each asset anomaly detection process is not randomly generated during the detection process, but is determined before the detection process begins;

[0036] The method for determining the current rule threshold can be manually defined, but in order to make the current rule threshold adapt to the changes in the asset characteristics of the target asset during use, the current rule threshold used in each asset anomaly detection process is determined based on the historical asset anomaly information and historical rule threshold of the previous asset anomaly detection process; to a certain extent, the current rule threshold determined in each asset anomaly detection process can reflect the usage performance of the asset characteristics of the target asset.

[0037] In addition, since the current rule threshold in the isolation tree model is not randomly generated, there is no need to train multiple isolation trees to adapt to the distribution characteristics of different feature data like the isolation forest model. Therefore, usually only one isolation tree needs to be trained. In actual implementation, for the purpose of verifying asset anomaly information, an isolation tree can be set in addition to the isolation tree used for asset anomaly detection to verify asset anomaly information. From the above, it can be seen that the differences between the isolation tree model and the existing isolation forest model also include: ② The number of isolation trees in the isolation tree model usually only includes 1.

[0038] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings. Obviously, the embodiments described are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0039] First, the embodiment of the present application provides an asset detection method, such as Figure 1 As shown, Figure 1 This is a flow chart of an asset detection method provided in an embodiment of the present application, the method comprising:

[0040] S110: Acquire current fingerprint data of the target asset;

[0041] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments.

[0042] Specifically, in enterprise operations and equipment management, asset anomaly detection for a target asset is typically performed multiple times at preset intervals. Therefore, the feature data includes both feature data collected at the current moment and feature data collected at at least one historical moment. The current fingerprint data is the fingerprint data required for the current t-th asset anomaly detection; where M and t are both positive integers. In the embodiment of the present application, the fingerprint data is a data matrix; each row of data in the fingerprint data indicates the feature data of multiple asset features of the target asset at a single detection moment, and each column of data in the fingerprint data corresponds to the same asset feature.

[0043] In one implementation, S110 includes steps (1) to (2), as detailed below:

[0044] Step (1): Obtain feature data of M asset features of multiple target assets at the current moment.

[0045] Each target asset corresponds to at least one asset feature. Specifically, in the embodiment of the present application, the asset features of each target asset among multiple target assets are uniformly detected, eliminating the need to perform an asset anomaly detection process for each target asset, which can effectively improve the asset anomaly detection process for target assets. In actual operation, the M asset features can be arranged in a preset order, with asset features located in different positions corresponding to different target assets.

[0046] Step (1) includes: Step (1.1) to Step (1.4), the details of which are as follows:

[0047] Step (1.1): Collect the original data of the target asset;

[0048] M asset features B can be automatically collected through scripts or applications installed in the target asset m The original data at the current moment;

[0049] Step (1.2): Determine the reference data of the target asset;

[0050] The control data indicates asset characteristics B m In practical applications, the ideal situation should be determined based on actual factors such as the age and frequency of use of the target asset. The reference data can be determined based on experience or by the average value of the original data. This application does not impose any specific restrictions on this. The reference data can be inserted into the fingerprint data as a feature data at the time of detection. Steps (1.1) and (1.2) are not executed in any order.

[0051] Step (1.3): Process missing values ​​for original data and control data;

[0052] Check the original data and the control data to see if there are any null values, special characters or NaN (Not a Number, undefined value) attributes. In actual execution, if the detection rule A m Corresponding asset characteristics B m At the current moment, there are missing values ​​in the original data, and the detection rule A m Corresponding asset characteristics B m The feature data at p historical moments are deleted respectively, and then the data matrix of the fingerprint data needs to be filled in.

[0053] Step (1.4): Convert the original data and control data into vectors;

[0054] The original data and reference data are converted into vectors to obtain feature data. In actual implementation, the original data needs to be collected for each asset anomaly detection, and the reference data can be collected according to actual needs. When it is believed that the asset characteristics of the target asset have changed significantly during use, the reference data can be determined accordingly. This application does not make specific restrictions on this.

