Network data capture and anomaly detection method based on artificial intelligence

Abstract

The invention belongs to the technical field of network data processing, and particularly relates to a network data capture and anomaly detection method based on artificial intelligence. Aiming at the defects in the aspect of network data processing in the prior art, the method comprises the following steps: firstly screening an initial URL list to remove invalid low-value URLs, then identifying a webpage data area by using a model fusing the advantages of a CNN and an RNN, generating an extraction path by using a dynamic XPath algorithm, then calculating fingerprint comparison differences by using a multi-granularity Hash algorithm, and finally detecting data exception in combination with improved DBN and IF algorithms. The method can adapt to complex webpage structure changes, accurately capture data, accurately identify data updating or newly adding, effectively detect abnormal modes, improve data processing efficiency, accuracy and safety, and provide a reliable solution for network data processing.

Description

Technical Field

[0001] The present invention belongs to the technical field of network data processing, and in particular relates to a network data capture and anomaly detection method based on artificial intelligence. Background Art

[0002] In today's era of digital information explosion, the Internet has become a gathering place for massive data. Network data plays a key role in many fields such as business intelligence, market research, and financial risk analysis. However, the complexity, diversity, and dynamic variability of network data have brought great challenges to the effective acquisition and accurate analysis of data. Existing data capture technologies often rely on manually written rules or simple template matching methods. They may be effective for web page data with relatively fixed structures and standardized formats, but they are powerless in the face of increasingly complex and frequently updated web page structures. Different types of web pages have significant differences in layout, tag usage, element nesting, etc., which makes traditional methods seriously lack adaptability when capturing data. At the same time, in the field of data anomaly detection, traditional statistical analysis methods and rule-based detection methods also face many difficulties. Statistical analysis methods have certain assumptions about data distribution, while actual network data often presents complex non-normal distribution and other characteristics, which makes statistical analysis methods prone to high misjudgment rates. Rule-based detection methods require manual pre-definition of a large number of complex rules to identify anomalies, which is not only time-consuming and labor-intensive, but also difficult to cope with the emerging new anomaly patterns. As network attack methods become increasingly diverse and data tampering methods become more covert, higher requirements are placed on the accuracy and timeliness of data anomaly detection. Summary of the invention

[0003] In view of the technical problems existing in the above-mentioned background technology, the present invention proposes a network data crawling and anomaly detection method based on artificial intelligence.

[0004] In order to achieve the above object, the technical solution adopted by the present invention comprises the following steps:

[0005] S1. First, filter the initial URL list to remove invalid and low-value URLs;

[0006] S2. Then, for different types of web pages, a web page structure recognition model based on deep learning is used, and according to the identified data area, a dynamic XPath generation algorithm is used to generate a path expression for extracting data;

[0007] S3, then use the multi-granularity hash algorithm to calculate the fingerprint of each captured data and compare the fingerprint differences;

[0008] S4. Finally, based on the combination of improved deep belief network DBN and isolation forest IF algorithm, the data anomaly is detected. The fused feature vector of the data to be detected is input into the trained anomaly detection model, and the data is judged whether it is abnormal according to the preset threshold;

[0009] The specific implementation of using the dynamic XPath generation algorithm to generate the path expression for extracting data in step S2 is:

[0010] S21. First, for each element in the web page, extract HTML semantic tags, extract keyword vectors of the text in the element, and convert the semantic tags into vector form;

[0011] S22. For any two elements e i and e j , calculate the semantic association strength: in is the similarity of semantic label vectors, is the similarity of keyword vectors, α is the weight coefficient;

[0012] S23, take the web page element as node V = {e1, e2, ..., e n}, construct a directed graph with semantic association strength as edge weight;

[0013] S24. Then find the shortest path, with the root node r and the target node t. d(v) is the shortest distance from the root node r to the node v. Initially, d(r) = 0. For other nodes v≠r, d(v) = ∞. For the node set S with the shortest path determined, initially S = {r}. For the node u not in S, update its shortest distance: where w vu represents the weight of the edge from node v to node u; then the process is repeated until the target node t is added to S, generating the initial XPath expression;

[0014] S25, then perform path optimization, calculate the structure change risk value, web page structure change probability matrix M = (m ij ), where m ij Represents the slave node e i To node e j The structural change probability of i ,v i+1 ) Calculate the structural risk value where depth(v i+1 ) is the node v i+1 The depth in the web page structure is calculated from the root node to v i+1 The number of node layers passed is determined;

[0015] S26. Finally, the path is adjusted. For each node pair (v i ,v i+1 ), if R i,i+1 is greater than the preset threshold, then in the semantic relationship graph G, find the node v i+1 Nodes v with similar semantics and low risk of structural changes i ' +1 , replace the nodes in path P to obtain the optimized XPath expression.

