C2F application data anomaly detection model training method, anomaly detection method and related equipment

Abstract

The embodiment of the invention provides a C2F application data anomaly detection model training method, an anomaly detection method and related equipment, and the method comprises the steps: obtaining a plurality of continuous C2F application data sequences according to a plurality of continuous time sequence data based on a preset sliding step length; variable mask processing is carried out on each C2F application data sequence one by one, and cue word prefixes and cue word answers which correspond to each C2F application data sequence and are complementary are obtained; inputting the cue word prefix into a C2F application data anomaly detection model for data prediction, and generating prediction cue data; according to the method and the device, the loss value is calculated according to each piece of prediction prompt data and the corresponding prompt word answer, model training is performed on the C2F application data anomaly detection model based on the loss value, and the trained C2F application data detection model is used for performing anomaly detection on the C2F application data, so that the accuracy of C2F application data anomaly detection is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a C2F application data anomaly detection model training method, an anomaly detection method and related equipment. Background Art

[0002] With the development of society, a new business model called customer to factory (C2F) has emerged. In this model, customers can place orders directly through a digital platform, and the factory produces and delivers according to the order requirements. It directly connects consumers and manufacturers, eliminates the middleman, thereby improving efficiency, reducing costs, and providing more personalized customized services. In the C2F model, the factory needs to respond to consumers' order requirements in real time and be able to quickly adjust the production line to meet personalized needs. This requires not only that the factory has an efficient production process, but also a powerful and flexible hardware infrastructure to support high-speed data transmission and processing.

[0003] In order to effectively deal with the huge data flow in the C2F mode, many information layer switches are usually set up at the factory end. These information layer switches need to process and transmit the huge data flow of various industrial equipment and business management systems. However, due to the excessive types of transmission protocols and complex data sources in the transmitted data, in order to ensure the security of data transmission, it is necessary to detect anomalies in the data transmission process of C2F applications.

[0004] In the related art, in order to improve the security of factory application data, it is usually necessary to set a number of specific data detection points in the factory data transmission process, and formulate corresponding data anomaly detection conditions for these data detection points in advance. In the actual factory data transmission process, data anomaly detection is performed at these specific data detection points using the corresponding data anomaly detection conditions. However, due to the wide variety of application data sources in the C2F scenario, it is impossible to comprehensively analyze the correlation between time series in the C2F application data using only fixed data anomaly detection conditions, and thus it is impossible to accurately perform appropriate anomaly detection on such C2F application data. In addition, when collecting C2F application data for detection at fixed data detection points, there are problems such as a single detection sample and a limited amount of detection data, which results in low detection accuracy when using traditional factory data detection methods to detect anomalies in C2F application data. Summary of the invention

[0005] The embodiments of the present application provide a C2F application data anomaly detection model training method, anomaly detection method and related equipment, which can improve the accuracy of anomaly detection of application data in a C2F scenario.

[0006] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a C2F application data anomaly detection model training method, the method comprising: Based on a preset sliding step, a plurality of continuous C2F application data sequences are obtained according to a plurality of continuous time series data; Performing variable masking processing on each of the C2F application data sequences one by one to obtain a prompt word prefix and a prompt word answer corresponding to each of the C2F application data sequences, wherein the prompt word prefix and the prompt word answer are complementary to each other; Inputting the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data; A loss value is calculated based on each predicted prompt data and the corresponding prompt word answer, and a C2F application data anomaly detection model is trained based on the loss value. The trained C2F application data detection model is used to perform anomaly detection on C2F application data.

[0007] In some embodiments, the multiple time series data include a total length of the time series, and the variable masking process is performed on each of the C2F application data sequences to obtain a prompt word prefix and a prompt word answer corresponding to each of the C2F application data sequences, including: Obtaining a mask matrix, wherein the mask matrix includes a mask ratio parameter; generating the prompt word prefix based on the Hadamard product of the mask matrix and the C2F application data sequence; The prompt word answer is generated based on the Hadamard product of the complement of the mask matrix and the C2F application data sequence, and the prompt word prefix and the prompt word answer satisfy a complementary data condition, and the complementary data condition is generated based on the mask ratio parameter and the total length of the time series.

[0008] In some embodiments, the time series data includes a plurality of feature data, the complementary data condition includes a first mask condition, a second mask condition and a mask complementary condition, and the step of generating the complementary data condition includes: Based on one minus the mask ratio parameter, multiplying the total length of the time series and the number of features of the feature data, a first mask data value is obtained, and based on the numerical relationship between the first matrix norm of the prompt word prefix and the first mask data value, the first mask condition is generated; Multiplying the mask ratio parameter, the total length of the time series and the number of features to obtain a second mask data value, and generating the second mask condition based on the numerical relationship between the second matrix norm of the prompt word answer and the second mask data value; The total length of the time series and the number of features are multiplied to obtain a complementary mask data value, and the mask complementarity condition is generated based on a numerical relationship among the first matrix norm, the second matrix norm and the complementary mask data value.

[0009] In some embodiments, the step of inputting the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data includes: Performing padding processing on the prompt word prefix to obtain a padding mask data sequence; The filling mask data sequence port is input into the C2F application data anomaly detection model to perform mapping data prediction processing to obtain the prediction prompt data.