[0055] Step (2): Merge the feature data of the M asset features at the current moment and the feature data at p historical moments in time sequence to obtain the current fingerprint data.

[0056] Specifically, the example form of fingerprint data can be as follows:

[0057]

[0058] in, Indicates the mth asset feature B required for the current tth asset anomaly detection m In actual implementation, the number of rows and columns of the data matrix can be based on the asset characteristics B m The number of target assets and the number of detection moments are determined, and this application does not make specific restrictions on this; it should be noted that the number of target assets can be multiple and the types of target assets can be multiple.

[0059] In actual implementation, detection rule A m With asset characteristics B m There is a one-to-one correspondence, but asset characteristic B m Can include multiple asset sub-characteristics B' m , provided that the detection rule A m is a logical operation rule; in detail, when multiple asset sub-features B′ m When the corresponding detection rules are all logical operation rules, multiple asset sub-features B′ with the same operation results can be m The integration into an asset feature B m; Asset feature B referred to in the embodiment of this application m For integrated.

[0060] S120: Determine the current asset information of the target asset using an isolation tree model based on the current fingerprint data;

[0061] Among them, the asset information is asset abnormality information or asset normal information. The asset abnormality information indicates that there is abnormal data in the fingerprint data, and the asset normal information indicates that there is no abnormal data in the fingerprint data; the isolated tree model detects the fingerprint data through the detection rules and the current rule threshold; the detection rules are preset, and the current rule threshold is determined based on the historical asset abnormality information and historical rule threshold of the target asset.

[0062] Specifically, the current fingerprint data is input into the isolation tree model, and the isolation tree model is based on the detection rule A. m and the current rule threshold S t,m , for the corresponding asset characteristics B m (p+1) feature data at (p+1) detection moments (including the current moment and p historical moments) Detection is performed based on feature data The corresponding current rule threshold S t,m The arithmetic operation relationship or logical operation relationship between them determines the characteristic data Whether it is abnormal data.

[0063] In the embodiments of this application, Figure 2 As shown, Figure 2 This is a first update diagram of the current rule threshold provided in an embodiment of the present application. After the current anomaly score is obtained in the current t-th asset anomaly detection, it is considered that the current t-th asset anomaly detection is completed. After the current t-th asset anomaly detection is completed, it is necessary to determine the target rule threshold S for the (t+1)-th asset anomaly detection. t+1,m Before the (t+1)th asset anomaly detection, the target rule threshold S t+1,m Update to the current rule threshold S t+1,m , which can be used for the (t+1)th asset anomaly detection.

[0064] In one implementation, the current asset anomaly information includes: a current anomaly score, which indicates the degree of anomaly of the current fingerprint data.

[0065] Specifically, the value of the anomaly score can reflect the degree of anomaly of the fingerprint data;

[0066] The calculation formula for the anomaly score is as follows:

[0067]

[0068] Where, Anomaly Score represents the anomaly score; h(y) represents the path length of the fingerprint data on the isolation tree, y represents the node; c(n) represents the expected average path length, and n represents the number of sample fingerprint data used to determine c(n).

[0069] In one implementation, if the current asset information is current asset abnormality information, after S120, the method further includes: step (3), the details of which are as follows:

[0070] Step (3): Determine the target rule threshold based on the current anomaly score, the current rule threshold, and the threshold update formula;

[0071] The target rule threshold is used to update the current rule threshold in the isolation tree model; the threshold update formula is as follows:

[0072] S t+1,m =S t,m +Q t+1,m (P t -S t,m );

[0073] Where S t+1,m Indicates the target rule threshold corresponding to the mth detection rule to be used when performing the (t+1)th asset anomaly detection on the target asset;

[0074] S t,m Indicates the current rule threshold corresponding to the mth detection rule used in the tth asset anomaly detection for the target asset;

[0075] Q t+1,m Indicates the threshold S corresponding to the target rule t+1,m Target adjustment coefficient;

[0076] P t Indicates the current anomaly score obtained by performing the t-th asset anomaly detection on the target asset.