[0016] Preferably, the web page structure recognition model based on deep learning adopted in step S2 adopts a hybrid architecture integrating the advantages of CNN and RNN, wherein the CNN layer is used to extract local features of the web page, and preliminarily extract features of each HTML tag, text block, and image area element in the web page, and slides the convolution kernel on the HTML structure text representation of the web page to capture feature patterns at different positions and scales, and the RNN layer is used to learn the sequence relationship and context information between these local features.

[0017] Preferably, the hybrid architecture integrating the advantages of CNN and RNN is implemented as follows:

[0018] Step 1: First, the HTML structure text of the web page is represented as H, and the i-th convolution kernel of the CNN layer is represented as K i , then the local feature map F output by the CNN layer is: F = CNN(H) = [f1,f2,...f m ], where m is the number of convolution kernels, f j It represents the jth feature vector in the local feature map F obtained after CNN processing, and its value range is 1 to m. is the convolution operation, b i is the bias term;

[0019] Step 2: Then input the local feature map F output by the CNN layer into the RNN layer, update the current hidden state, and learn the sequence relationship between the features of the web page elements;

[0020] Step 3: Then design the loss function L, which is obtained by summing the web page structure recognition loss, element classification loss and structure similarity judgment loss;

[0021] Step 4: Finally, introduce adversarial training and construct a discriminator network D to output a probability value, which indicates the probability that the input feature representation is true. The objective function of adversarial training is: where p data (x) is the distribution of the real web page structure features, p z (z) is the noise distribution, G is the generator network, x is the real sample, and z is the noise input.

[0022] Preferably, in step S3, for different difference parts of the fingerprint difference, it is determined whether it is data update or new data. For data update, only the changed part of the data is updated, and for new data, it is processed according to the established data storage and processing flow.

[0023] Preferably, in step S3, a multi-granularity hash algorithm is used to calculate the fingerprint, and a specific implementation method of comparing the fingerprint difference is as follows:

[0024] S31. First, the captured complete data set is regarded as a whole, and SHA-256 is used to perform hash calculation on the entire data set to obtain the feature fingerprint f at the overall data level. whole ;

[0025] S32, according to the structure of the data, divide the data into multiple data blocks, and use the same SHA-256 to calculate the hash value of each data block to obtain the feature fingerprint f corresponding to each data block block ;

[0026] S33, then, within the data block, for the title elements, image elements, and link elements in the web page that need to be paid attention to, the same hash processing is performed again to generate element-level feature fingerprints f element ;

[0027] S34, when the newly captured data calculates the feature fingerprint f at the overall data level newwhole Then, it is compared with the overall data level feature fingerprint f corresponding to the historical data in the fingerprint library oldwhole For comparison, if f newwhole =f oldwhole , continue to confirm through data block level and element level comparison, if f newwhole ≠f oldwhole Perform block-level comparisons and mark data with significant changes.

[0028] Preferably, step S4 is based on a combination of an improved deep belief network DBN and an isolation forest IF algorithm to detect data anomalies, and the specific implementation of detecting data anomalies is as follows:

[0029] S41. First, a multi-layer deep belief network is designed. A large number of normal data samples are used to perform unsupervised pre-training of the DBN layer by layer, and the feature vector output from the highest hidden layer of the pre-trained DBN is used as input data to construct an isolation forest.