[0010] In some embodiments, the C2F application data anomaly detection model includes a normalization layer and a feedforward layer, and the loss value is calculated according to each of the predicted prompt data and the corresponding prompt word answer, and the C2F application data anomaly detection model is trained based on the loss value, including: Based on the difference between each predicted prompt data and the corresponding prompt word answer, matrix bi-norm processing is performed to obtain a data sequence loss value corresponding to each C2F application data sequence; A normalization layer parameter of the normalization layer and / or a feed-forward layer parameter of the feed-forward layer are adjusted based on at least one of the data sequence loss values.

[0011] In some embodiments, the step of obtaining a plurality of continuous C2F application data sequences based on a plurality of continuous time series data based on a preset sliding step size includes: Obtain multiple continuous time series data in C2F application data; Performing a missing data filling operation on the multiple time series data to obtain filled time series data; Normalizing the filled time series data to obtain normalized time series data; Based on the preset sliding step size, the multiple normalized time series data are divided according to the time order in the normalized time series data to obtain the multiple continuous C2F application data sequences.

[0012] To achieve the above objective, a second aspect of an embodiment of the present application proposes a method for detecting anomalies in C2F application data, the method comprising: Get the target C2F application data; Masking the target C2F application data to obtain a target prompt word prefix and a target prompt word answer; Inputting the target prompt word prefix into the C2F application data anomaly detection model obtained after training as described in the first aspect to perform data prediction processing to obtain target prediction prompt data; Based on the loss value between the target prediction prompt data and the target prompt word answer, a target anomaly detection result of the target C2F application data is obtained.

[0013] To achieve the above-mentioned purpose, a third aspect of an embodiment of the present application proposes a C2F application data anomaly detection model training device, the device comprising: A data sequence partitioning module, used for obtaining a plurality of continuous C2F application data sequences according to a plurality of continuous time series data based on a preset sliding step size; a mask generation module, configured to perform variable mask processing on each of the C2F application data sequences one by one, to obtain a prompt word prefix and a prompt word answer corresponding to each of the C2F application data sequences, wherein the prompt word prefix and the prompt word answer are complementary to each other; A prediction data generation module, used for inputting the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data; The model training module is used to calculate a loss value according to each of the predicted prompt data and the corresponding prompt word answer, and perform model training on the C2F application data anomaly detection model based on the loss value.

[0014] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, the memory stores a computer program, and when the processor executes the computer program, it implements the C2F application data anomaly detection model training method as described in the first aspect or the C2F application data anomaly detection method as described in the second aspect.

[0015] To achieve the above-mentioned purpose, the fifth aspect of an embodiment of the present application proposes a storage medium, which is a computer-readable storage medium, and the storage medium stores a computer program. When the computer program is executed by a processor, it implements the C2F application data anomaly detection model training method described in the first aspect or the C2F application data anomaly detection method described in the second aspect.

[0016] The C2F application data anomaly detection model training method, anomaly detection method and related equipment proposed in the embodiments of the present application include: first, based on a preset sliding step size, multiple continuous C2F application data sequences are obtained according to multiple continuous time series data; then, variable masking is performed on each C2F application data sequence one by one to obtain a prompt word prefix and a prompt word answer corresponding to each C2F application data sequence, and the prompt word prefix and the prompt word answer are complementary; next, the prompt word prefix is ​​input into the C2F application data anomaly detection model for data prediction to generate predicted prompt data; finally, a loss value is calculated according to each predicted prompt data and the corresponding prompt word answer, and a C2F application data anomaly detection model is trained based on the loss value, and the trained C2F application data detection model is used to perform anomaly detection on the C2F application data. The embodiment of the present application trains a C2F application data anomaly detection model for a plurality of time-continuous C2F application data without limiting the limited data detection moment, so as to improve the detection data volume and time series relevance of the detection sample, and uses a preset sliding step to perform time series division on the time series data, so as to reduce the amount of data processed each time while maintaining the time series relevance of the data, so as to reduce the data processing time, thereby improving the training efficiency of the model training; then, the C2F application data sequence after each continuous time series division is masked and divided by using a mask processing based on a variable to obtain a complementary prompt word prefix and a prompt word answer, and then the C2F application data anomaly detection model is further used for the prompt word The loss value between the predicted prompt data output by the prefix and the answer to the prompt word is used to train the C2F application data anomaly detection model, so that the C2F application data anomaly detection model can learn the correlation between the complementary data in the normal C2F application data, so that in actual applications, when the trained C2F application data anomaly detection model is used to perform security detection on the C2F application data, the loss value between the complementary data obtained by masking in the C2F application data can be used to calculate the C2F application data correlation, and then the C2F application data correlation can be used to accurately obtain the anomaly detection result of the C2F application data, which greatly improves the accuracy and reliability of the C2F application data anomaly detection.

[0017] Other features and advantages of the present application will be described in the following description, and partly become apparent from the description, or understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 This is a C2F production model operation organizational structure diagram provided in an embodiment of the present application.

[0019] Figure 2 This is a flowchart of a C2F application data anomaly detection model training method provided by another embodiment of the present application.

[0020] Figure 3 yes Figure 2 Flow chart of step 201 in FIG.

[0021] Figure 4 yes Figure 2 Flow chart of step 202 in FIG.

[0022] Figure 5 This is a flow chart for generating complementary data conditions provided by another embodiment of the present application.

[0023] Figure 6 yes Figure 2 Flow chart of step 203 in FIG.

[0024] Figure 7 yes Figure 2 Flow chart of step 204 in FIG.

[0025] Figure 8 It is a flowchart of C2F application data anomaly detection model training provided by another embodiment of the present application.

[0026] Fig. 9 This is a flowchart of a method for detecting anomalies in C2F application data provided by another embodiment of the present application.