[0077] Specifically, if the current asset information is current asset abnormality information, it indicates that abnormal data exists in the feature data of the M asset features at the current moment and the feature data at p historical moments.

[0078] It should be emphasized that in the threshold update formula, the target rule threshold S t+1,m , current rule threshold S t,m It is the amount used when processing input data when performing asset anomaly detection on the target asset; the current anomaly score P t The output data after asset anomaly detection for the target asset; the target adjustment coefficient Qt+1,m Does not directly participate in asset anomaly detection for target assets.

[0079] Current rule threshold S t,m The update is based on the detection rule A m Each detection rule A m The current rule thresholds of are determined independently of each other; e.g. Figure 3 As shown, Figure 3 This is a schematic diagram of the second update of the current rule threshold provided in the embodiment of the present application. After the current t-th asset anomaly detection, the current anomaly score P can be obtained. t , target adjustment coefficient Q t+1,m ; Followed by the current abnormal score P t , target adjustment coefficient Q t+1,m and the current rule threshold S t,m , determine the target rule threshold S t+1,m , multiple target rule thresholds S t+1,m are determined independently of each other.

[0080] In one implementation, the current asset abnormality information also includes: the current abnormal data ratio corresponding to the abnormal asset feature including abnormal data in the feature data, and the current abnormal data ratio is the abnormal asset feature B in the current fingerprint data. m The number of abnormal data corresponding to q m The ratio between the number of corresponding feature data (p+1); the current abnormal data ratio is used to update the target adjustment coefficient Q t+1,m After S120, the method further includes steps (4) to (6), the details of which are as follows:

[0081] Step (4): Determine whether there is a current abnormal data proportion among the M current abnormal data proportions whose value is greater than or equal to the corresponding first proportion threshold.

[0082] Specifically, if Figure 4 As shown, Figure 4 This is a simplified schematic diagram of the correspondence between the target assets, asset characteristics and characteristic data provided in the embodiments of the present application. If there is abnormal data in the characteristic data of the asset characteristic at the current moment and the characteristic data at the historical moment, then the asset characteristic is an abnormal asset characteristic. If at least one asset characteristic corresponding to the target asset includes an abnormal asset characteristic, then the target asset is an abnormal asset.

[0083] In actual operation, since the multiple feature data corresponding to each asset feature are determined at the current moment and multiple historical moments respectively, the number of multiple feature data corresponding to each asset feature is the number of detection moments (including the current moment and p historical moments).

[0084] In the embodiment of the present application, the purpose of determining the current abnormal data ratio is to update the target adjustment coefficient Q in the subsequent steps. t+1,m .

[0085] Step (5): Increase the current adjustment coefficient corresponding to the current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold to obtain the corresponding target adjustment coefficient.

[0086] Step (6): Update the current adjustment coefficient corresponding to the remaining current abnormal data ratio to the target adjustment coefficient.

[0087] Specifically, the current anomaly score P t It can indicate the abnormality of the current fingerprint data, but the current abnormality score P t Indicates the current fingerprint data corresponding to all asset features B m Feature data The degree of abnormality of the individual asset characteristics B m Corresponding feature data The abnormality level is not clearly indicated, so when updating the rule threshold, it depends on the current abnormality score P. t , but it is more necessary to be able to clearly indicate the individual asset characteristics B m Corresponding feature data The degree of abnormality, the embodiment of the present application constructs a target adjustment coefficient Q t+1,m .