[0030] S42. Then define a joint loss function to combine the reconstruction error of DBN with the anomaly score of isolation forest: Where E DBNis the reconstruction error of the deep belief network DBN, T is the number of isolated trees, s i (x) is the anomaly score of each tree in the isolation forest for the data point;

[0031] S43, inputting normal data and a small amount of labeled abnormal data into the model, calculating the loss according to the joint loss function, and adjusting the weights and biases of the DBN and related parameters in the isolation forest, including the construction parameters of the isolation tree and the calculation parameters of the abnormal score, through the back propagation algorithm;

[0032] S44, then perform anomaly detection, perform preprocessing operations on the data to be detected, input the feature vector extracted by DBN into the isolation forest, and calculate the anomaly score s of each isolated tree for the data point i (x), the scores of all trees are combined to obtain the final anomaly score;

[0033] S45. Finally, according to the preset abnormal score threshold, determine whether the data point is abnormal data.

[0034] Preferably, in step S26, the node v is searched for i+1 Nodes v with similar semantics and low risk of structural changes i ' +1 The specific implementation is to convert the semantic association strength w ij and structural risk value R i,j Combined, the calculation formula is: i+1 ·(1-R ij ).

[0035] Compared with the prior art, the advantages and positive effects of the present invention are that the webpage structure recognition model that integrates the advantages of CNN and RNN can accurately extract features and understand structural relationships; the dynamic XPath generation algorithm adapts to webpage changes; the multi-granularity hash algorithm accurately determines data updates and additions; and the improved DBN and IF algorithms are combined to effectively detect anomalies. These innovations improve the accuracy and adaptability of data capture, reduce the misjudgment rate of anomaly detection, provide more efficient, accurate, and reliable solutions for network data processing, and strongly promote the development of related fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0037] Figure 1 This is the structural flow chart of this algorithm; Figure 2Generate algorithm flow chart for dynamic Xpath. DETAILED DESCRIPTION

[0038] In order to more clearly understand the above-mentioned purpose, features and advantages of the present invention, the present invention is further described below in conjunction with the accompanying drawings and embodiments. It should be noted that the embodiments of the present application and the features in the embodiments can be combined with each other without conflict.

[0039] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways than those described herein. Therefore, the present invention is not limited to the specific embodiments of the following disclosure.

[0040] Embodiment, in today's digital information age, the effective acquisition and accurate analysis of network data are crucial in many fields. However, the existing technology has many shortcomings when facing complex and changeable web page structures and diverse data anomalies. This embodiment aims to elaborate on the network data crawling and anomaly detection method based on artificial intelligence to solve the problems of traditional methods in adaptability, accuracy and efficiency. The structure and flow of this application are as follows Figure 1 shown.

[0041] In order to remove invalid and low-value URLs and improve data crawling efficiency, the invention first screens the initial URL list. In an actual network environment, a large number of URLs may point to invalid pages or contain information that is meaningless to analysis, which not only wastes network resources and crawling time, but may also introduce noise data. Collect a large amount of annotated URL data, which includes the URL itself and the annotation information of whether the corresponding page contains the target data. For each URL, extract its feature information, such as page title, keyword tag, keywords in the URL, HTML structure features of the page, etc. These features will be used as input for the machine learning classification algorithm. Select the support vector machine classification algorithm and use the extracted URL features and annotated data for training. During the training process, the algorithm learns the relationship pattern between URL features and whether the page contains the target data, evaluates the trained model using methods such as cross-validation, calculates the model's accuracy, recall rate, F1 value and other indicators, and inputs each URL in the generated initial URL list into the trained classification model. The model predicts whether the corresponding page may contain the target data based on the characteristics of the URL. For URLs predicted to not contain the target data, they are removed from the initial URL list.

[0042] In view of the large differences in the structures of different types of web pages and the lack of adaptability of traditional methods, the present invention adopts a hybrid architecture web page structure recognition model that integrates the advantages of CNN and RNN. The CNN layer is used to extract the local features of the web page, and preliminarily extracts the features of each HTML tag, text block, and image area element in the web page. The convolution kernel slides on the HTML structure text representation of the web page to capture feature patterns at different positions and scales. The RNN layer is used to learn the sequence relationship and contextual information between these local features. First, the HTML structure text of the web page is represented as H, and the i-th convolution kernel of the CNN layer is represented as K i , then the local feature map F output by the CNN layer is: F = CNN(H) = [f1,f2,...f m ], where m is the number of convolution kernels, f j It represents the jth feature vector in the local feature map F obtained after CNN processing, and its value range is 1 to m. is the convolution operation, b i is the bias term; then the local feature map F output by the CNN layer is input to the RNN layer, the current hidden state is updated, and the sequence relationship between the features of the web page elements is learned; then the loss function L is designed, which is obtained by summing the web page structure recognition loss, element classification loss, and structural similarity judgment loss; finally, adversarial training is introduced to construct a discriminator network D to output a probability value, which indicates the probability that the input feature representation is true. The objective function of adversarial training is: where p data (x) is the distribution of the real web page structure features, p z (z) is the noise distribution, G is the generator network, x is the real sample, and z is the noise input.