[0027] Fig.10 This is an architecture diagram of an industrial data anomaly detection device for a C2F scenario provided in another embodiment of the present application.

[0028] Fig.11 It is a structural diagram of a C2F application data anomaly detection model training device provided by another embodiment of the present application.

[0029] Fig.12 This is a schematic diagram of the hardware structure of an electronic device provided in yet another embodiment of the present application. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0031] It should be noted that although the functional modules are divided in the device schematic and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart.

[0032] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0033] With the development of society, a new business model called customer to factory (C2F) has emerged. In this model, customers can place orders directly through digital platforms, and factories produce and deliver according to order requirements. It directly connects consumers and manufacturers, eliminates intermediaries, thereby improving efficiency, reducing costs, and providing more personalized customized services.

[0034] The C2F model is used in many industries, including clothing, footwear, furniture, and automobiles. For example, some clothing brands allow customers to select clothing styles, fabrics, and colors online, and then place orders directly at the factory for production. This model is becoming more and more popular with the development of e-commerce and digital technology. With the advancement of 3D printing and smart manufacturing technology, the potential of the C2F model will be further explored.

[0035] Reference Figure 1 , is a C2F production model operation organizational structure diagram provided in the embodiment of the present application. Figure 1 As shown in the figure, consumers place orders on the C-end (i.e., client) through shopping websites, and the orders are sent to the C2F platform. The C2F platform then breaks down the orders into production tasks and sends them to the factory, i.e., the F-end. After a series of production processes, the F-end produces the products and delivers them to the C-end, i.e., the consumer. The C2F platform also needs to monitor the production process of the F-end, and the F-end needs to collect real-time production data for the C2F platform so that the C2F platform can make intelligent decisions and issue production control instructions correctly.

[0036] The two ends of C2F are C-end and F-end, that is, consumers and producers. C-end runs on the IT side, and F-end runs on the OT side. What needs to be achieved in the C2F model is to break through the technical barriers in the fields of information technology (IT) and operational technology (OT) and integrate these two technical fields. Ultimately, the data of C-end must be accurately reflected on the F-end so that the F-end can realize the ideas of C-end, and the industrial data of F-end can be accurately fed back to C-end so that C-end can make correct judgments on the response of F-end.

[0037] In the traditional industrial model, the F end produces goods in large quantities, and the C end purchases goods according to their own preferences. In the C2F industrial model, the needs of the C end are flexible, which requires the F end to have the ability to produce multiple varieties in small batches, that is, flexible manufacturing.

[0038] In the C2F model, factories need to respond to consumers' order needs in real time and be able to quickly adjust production lines to meet personalized needs. This requires not only efficient production processes, but also powerful and flexible hardware infrastructure to support high-speed data transmission and processing.

[0039] In order to effectively deal with the huge data flow in the C2F mode, many information layer switches are usually set up at the factory end. These information layer switches need to process and transmit the huge data flow of various industrial equipment and business management systems. However, due to the excessive types of transmission protocols and complex data sources in the transmitted data, in order to ensure the security of data transmission, it is necessary to detect anomalies in the data transmission process of C2F applications.

[0040] In addition, the complex requirements in the C2F scenario have a great impact on industrial data. In the field of information technology (IT), the communication protocols of data all follow the standard Ethernet protocol, while in the field of operational technology (OT), there is no unified industrial field protocol, that is, multiple protocols coexist. Currently, there are more than ten commonly used industrial field protocols. Under the traditional industrial model, the introduction of a production line in a factory may only involve one or two industrial field protocols, nor the interconnection of multiple industrial protocols, let alone the data intercommunication between IT and OT. Under the C2F industrial model, these problems are highlighted. Industrial data of multiple different protocols need to communicate, and OT and IT data also have communication needs.

[0041] OT data communication in the IT field also faces security issues. Industrial data in the OT field is relatively safe, but data security in the IT field has been a very difficult issue since the advent of the Internet. How to ensure the safe and reliable transmission of industrial data in the IT field has become a hot topic of research in recent years.

[0042] In the related art, in order to improve the security of factory application data, it is usually necessary to set a number of specific data detection points in the factory data transmission process, and formulate corresponding data anomaly detection conditions for these data detection points in advance, and use the corresponding data anomaly detection conditions to perform data anomaly detection at these specific data detection points during the actual factory data transmission process. However, due to the wide variety of application data sources in the C2F scenario, it is impossible to comprehensively analyze the correlation between continuous time series data in the C2F application data using only fixed data anomaly detection conditions, and thus it is impossible to accurately perform appropriate anomaly detection on such C2F application data. In addition, when collecting C2F application data for detection at fixed data detection points, there are problems such as a single detection sample and a limited amount of detection data, which results in low detection accuracy when using traditional factory data detection methods to detect anomalies in C2F application data.

[0043] In order to improve the accuracy of anomaly detection of application data in the C2F scenario, the embodiment of the present application trains a C2F application data anomaly detection model for a plurality of time-continuous C2F application data without limiting the limited data detection moment, so as to increase the detection data volume and time series relevance of the detection samples, and use a preset sliding step to perform time series division on the time series data, so as to reduce the amount of data processed each time while maintaining the time series relevance of the data, so as to reduce the data processing time, thereby improving the training efficiency of the model training; then, masking is performed on each C2F application data sequence after time series division by using a variable-based masking process to obtain complementary prompt word prefixes and prompt word answers, and then the C2F application data anomaly detection model is further used to perform masking on the C2F application data sequence after time series division ... The detection model trains the C2F application data anomaly detection model based on the loss value between the predicted prompt data output by the prompt word prefix and the prompt word answer, so that the C2F application data anomaly detection model can learn the correlation between complementary data in normal C2F application data, so that when the trained C2F application data anomaly detection model is used to perform security detection on C2F application data in actual applications, the loss value between the complementary data obtained by masking in the C2F application data can be used to calculate the C2F application data correlation, and then the C2F application data correlation can be used to accurately obtain the anomaly detection result of the C2F application data, which greatly improves the accuracy and reliability of C2F application data anomaly detection.