[0088] Target adjustment coefficient Q t+1,m corresponds to detection rule A m and asset characteristics B m The amount, according to the detection rule A m Corresponding feature data According to the threshold update formula, the target adjustment coefficient Q t+1,m It can indicate the degree of adjustment when updating the target rule threshold, and to some extent, it can also indicate the current anomaly score P t Target adjustment coefficient Q t+1,m The degree of influence; in the current abnormal score P t , current rule threshold S t,m When the target adjustment coefficient Q is kept constant, t+1,m The larger the target rule threshold S is, the t+1,m It will be correspondingly larger.

[0089] In practical applications, since the target adjustment coefficient Q is required t+1,m Ability to clearly indicate individual asset characteristics B mCorresponding feature data Therefore, the present embodiment adjusts the current adjustment coefficient Q by the abnormal data ratio. t,m Update to get the target adjustment coefficient Q t+1,m .

[0090] The proportion of abnormal data can indicate the asset characteristics B m Corresponding feature data In actual application, when asset feature B m When the corresponding abnormal data accounts for a large proportion, it indicates that in addition to fault repair, other methods may need to be taken to reduce the proportion of abnormal data.

[0091] In one implementation, if the current asset information is current asset abnormality information, after S120, the method further includes: steps (7) to (8), the details of which are as follows:

[0092] Step (7): Determine the target asset corresponding to the abnormal asset feature as an abnormal asset.

[0093] Specifically, if Figure 4 As shown, after performing asset anomaly detection on the current fingerprint data of multiple target assets, it is finally necessary to determine the abnormal asset characteristics. In actual operation, the abnormal assets can be determined again based on the abnormal asset characteristics.

[0094] Step (8): Issue an alert for abnormal assets and abnormal asset characteristics.

[0095] Specifically, once an abnormal asset is identified, an alarm can be issued for the current asset abnormal information and abnormal assets, so that staff can perform fault repairs in a timely manner based on the abnormal asset characteristics of the abnormal asset to ensure the normal operation of the target asset.

[0096] Step (9): Execute a verification process for abnormal assets at a preset interval until T ′ The second verification process obtains the abnormal assets T ′ Current asset information.

[0097] Among them, the verification process is the process of determining the current asset information of abnormal assets through the isolation tree model.

[0098] Specifically, after repairing an abnormal asset, since the abnormal asset has a history of failure, it is necessary to focus on monitoring its operation process. In the embodiment of the present application, in addition to basic asset abnormality detection, T is also performed on the abnormal asset. ′ Verification process to obtain T of abnormal assets ′ Current asset information.

[0099] In each verification process, the feature data of at least one asset feature of the abnormal asset at the current moment when the process is executed is obtained, and then the current asset information of the abnormal asset is determined through the isolation tree model based on the feature data of at least one asset feature of the abnormal asset at the current moment and the feature data at p historical moments.

[0100] It should be emphasized that T ′ The verification process is usually carried out between two adjacent asset anomaly detections; it should also be emphasized that the verification process targets abnormal assets, that is, only the characteristic data of at least one asset characteristic of the abnormal asset needs to be counted in the verification process.

[0101] Step (10): Determine T ′ The number of abnormal asset information in the current asset information is T ′ The ratio between them is the current abnormal asset information ratio of abnormal assets.

[0102] Specifically, when T is conducted on abnormal assets ′ After a verification process, you can get T ′ Current asset information, which needs to be determined later ′ The number of abnormal asset information in the current asset information, and then the number of abnormal asset information and T ′ The ratio between the two can be used to obtain the current abnormal asset information ratio of abnormal assets; where T ′ It can be determined according to actual needs, and this application does not make any specific limitations on this.

[0103] In actual operation, the current proportion of abnormal asset information can effectively measure the possibility that the abnormal asset has been successfully repaired. The larger the current proportion of abnormal asset information, the smaller the possibility that the repair of the abnormal asset based on the alarm is successful. The smaller the current proportion of abnormal asset information, the greater the possibility that the repair of the abnormal asset based on the alarm is successful.