[0043] On this basis, the dynamic XPath generation algorithm is used to generate the path expression for extracting data, such as Figure 2 First, for each element in the web page, extract the HTML semantic tags, extract the keyword vector of the text in the element, and convert the semantic tags into vector form; for any two elements e i and e j , calculate the semantic association strength: in is the similarity of semantic label vectors, is the similarity of the keyword vector, α is the weight coefficient; the web page elements are nodes V = {e1, e2, ..., e n}, a directed graph is constructed with the semantic association strength as the edge weight; then the shortest path is calculated, with the root node r and the target node t, d(v) is the shortest distance from the root node r to the node v, d(r) = 0 initially, and for other nodes v≠r, d(v) = ∞; for the node set S with the shortest path determined, S = {r} initially, and for the node u not in S, its shortest distance is updated: where w vu represents the weight of the edge from node v to node u; then repeat the process until the target node t is added to S, generating the initial XPath expression; then perform path optimization, calculate the structure change risk value, and the web page structure change probability matrix M = (m ij ), where m ij Represents the slave node e i To node e j The structural change probability of i ,v i+1 ) Calculate the structural risk value where depth(v i+1 ) is the node v i+1 The depth in the web page structure is calculated from the root node to v i+1 The number of node layers passed through is determined; finally, the path is adjusted. For each node pair (v i ,v i+1 ), if R i,i+1 is greater than the preset threshold, then in the semantic relationship graph G, find the node v i+1 Nodes v with similar semantics and low risk of structural changes i ' +1 , calculated as the semantic association strength w ij and structural risk value R i,j Combine: v i+1 ·(1-R ij ), replace the nodes in path P, and get the optimized XPath expression. This method enables the data extraction path to adapt to the dynamic changes of the web page structure. Even if the web page layout or elements change, the target data can still be accurately extracted, which greatly improves the accuracy and stability of data capture.

[0044] Then, in order to accurately identify data updates and additions, the present invention uses a multi-granularity hash algorithm to perform fingerprint calculations and compare fingerprint differences. For different difference parts of the fingerprint difference, it is determined whether it is a data update or new data. For data updates, only the changed part of the data is updated. For new data, it is processed according to the established data storage and processing flow. The specific implementation method of using a multi-granularity hash algorithm to perform fingerprint calculations and compare fingerprint differences is as follows: first, the captured complete data set is regarded as a whole, and SHA-256 is selected to perform hash calculations on the entire data set to obtain the feature fingerprint f at the overall data level. whole ; According to the data structure, the data is divided into multiple data blocks. For each data block, the same SHA-256 is used to calculate its hash value to obtain the feature fingerprint f corresponding to each data block block ; Then, within the data block, the same hashing process is performed again for the title elements, image elements, and link elements in the web page that need to be paid attention to, to generate element-level feature fingerprints f element ; When the newly captured data calculates the feature fingerprint f at the overall data level newwhole Then, it is compared with the overall data level feature fingerprint f corresponding to the historical data in the fingerprint library oldwhole For comparison, if f newwhole =f oldwhole , continue to confirm through data block level and element level comparison, if f newwhole ≠f oldwhole Perform block-level comparisons and mark data with significant changes.