[0044] The following will further describe the C2F application data anomaly detection model training method, anomaly detection method and related devices provided by the embodiments of the present application. First, the C2F application data anomaly detection model training method provided by the embodiments of the present application is described. Figure 2 , which is an optional flowchart of the C2F application data anomaly detection model training method provided in an embodiment of the present application, Figure 2 The method may include but is not limited to steps 201 to 204. It can also be understood that this embodiment Figure 2 The order of steps 201 to 204 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs. The C2F application data anomaly detection model training method provided in the embodiment of the present application can be applied to the server or intelligent terminal carrying the C2F platform in the C2F scenario, and can also be applied to the server or intelligent terminal performing application data detection in the factory end (i.e., the F end), and can also be applied to other control processors associated with the C2F scenario.

[0045] Step 201: Based on a preset sliding step, a plurality of continuous C2F application data sequences are obtained according to a plurality of continuous time series data.

[0046] The following is a detailed description of step 201.

[0047] In some embodiments, in order to achieve accurate anomaly detection of complex C2F application data, it is necessary to obtain a sample data set X in the C2F application scenario in advance. This sample data set X includes multiple continuous time series data, so as to facilitate the subsequent use of these continuous time series data to train the C2F application data anomaly detection model, so as to obtain a C2F application data anomaly detection model that can effectively and accurately and reliably detect anomalies of complex C2F application data.

[0048] Then, in order to further improve the training efficiency of the C2F application data anomaly detection model, the sample data set X (i.e., multiple continuous time series data) will be divided in time order based on the preset sliding step size k to obtain multiple continuous C2F application data sequences, so that the amount of data for each model training is reduced to reduce the data processing time.

[0049] Furthermore, in order to further improve the reliability of data processing, before dividing the continuous time series data, it is necessary to perform corresponding data preprocessing on the input sample data set X, and then divide the continuous time series data, as described below.

[0050] Reference Figure 3 , based on a preset sliding step, a plurality of continuous C2F application data sequences are obtained according to a plurality of continuous time series data, including the following steps 301 to 304.

[0051] Step 301: Acquire multiple continuous time series data in C2F application data.

[0052] Step 302: performing a missing data filling operation on a plurality of time series data to obtain filled time series data.

[0053] Step 303: normalize the filled time series data to obtain normalized time series data.

[0054] Step 304: Based on a preset sliding step, multiple normalized time series data are divided according to the time order in the normalized time series data to obtain multiple continuous C2F application data sequences.

[0055] Steps 301 to 304 are described in detail below.

[0056] In some embodiments, for a sample data set X corresponding to the C2F application data of a C2F scenario, a missing data filling operation is first performed on all time-continuous time series data in the sample data set, and all time series data in the sample data set X after the missing data filling operation is used as filled time series data, thereby avoiding affecting the model training efficiency of the C2F application data anomaly detection model due to missing data.

[0057] The embodiment of the present application is based on the following rules when performing the missing data filling operation: when the number of missing values ​​of the missing time series data in the sample data set X accounts for a small proportion of the overall data samples of the sample data set X (such as within 3%), the missing time series data is directly deleted; when the number of missing values ​​of the missing time series data in the sample data set X accounts for a certain threshold (such as 3% or more) of the overall data samples of the sample data set X, the missing time series data is appropriately filled, such as by zero filling.

[0058] After performing the missing data filling operation on the sample data set X to obtain the filled time series data, in order to improve the distribution characteristics of the data and improve the training efficiency of the C2F application data anomaly detection model, it is also necessary to normalize the filled time series data, that is, scale all the filled time series data to the same specific numerical range to obtain normalized time series data.

[0059] It is understandable that the specific numerical range can be a numerical range customized according to user needs, and how it is set does not affect the implementation of the C2F application data anomaly detection model training method provided in this application.

[0060] After the time series data is filled with missing data and normalized, the multiple normalized time series data will be further divided into sliding time windows based on the preset sliding step size k and the time order in the normalized time series data to obtain multiple continuous C2F application data sequences, as described below.

[0061] Sliding time window partitioning is to divide the continuous time series data into a series of fixed-size time windows for analysis and processing. The main purpose of sliding time window partitioning is to capture local patterns and trends in time series data. By analyzing the data in each window, short-term patterns and anomalies can be identified. Sliding time window is a method of dividing time series data into multiple continuous and overlapping time periods. Each time period is called a "window". The size of the window can be determined according to the needs of the analysis. The preset sliding step size (or the distance the window moves) determines the degree of overlap between windows. If the step size is less than the window size, there will be overlap between windows; if the step size is equal to the window size, there will be no overlap between windows.

[0062] For time series analysis tasks, contextual features between different timestamps are crucial. Therefore, the sample data set X after the processing will be converted into a C2F application data sequence corresponding to multiple sliding windows as shown in the following formulas (1) and (2).