[0104] In practical applications, by performing T ′ The second verification process measures the probability that the abnormal asset has been successfully repaired by the proportion of the current abnormal asset information obtained, rather than determining whether the abnormal asset has been successfully repaired by only performing the verification process once to obtain the current asset information. This is because T ′ The multi-verification process can effectively reduce detection errors and human operation errors. It should be noted that performing multiple asset anomaly detections on at least one target asset can also reduce detection errors and human operation errors.

[0105] Step (11): If the current abnormal asset information ratio is greater than or equal to the second ratio threshold, an alarm is issued again for the abnormal assets.

[0106] Specifically, if the current abnormal asset information ratio is greater than or equal to the second ratio threshold, it means that the repair of the abnormal asset based on the alarm is very unlikely to be successful, and it can be considered that the abnormal asset has not been repaired, so another alarm is needed.

[0107] In actual operation, when the alarm is triggered again, step (9) can be repeated until the current abnormal asset information is less than the second proportion threshold; wherein, the second proportion threshold can be determined according to actual needs, and this application does not make specific restrictions on this.

[0108] In summary, the asset detection method provided in the embodiment of the present application determines the current rule threshold S corresponding to each detection rule before the isolation tree model performs asset anomaly detection on the target asset. t,m , current rule threshold S t,m It is determined based on historical rule thresholds and historical asset anomaly information. In addition, since the current fingerprint data used in the embodiment of the present application is a data matrix including feature data at multiple detection moments, the isolation tree model that applies the rule threshold that can be determined can sensitively capture the changes in the asset characteristics of the target asset during use, so that the isolation tree model can perform asset anomaly detection on the target asset based on the actual situation of the target asset, so that the asset anomaly information obtained by the isolation tree model can better reflect the actual degree of anomaly of the target asset.

[0109] Second, the embodiment of the present application provides an asset detection device, such as Figure 5 As shown, Figure 5 This is a structural diagram of an asset detection device provided in an embodiment of the present application, the device includes: a data module 310 and a detection module 320;

[0110] Data module 310, used to obtain current fingerprint data of the target asset;

[0111] The fingerprint data includes feature data corresponding to M asset features of the target asset, and the feature data includes: feature data at the current moment and feature data at historical moments;

[0112] A detection module 320 is configured to determine the current asset information of the target asset using an isolation tree model based on the current fingerprint data;

[0113] Among them, the asset information is asset abnormality information or asset normal information. The asset abnormality information indicates that there is abnormal data in the fingerprint data, and the asset normal information indicates that there is no abnormal data in the fingerprint data; the isolated tree model detects the feature data through the detection rules and the current rule threshold; the detection rules are preset; the current rule threshold is determined based on the historical asset abnormality information and historical rule threshold of the target asset.

[0114] In one implementation, the data module 310 is further configured to obtain feature data of M asset features of multiple target assets at a current moment;

[0115] Among them, each target asset corresponds to at least one asset feature;

[0116] The data module 310 is further configured to merge the feature data of the M asset features at the current moment and the feature data at p historical moments in time sequence to obtain current fingerprint data.

[0117] In one implementation, the current asset anomaly information includes: a current anomaly score, which indicates the degree of anomaly of the current fingerprint data; the data module 310 is further used to determine the target rule threshold based on the current anomaly score, the current rule threshold and the threshold update formula if the current asset information is current asset anomaly information; wherein the target rule threshold is used to update the current rule threshold in the isolation tree model.

[0118] In one implementation, the threshold update formula used by the detection module 320 is as follows:

[0119] S t+1,m =S t,m +Q t+1,m (P t -S t,m );

[0120] Where S t+1,m Indicates the target rule threshold corresponding to the mth detection rule to be used when performing the (t+1)th asset anomaly detection on the target asset;

[0121] S t,m Indicates the current rule threshold corresponding to the mth detection rule used in the tth asset anomaly detection for the target asset;

[0122] Q t+1,m Indicates the threshold S corresponding to the target rule t+1,m Target adjustment coefficient;

[0123] P t Indicates the current anomaly score obtained by performing the t-th asset anomaly detection on the target asset.