[0045] Finally, based on the combination of improved deep belief network DBN and isolation forest IF algorithm, it is used to detect data anomalies. The fused feature vector of the data to be detected is input into the trained anomaly detection model, and the data is judged whether it is abnormal according to the preset threshold. First, a multi-layer deep belief network is designed, and a large number of normal data samples are used to perform unsupervised pre-training on DBN layer by layer, and the feature vector output from the highest hidden layer of the pre-trained DBN is used as input data to construct an isolation forest. Then a joint loss function is defined to combine the reconstruction error of DBN with the anomaly score of the isolation forest: Where E DBN is the reconstruction error of the deep belief network DBN, T is the number of isolated trees, s i(x) is the anomaly score of each tree in the isolation forest for the data point; normal data and a small amount of labeled anomaly data are input into the model together, the loss is calculated according to the joint loss function, and the weights and biases of DBN and related parameters in the isolation forest are adjusted through the back propagation algorithm, including the construction parameters of the isolation tree and the anomaly score calculation parameters; then anomaly detection is performed, the data to be detected is preprocessed, the feature vector extracted by DBN is input into the isolation forest, and the anomaly score s of each isolated tree for the data point is calculated i (x), the scores of all trees are combined to obtain the final anomaly score; finally, according to the pre-set anomaly score threshold, it is determined whether the data point is anomaly data. This combination method gives full play to the advantages of DBN in feature learning and the high efficiency of isolation forest in anomaly detection, which can effectively reduce the misjudgment rate, timely and accurately discover various complex anomaly patterns, and provide strong protection for the security and reliability of network data.

[0046] The above description is only a preferred embodiment of the present invention and does not limit the present invention in other forms. Any technician familiar with the profession may use the technical content disclosed above to change or modify it into an equivalent embodiment with equivalent changes and apply it to other fields. However, any simple modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the content of the technical solution of the present invention still falls within the protection scope of the technical solution of the present invention.

Claims

1. A network data capture and anomaly detection method based on artificial intelligence, characterized in that: The following steps are involved: S1. First, filter the initial URL list to remove invalid and low-value URLs; S2. Then, for different types of web pages, a web page structure recognition model based on deep learning is used, and according to the identified data area, a dynamic XPath generation algorithm is used to generate a path expression for extracting data; S3, then use the multi-granularity hash algorithm to calculate the fingerprint of each captured data and compare the fingerprint differences; S4. Finally, based on the combination of improved deep belief network DBN and isolation forest IF algorithm, the data anomaly is detected. The fused feature vector of the data to be detected is input into the trained anomaly detection model, and the data is judged whether it is abnormal according to the preset threshold; The specific implementation of using the dynamic XPath generation algorithm to generate the path expression for extracting data in step S2 is: S21. First, for each element in the web page, extract HTML semantic tags, extract keyword vectors of the text in the element, and convert the semantic tags into vector form; S22. For any two elements e i and e j , calculate the semantic association strength: in is the similarity of semantic label vectors, is the similarity of keyword vectors, α is the weight coefficient; S23, take the web page element as node V = {e1, e2, ..., e n }, construct a directed graph with semantic association strength as edge weight; S24. Then find the shortest path, with the root node r and the target node t. d(v) is the shortest distance from the root node r to the node v. Initially, d(r) = 0. For other nodes v≠r, d(v) = ∞. For the node set S with the shortest path determined, initially S = {r}. For the node u not in S, update its shortest distance: where w vu represents the weight of the edge from node v to node u; Then the process is repeated until the target node t is added to S to generate the initial XPath expression; S25, then perform path optimization, calculate the structure change risk value, web page structure change probability matrix M = (m ij ), where m ij Represents the slave node e i To node e j The structural change probability of i ,v i+1 ) Calculate the structural risk value R i,i+1 : where depth(v i+1 ) is the node v i+1 The depth in the web page structure is calculated from the root node to v i+1 The number of node layers passed is determined; S26, finally, path adjustment is performed. For each node pair (v i ,v i+1 ), if R i,i+1 is greater than the preset threshold, in the semantic relationship graph G, find the node v i+1 Nodes v with similar semantics and low risk of structural changes i ' +1 , replace the nodes in path P to obtain the optimized XPath expression.

2. According to the artificial intelligence-based network data capture and anomaly detection method according to claim 1, it is characterized in that: The web page structure recognition model based on deep learning in step S2 adopts a hybrid architecture that integrates the advantages of CNN and RNN. The CNN layer is used to extract local features of the web page, and preliminarily extracts the features of each HTML tag, text block, and image area element in the web page. The convolution kernel slides on the HTML structure text representation of the web page to capture feature patterns at different positions and scales. The RNN layer is used to learn the sequence relationship and context information between these local features.