[0063]

[0064]

[0065] Among them, k is the preset sliding step size (that is, the window size), and k is also the number of time points contained in each C2F application data sequence. is the C2F application data sequence (i.e., the sliding window sequence), is the number of windows (i.e., the number of C2F application data sequences), which is obtained by dividing the total length t of the time series of the sample data set X by the window size k and rounding down. Refers to the index of the C2F application data sequence.

[0066] C2F Application Data Sequence is a data matrix containing multiple features (or variables) extracted from time series data. Represents the feature data of the first feature at the first k time points in the jth window. Represents the feature data of the second feature at the first k time points in the jth window. And so on, until , which represents the feature data of the d-th feature at the first k time points in the j-th window.

[0067] Through the above steps 301 to 304, by obtaining multiple continuous time series data in the C2F application data, and performing missing data filling, normalization processing and sliding time window division in sequence, the missing data filling operation is used to ensure the integrity of the data, avoid the anomaly detection error caused by missing data, and improve the reliability of detection; secondly, the data is scaled to a uniform range by normalization processing, which improves the distribution characteristics of the data, accelerates the convergence speed of the subsequent anomaly detection algorithm, and improves the detection efficiency; finally, the continuous time series data is divided into multiple fixed-size windows by sliding time window division, which can effectively capture the local patterns and trends in the data and enhance the sensitivity and accuracy of anomaly detection. These steps work together to make the industrial data anomaly detection in the C2F scenario more efficient and accurate, and can better cope with the complex industrial environment of multiple protocols and multiple data types.

[0068] Step 202: Perform variable masking processing on each C2F application data sequence one by one to obtain a prompt word prefix and a prompt word answer corresponding to each C2F application data sequence.

[0069] The following is a detailed description of step 202.

[0070] In some embodiments, after obtaining a plurality of consecutive C2F application data sequences After that, each C2F application data sequence will be subjected to variable masking processing one by one to obtain the prompt word prefix corresponding to each C2F application data sequence. and the clue word answer Among them, the prompt word prefix and the prompt word answer are complementary. So that the prompt word prefix can be input into the C2F application data anomaly detection model for prediction to obtain the predicted prompt data. , and use the prediction prompt data and the clue word answer The C2F application data anomaly detection model is trained with a loss value between .

[0071] This random masking operation is expressed as: , = (W), where the first output value Prompt input for the C2F application data anomaly detection model OLM (Industrial Large Model), the second It's a hint.

[0072] The following will further describe how to apply data sequence to C2F Perform masking.

[0073] Reference Figure 4, performing variable masking processing on each C2F application data sequence to obtain a prompt word prefix and a prompt word answer corresponding to each C2F application data sequence, including the following steps 401 to 403.

[0074] Step 401: Obtain a mask matrix.

[0075] Step 402: Generate a prompt word prefix based on the Hadamard product of the mask matrix and the C2F application data sequence.

[0076] Step 403: Generate a prompt word answer based on the Hadamard product of the complement of the mask matrix and the C2F application data sequence.

[0077] Steps 401 to 403 are described in detail below.

[0078] The embodiment of the present application generates the prompt word prefix and prompt word answer after masking the C2F application data sequence, so that the output of the model is optimized and adjusted without relying on the specific text prompt word. The specific implementation of this method in the present application obtains the prompt word prefix and prompt word answer by randomly masking the variables. The unmasked part is the prompt word prefix, and the masked part is the prompt word answer. Different from the traditional text prompt word method, the text-free prompt word modeling method does not require a prompt word template.

[0079] Use a randomly generated mask with a ratio The random Boolean mask matrix B (i.e., mask matrix) is then applied to the data sequence based on the mask matrix B and C2F The Hadamard product of generates the prompt word prefix as shown in the following formula (3).

[0080]

[0081] in, Next, based on the complement of the mask matrix (1-B) and the Hadamard product of the C2F application data sequence, the prompt word answer is generated as shown in the following formula (4).

[0082]

[0083] The prefix of the prompt word and the clue word answer yes order data matrix; and the prompt word prefix and the prompt word answer satisfy the complementary data condition, which is generated based on the mask ratio parameter and the total length of the time series. The complementary data condition includes a first mask condition, a second mask condition and a mask complementary condition. The following will further describe how to generate the complementary data condition.

[0084] Reference Figure 5, the step of generating complementary data conditions includes the following steps 501 to 503.

[0085] Step 501: Based on one minus the mask ratio parameter, multiplying by the total length of the time series and the number of features of the feature data, a first mask data value is obtained, and based on the numerical relationship between the first matrix norm of the prompt word prefix and the first mask data value, a first mask condition is generated.

[0086] Step 502: Multiply the mask ratio parameter, the total length of the time series and the number of features to obtain a second mask data value, and generate a second mask condition based on the numerical relationship between the second matrix norm of the prompt word answer and the second mask data value.

[0087] Step 503: Multiply the total length of the time series and the number of features to obtain a complementary mask data value, and generate a mask complementarity condition based on the numerical relationship between the first matrix norm, the second matrix norm and the complementary mask data value.

[0088] Steps 501 to 503 are described in detail below.

[0089] In some embodiments, based on a minus mask ratio parameter , and then multiply by the total length of the time series and the number of features in the feature data , and then round up to get the first mask data value , and based on the numerical relationship between the first matrix norm of the prompt word prefix and the first mask data value, the first mask condition is generated as shown in the following formula (5).

[0090]

[0091] in, Ceiling sign.