[0124] In one implementation, the current asset abnormality information also includes: the current abnormal data ratio corresponding to the abnormal asset features including abnormal data in the feature data, and the current abnormal data ratio is the number q of abnormal data corresponding to the abnormal asset features in the current fingerprint data. m The ratio between the number of corresponding feature data (p+1); the current abnormal data ratio is used to update the target adjustment coefficient Q t+1,m .

[0125] In one implementation, the data module 310 is further configured to determine whether there is a current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold among the m current abnormal data proportions;

[0126] The data module 310 is further configured to increase the current adjustment coefficient corresponding to the current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold value to obtain the corresponding target adjustment coefficient;

[0127] The data module 310 is further configured to update the current adjustment coefficient corresponding to the remaining current abnormal data ratio to the target adjustment coefficient.

[0128] In one implementation, the apparatus further includes: a verification module;

[0129] The verification module is further configured to determine the target asset corresponding to the abnormal asset feature as an abnormal asset if the current asset information is abnormal current asset information;

[0130] The verification module is also used to issue alerts for abnormal assets and abnormal asset characteristics;

[0131] The verification module is also used to execute a verification process for abnormal assets at preset intervals until T ′ Verification process to obtain abnormal assets T ′ Current asset information;

[0132] Among them, the verification process is the process of determining the current asset information of abnormal assets through the isolation tree model;

[0133] The verification module is also used to determine T ′ The number of abnormal asset information in the current asset information is T ′ The ratio between them is used to obtain the current abnormal asset information ratio of abnormal assets;

[0134] The verification module is also used to issue another alarm for abnormal assets if the current proportion of abnormal asset information is greater than or equal to a second proportion threshold.

[0135] Third, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, steps S110 to S120 provided in the above embodiment are implemented.

[0136] Fourth, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, steps S110 to S120 of the above embodiment are executed.

[0137] Fifth, the computer program product provided in this application includes a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the method in the previous method embodiment. For specific implementation, please refer to steps S110 to S120 of the method embodiment, which will not be repeated here.

[0138] In the embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interface, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0139] In addition, the units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0140] Furthermore, the functional modules in each embodiment of the present application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0141] It should be noted that if the function is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0142] In this document, relational terms such as first and second, etc. are used merely to distinguish one entity or operation from another entity or operation, but do not necessarily require or imply any actual relationship or order between these entities or operations.

[0143] The above description is merely an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. An asset detection method, characterized in that: The method comprises: Get the current fingerprint data of the target asset; The fingerprint data includes the Characteristic data of asset characteristics, the characteristic data including: characteristic data at the current moment and characteristic data at historical moments; Determining the current asset information of the target asset using an isolation tree model based on the current fingerprint data; The asset information is asset abnormality information or asset normal information, the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolation tree model detects the feature data using a detection rule and a current rule threshold; the detection rule is preset; and the current rule threshold is determined based on historical asset abnormality information and a historical rule threshold of the target asset; The current asset anomaly information includes: a current anomaly score, the current anomaly score indicating the degree of anomaly of the current fingerprint data; if the current asset information is current asset anomaly information, determining a target rule threshold according to the current anomaly score, the current rule threshold, and a threshold update formula; Wherein, the target rule threshold is used to update the current rule threshold in the isolated tree model; The threshold update formula is as follows: ； In the formula, Indicates that the target asset is The first one to be used for asset anomaly detection a target rule threshold corresponding to each of the detection rules; described Indicates that the current The first one used in the asset anomaly detection the current rule threshold corresponding to each of the detection rules; described Indicates the threshold corresponding to the target rule Target adjustment coefficient; described Indicates that the current The current anomaly score obtained from the secondary asset anomaly detection; The current asset abnormality information also includes: the current abnormal data ratio corresponding to the abnormal asset characteristics including the abnormal data in the feature data, and the current abnormal data ratio is the number of abnormal data corresponding to the abnormal asset characteristics in the current fingerprint data. The number of the corresponding feature data The current abnormal data ratio is used to update the target adjustment coefficient .