3. According to the artificial intelligence-based network data capture and anomaly detection method of claim 2, it is characterized in that: The implementation of the hybrid architecture that combines the advantages of CNN and RNN is: Step 1: First, the HTML structure text of the web page is represented as H, and the i-th convolution kernel of the CNN layer is represented as K i , then the local feature map F output by the CNN layer is: F = CNN(H) = [f1,f2,...f m ], where m is the number of convolution kernels, f j It represents the jth feature vector in the local feature map F obtained after CNN processing, and its value range is 1 to m. is the convolution operation, b i is the bias term; Step 2: Then input the local feature map F output by the CNN layer into the RNN layer, update the current hidden state, and learn the sequence relationship between the features of the web page elements; Step 3: Then design the loss function L, which is obtained by summing the web page structure recognition loss, element classification loss and structure similarity judgment loss; Step 4: Finally, introduce adversarial training and build a discriminator network D to output a probability value, which indicates the probability that the input feature representation is true. The objective function of adversarial training is: G inm D axV(D,G)=E x～pdata(x) [logD(x)]+E z～pz(z) [log(1-D(G(z)))], where p data (x) is the distribution of the real web page structure features, p z (z) is the noise distribution, G is the generator network, x is the real sample, and z is the noise input.

4. According to the artificial intelligence-based network data capture and anomaly detection method of claim 1, it is characterized in that: In step S3, for different difference parts of the fingerprint difference, it is determined whether it is data update or new data. For data update, only the changed part of the data is updated, and for new data, it is processed according to the established data storage and processing flow.

5. The method for network data capture and anomaly detection based on artificial intelligence according to claim 1 is characterized in that: In step S3, a multi-granularity hash algorithm is used to calculate fingerprints, and the specific implementation method of comparing fingerprint differences is as follows: S31. First, the captured complete data set is regarded as a whole, and SHA-256 is used to perform hash calculation on the entire data set to obtain the feature fingerprint f at the overall data level. whole ; S32, according to the structure of the data, divide the data into multiple data blocks, and use the same SHA-256 to calculate the hash value of each data block to obtain the feature fingerprint f corresponding to each data block block ; S33, then, within the data block, for the title elements, image elements, and link elements in the web page that need to be paid attention to, the same hash processing is performed again to generate element-level feature fingerprints f element ; S34, when the newly captured data calculates the feature fingerprint f at the overall data level newwhole Then, it is compared with the overall data level feature fingerprint f corresponding to the historical data in the fingerprint library oldwhole For comparison, if f newwhole =f oldwhole , continue to confirm through data block level and element level comparison, if f newwhole ≠f oldwhole Perform block-level comparisons and mark data with significant changes.

6. The method for network data capture and anomaly detection based on artificial intelligence according to claim 1 is characterized in that: The step S4 is based on the combination of improved deep belief network DBN and isolation forest IF algorithm, and is used to detect data anomalies. The specific implementation of detecting data anomalies is as follows: S41. First, a multi-layer deep belief network is designed. A large number of normal data samples are used to perform unsupervised pre-training of the DBN layer by layer, and the feature vector output from the highest hidden layer of the pre-trained DBN is used as input data to construct an isolation forest. S42. Then define a joint loss function to combine the reconstruction error of DBN with the anomaly score of isolation forest: Where E DBN is the reconstruction error of the deep belief network DBN, T is the number of isolated trees, s i (x) is the anomaly score of each tree in the isolation forest for the data point; S43, inputting normal data and a small amount of labeled abnormal data into the model, calculating the loss according to the joint loss function, and adjusting the weights and biases of the DBN and related parameters in the isolation forest, including the construction parameters of the isolation tree and the calculation parameters of the abnormal score, through the back propagation algorithm; S44, then perform anomaly detection, perform preprocessing operations on the data to be detected, input the feature vector extracted by DBN into the isolation forest, and calculate the anomaly score s of each isolated tree for the data point i (x), the scores of all trees are combined to get the final anomaly score; S45. Finally, according to the preset abnormal score threshold, determine whether the data point is abnormal data.

7. The method for network data capture and anomaly detection based on artificial intelligence according to claim 1 is characterized in that: In step S26, find the node v i+1 Nodes v with similar semantics and low risk of structural changes i ' +1 The specific implementation is to convert the semantic association strength w ij and structural risk value R i,j Combined, the calculation formula is: i+1 ·(1-R ij ).

Images