[0092] Multiply by the mask ratio parameter , total length of time series and the number of features , and then round down to get the second mask data value , and based on the numerical relationship between the second matrix norm of the prompt word answer and the second mask data value, generate the second mask condition as shown in the following formula (6).

[0093]

[0094] in, The floor symbol.

[0095] Multiply by the total length of the time series and the number of features , the complementary mask data value td is obtained, and based on the numerical relationship between the first matrix norm, the second matrix norm and the complementary mask data value, the mask complementary condition is generated as shown in the following formula (7).

[0096]

[0097] Through the above steps 401 to 403, and steps 501 to 503, the introduction of the mask matrix makes the generation of the prompt word prefix and the prompt word answer not need to rely on the specific text prompt word template, simplifies the modeling process, reduces the model's dependence on specific text prompt words, and enhances the versatility and flexibility of the model; secondly, the Hadamard product operation ensures the complementarity of the prompt word prefix and the prompt word answer, so that the model can perform data segmentation without losing key information, improving the accuracy and robustness of anomaly detection; finally, the generation of complementary data conditions ensures the balance of the prompt word prefix and the prompt word answer in terms of data volume through the calculation of the mask ratio parameter and the total length of the time series, avoids the problem of data skew, and further optimizes the training effect of the model. These steps work together to enable the industrial data anomaly detection method in the C2F scenario to more efficiently process complex industrial data of multiple protocols and multiple data types, and improve the accuracy and efficiency of anomaly detection.

[0098] Furthermore, this text-free prompting approach eliminates the text-dependent prompt templates that connect the initial input and the prompted answer.

[0099] Step 203: Input the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data.

[0100] The following is a detailed description of step 203.

[0101] In some embodiments, after obtaining the C2F application data sequence Corresponding prompt word prefix and the clue word answer After that, further prefix the prompt word Input the C2F application data anomaly detection model to perform data prediction to obtain the corresponding prediction prompt data , so that the subsequent use of prediction prompt data and the clue word answer The C2F application data anomaly detection model is trained with a loss value between .

[0102] However, since the input data of the C2F application data anomaly detection model OLM usually has dimension restrictions, the prompt word prefix needs to be processed before it is input into the C2F application data anomaly detection model for data prediction, as described below.

[0103] Reference Figure 6 , input the prompt word prefix into the C2F application data anomaly detection model for data prediction, and generate prediction prompt data, including the following steps 601 to 602.

[0104] Step 601: Perform padding processing on the prompt word prefix to obtain a padding mask data sequence.

[0105] Step 602: Input the filled mask data sequence port into the C2F application data anomaly detection model for mapping data prediction processing to obtain prediction prompt data.

[0106] Steps 601 to 602 are described in detail below.

[0107] In some embodiments, in order to be consistent with the input dimension of the pre-trained C2F application data anomaly detection model OLM, after obtaining the prompt word prefix After that, the prompt word prefix Zero padding is performed to obtain a padding mask data sequence as shown in the following formula (8).

[0108]

[0109] Here, PAD() refers to the zero padding operation.

[0110] After zero filling, the filling mask data sequence is obtained. Afterwards, the padding mask data sequence Input C2F application data anomaly detection model OLM for prediction processing to fill in the prefix of the prompt word The empty prompt position of the As shown in the following formula (9).

[0111]

[0112] Through the above steps 601 to 602, the prompt word prefix is ​​filled to generate a filled mask data sequence, which ensures the integrity and consistency of the input data. The filled mask data sequence is input into the C2F application data anomaly detection model for mapping data prediction processing, which enables the model to better adapt to diverse industrial data scenarios. In this way, the model can more accurately capture abnormal data in the data and improve its generalization ability in complex industrial environments.

[0113] Step 204: Calculate a loss value based on each predicted prompt data and the corresponding prompt word answer, and perform model training on the C2F application data anomaly detection model based on the loss value.

[0114] Step 204 is described in detail below.

[0115] In some embodiments, after obtaining the C2F application data sequence Corresponding prediction prompt data and the clue word answer After that, the data sequence will be applied according to each C2F Corresponding prediction prompt data and the clue word answer The calculated loss value is used to train the C2F application data anomaly detection model OLM, as described below.

[0116] Reference Figure 7 , a loss value is calculated according to each predicted prompt data and the corresponding prompt word answer, and a C2F application data anomaly detection model is trained based on the loss value, including the following steps 701 to 702.

[0117] Step 701: Based on the difference between each predicted prompt data and the corresponding prompt word answer, matrix bi-norm processing is performed to obtain the data sequence loss value corresponding to each C2F application data sequence.

[0118] Step 702: Adjust a normalization layer parameter of a normalization layer and / or a feed-forward layer parameter of a feed-forward layer based on at least one data sequence loss value.

[0119] Steps 701 to 702 are described in detail below.

[0120] In some embodiments, the training method of the C2F application data anomaly detection model comprises: and the clue word answer The minimum mean square error loss function (MSE) is implemented, and its corresponding loss function is shown in the following formula (10).

[0121]

[0122] Therefore, based on the above formula (10), based on each prediction prompt data The corresponding clue word answer The difference is then processed by matrix two norm to obtain the data sequence loss value corresponding to each C2F application data sequence.

[0123] Then, these data sequence loss values ​​are used to fine-tune the normalization layer parameters of the normalization layer and / or the feed-forward layer parameters of the feed-forward layer of the C2F application data anomaly detection model, so that the C2F application data anomaly detection model can fully learn the correlation between normal continuous time series data in the C2F scenario.