2. The method according to claim 1, characterized in that The obtaining of the current fingerprint data of the target asset includes: Get multiple target assets Feature data of asset characteristics at the current moment; wherein each target asset corresponds to at least one asset characteristic; Will The characteristic data of the asset characteristics at the current moment and The feature data of each historical moment are merged in time sequence to obtain the current fingerprint data.

3. The method according to claim 1, characterized in that Before determining the target rule threshold according to the current anomaly score, the current rule threshold, and the threshold update formula, the method further includes: Will The current adjustment coefficient corresponding to the current abnormal data proportion whose value is greater than or equal to the corresponding first proportion threshold among the current abnormal data proportions is adjusted to be larger to obtain the corresponding target adjustment coefficient; The current adjustment coefficient corresponding to the remaining current abnormal data ratio is updated to the target adjustment coefficient.

4. The method according to claim 1, wherein If the current asset information is abnormal current asset information, after determining the current asset information of the target asset using the isolation tree model, the method further includes: Determining the target asset corresponding to the abnormal asset feature as an abnormal asset; issuing an alarm for the abnormal assets and the abnormal asset characteristics; At each preset time interval, a verification process is performed on the abnormal assets until the The verification process obtains the abnormal assets The current asset information; The verification process is a process of determining the current asset information of the abnormal asset through the isolation tree model; Sure The number of abnormal information about the current asset in the current asset information The ratio between them is used to obtain the current abnormal asset information ratio of the abnormal assets; If the current abnormal asset information ratio is greater than or equal to the second ratio threshold, an alarm is issued again for the abnormal assets.

5. An asset detection device, characterized in that: The device includes: a data module and a detection module; The data module is used to obtain the current fingerprint data of the target asset; The fingerprint data includes the Characteristic data of asset characteristics, the characteristic data including: characteristic data at the current moment and characteristic data at historical moments; The detection module is configured to determine the current asset information of the target asset through an isolation tree model based on the current fingerprint data; The asset information is asset abnormality information or asset normal information, where the asset abnormality information indicates that abnormal data exists in the fingerprint data, and the asset normal information indicates that the abnormal data does not exist in the fingerprint data; the isolation tree model detects the feature data using a detection rule and a current rule threshold; the detection rule is preset; the current rule threshold is determined based on historical asset abnormality information and a historical rule threshold of the target asset; the current asset abnormality information includes a current abnormality score, which indicates the degree of abnormality of the current fingerprint data; The detection module is further configured to determine a target rule threshold based on the current anomaly score, the current rule threshold, and a threshold update formula if the current asset information is current asset anomaly information; Wherein, the target rule threshold is used to update the current rule threshold in the isolated tree model; The threshold update formula is as follows: ； In the formula, Indicates that the target asset is The first one to be used for asset anomaly detection a target rule threshold corresponding to each of the detection rules; described Indicates that the current The first one used in the asset anomaly detection the current rule threshold corresponding to each of the detection rules; described Indicates the threshold corresponding to the target rule Target adjustment coefficient; described Indicates that the current The current anomaly score obtained from the secondary asset anomaly detection; The current asset abnormality information also includes: the current abnormal data ratio corresponding to the abnormal asset characteristics including the abnormal data in the feature data, and the current abnormal data ratio is the number of abnormal data corresponding to the abnormal asset characteristics in the current fingerprint data. The number of the corresponding feature data The current abnormal data ratio is used to update the target adjustment coefficient .

6. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory is used to store a software program, and the processor runs or executes the software program stored in the memory so that the electronic device implements the asset detection method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium is used to store program codes executed by a processor, wherein the program codes include code for implementing the asset detection method according to any one of claims 1 to 4.

Images