[0124] It is understandable that the reason why this anomaly detection model achieves ideal performance is that the fine-tuned industrial large model with normal behavior patterns cannot reconstruct the masked variables based on the anomaly variables. For the test timestamp, the input includes the root cause variable, which results in poor variable generation for the test timestamp. ∈W is marked as = 1. The first m variables =[ , ,.., ] contains the root cause variables, thereby constructing the prompt.

[0125] As shown in the following formulas (11) and (12).

[0126]

[0127]

[0128] This expression means that for the I-th sample, the original data in dimensions m+1 to d is The predicted data obtained by a certain model or method Dissimilar. This usually means that along these dimensions, the model's predictions differ significantly from the actual data.

[0129] Through the above steps 701 to 702, the difference between the predicted prompt data and the actual answer is processed by the matrix bi-norm, which can measure the overall deviation of the data sequence from the multi-dimensional space. Compared with the single-point error calculation, it can better capture the global abnormal characteristics in complex industrial data. The distribution calibration parameters of the normalization layer and the feature extraction parameters of the feedforward layer are reversely adjusted by the loss value, so as to realize the adaptability of the model to the dynamic industrial environment. The optimization of the parameters of the normalization layer can eliminate the influence of the dimension difference of multi-source data on the model and ensure the distribution consistency of the fusion data in the IT / OT field. The iterative update of the parameters of the feedforward layer enhances the expression ability of the industrial large model for the local pattern and cross-protocol data features in the time window. In this way, the C2F application data anomaly detection model can fully learn the correlation between continuous time data in the C2F scenario, so as to facilitate the use of the C2F application data correlation to generate accurate abnormal data detection results when performing C2F application data anomaly detection in actual applications.

[0130] Reference Figure 8 , is a flow chart of a C2F application data anomaly detection model training process provided by an embodiment of the present application. Figure 8 As shown in the figure, for the C2F application data sequence obtained with multiple continuous time series data , through mask operation Split into prompt word prefix and the clue word answer Then, we use C2F to apply the data anomaly detection model OLM to the prompt word prefix , generating the predicted prompt answer . Then use the predictions to hint at the answer and the clue word answer The loss value between is used to fine-tune the C2F application data anomaly detection model OLM. In the figure, → indicates the direction of data flow. ⇆ indicates the calculation of the loss function for the training algorithm. In the figure, the symbol L() represents the loss function, which is used to measure the difference between the model prediction value and the actual value. In the embodiment of the present application, it is represented as the mean square error (MSE). Dimension Mapping is to transform data from its original dimension to a new dimensional space for better analysis and processing.

[0131] In addition, the present application embodiment also provides a method for detecting abnormalities in C2F application data. Fig. 9 , which is an optional flowchart of the C2F application data anomaly detection method provided in an embodiment of the present application, Fig. 9 The method in the embodiment may include but is not limited to steps 901 to 904. Fig. 9 The order of steps 901 to 904 is not specifically limited, and the order of steps can be adjusted or some steps can be reduced or added according to actual needs. The abnormality detection method of C2F application data provided in the embodiment of the present application can be applied to the server or intelligent terminal carrying the C2F platform in the C2F scenario, and can also be applied to the server or intelligent terminal performing application data detection in the factory end (i.e., the F end), and can also be applied to other control processors associated with the C2F scenario.

[0132] Step 901: Acquire target C2F application data.

[0133] Step 902: Mask the target C2F application data to obtain the target prompt word prefix and the target prompt word answer.

[0134] Step 903: Input the target prompt word prefix into the C2F application data anomaly detection model obtained after training to perform data prediction processing to obtain target prediction prompt data.

[0135] Step 904: Based on the loss value between the target prediction prompt data and the target prompt word answer, obtain the target anomaly detection result of the target C2F application data.

[0136] Steps 901 to 904 are described in detail below.

[0137] Reference Fig.10, is a diagram of the architecture of an industrial data anomaly detection device in a C2F scenario provided by an embodiment of the present application. Fig.10 As shown, at the C-end, customers send user demand data to the application layer based on their customized needs. The application layer decomposes the customer's needs to the F-end. The various actuators in the physical layer of the F-end are controlled by the PLC through the controller, and they work closely together on the assembly line to perform production operations. At the same time, the real-time collected data is transmitted to the digital layer through the OPC UA communication architecture.

[0138] Then, during the data transmission process, the flowing target C2F application data is obtained in real time for anomaly detection, which includes masking the target C2F application data to obtain the target prompt word prefix and the target prompt word answer, and then inputting the target prompt word prefix into the trained C2F application data anomaly detection model for data prediction processing to obtain the target predicted prompt data, and finally, based on the loss value between the target predicted prompt data and the target prompt word answer, the target anomaly detection result of the target C2F application data is obtained.

[0139] Next, a detection report is generated based on the target anomaly detection results, and the detection report is sent to the application layer. The application layer makes decisions based on the results of the anomaly detection to issue more efficient production control instructions based on the detection status of the production process to improve production efficiency.

[0140] The input data processed by the embodiment of the present application is the data to be detected collected by the factory end, and the prompt input and prompt answer are obtained through the randomly generated mask matrix B. The data targeted by the anomaly detection method of the present application is multiple continuous time series data, which is time series data collected simultaneously on multiple variables, including multiple variables, each of which is a sequence that changes over time.

[0141] The hinting method provided by this application is based on the observation that the root cause of the anomaly will disrupt the interpolation process of the normal variables. The fine-tuned large model with normal behavior patterns cannot reconstruct the masked variables based on the anomaly variables. For the test timestamp, the input feed includes the root cause variable, and the first m variables are assumed to contain the root cause variable to construct the hint. Assume that each anomaly timestamp has The proposed model masks the root cause variables. The probability that at least one root cause variable is not masked is given by the following formula (13).

[0142]

[0143] if , then p =1.

[0144] In summary, If the number is small or does not meet certain conditions, effective detection cannot be achieved. The number of prompts in this application needs to be selected to exceed a certain unmasked variable to ensure effective detection.

[0145] An important innovation of this application is to modify the timestamp mask operation to a variable-based mask operation. The unmasked and masked variables are respectively identified as prompt input and prompt answer, thereby getting rid of the text-driven prompt template, minimizing the difference between the predicted prompt answer and the actual prompt answer to fine-tune the C2F application data anomaly detection model OLM, and only activating the feedforward and normalization layers. In the test phase, if the output answer is far enough from the actual mask variable, an anomaly alarm will be triggered.

[0146] This application improves the masking operation to construct hints by masking the variables instead of the traditional method (masking the timestamp samples), which is called variable-level hints. The unmasked variables are used as prefix components, corresponding to the text-based prefix hint template. OLM fills the masked variables or vacancies through fine-tuning, while the activated feed-forward and normalization layers reduce the training burden and maintain acceptable detection accuracy.

[0147] The C2F application data anomaly detection model training method, anomaly detection method and related equipment proposed in the embodiment of the present application include: first, obtaining multiple continuous time series data in the C2F application data, performing missing data filling operation on the multiple time series data to obtain filled time series data, normalizing the filled time series data to obtain normalized time series data, and dividing the multiple normalized time series data according to the time order in the normalized time series data based on a preset sliding step size to obtain multiple continuous C2F application data sequences; then, obtaining mask matrices one by one, the mask matrix includes a mask ratio parameter, generating a prompt word prefix based on the Hadamard product of the mask matrix and the C2F application data sequence, generating a prompt word answer based on the complement of the mask matrix and the Hadamard product of the C2F application data sequence, the prompt word prefix and the prompt word answer satisfying the complementary data condition, the complementary data condition generation includes subtracting the mask ratio parameter from one, and then accumulating and multiplying the total length of the time series and the number of features of the feature data to obtain a first mask data value, and generating a prompt word prefix based on the first matrix norm of the prompt word prefix and the first mask data The first mask condition is generated based on the numerical relationship of the second matrix norm of the prompt word answer and the second mask data value, which is multiplied by the total length of the time series and the number of features to obtain the second mask data value, and the second mask condition is generated based on the numerical relationship of the second matrix norm of the prompt word answer and the second mask data value, which is multiplied by the total length of the time series and the number of features to obtain the complementary mask data value, and the mask complementary condition is generated based on the numerical relationship of the first matrix norm, the second matrix norm and the complementary mask data value, so that the prompt word prefix and the prompt word answer are complementary; next, the prompt word prefix is ​​padded to obtain a padded mask data sequence, and the padded mask data sequence is input into the C2F application data anomaly detection model for mapping data prediction processing to obtain predicted prompt data; finally, based on the difference between each predicted prompt data and the corresponding prompt word answer, the matrix second norm is processed again to obtain the data sequence loss value corresponding to each C2F application data sequence, and the normalization layer parameters of the normalization layer and / or the feedforward layer parameters of the feedforward layer are adjusted based on at least one data sequence loss value, and the trained C2F application data detection model is used to perform anomaly detection on the C2F application data.

[0148] The embodiment of the present application performs model training on a C2F application data anomaly detection model for multiple time-continuous C2F application data without limiting the limited data detection moment, so as to improve the detection data volume and time series correlation of the detection sample, and uses a preset sliding step size to perform time series division on the time series data, so as to reduce the amount of data processed each time while maintaining the time series correlation of the data, so as to reduce the data processing time, thereby improving the training efficiency of the model training; then, each C2F application data sequence after time series division is masked and divided using a mask processing based on a variable to obtain complementary prompt word prefixes and prompt word answers that characterize the C2F scenario, and then further uses the C2F application data anomaly detection model to train the C2F application data anomaly detection model based on the loss value between the predicted prompt data output by the prompt word prefix and the prompt word answer, so that the C2F application data anomaly detection model can learn the correlation of complementary data in normal C2F application data, so that the trained C2F application data anomaly detection model can be used in actual applications. When the detection model performs security detection on C2F application data, the loss value between the complementary data obtained by masking in the C2F application data can be used to calculate the correlation of the C2F application data, and then the anomaly detection result of the C2F application data can be accurately obtained by using the C2F application data correlation, which greatly improves the accuracy and reliability of anomaly detection of C2F application data. In addition, by obtaining multiple continuous time series data in the C2F application data, and performing missing data filling, normalization processing and sliding time window division in sequence, the missing data filling operation is used to ensure the integrity of the data, avoid anomaly detection errors caused by missing data, and improve the reliability of detection. Secondly, the normalization processing is used to scale the data to a uniform range, improve the distribution characteristics of the data, accelerate the convergence speed of the subsequent anomaly detection algorithm, and improve the detection efficiency. Finally, the sliding time window division is used to divide the continuous time series data into multiple fixed-size windows, which can effectively capture local patterns and trends in the data and enhance the sensitivity and accuracy of anomaly detection. These steps work together to make industrial data anomaly detection in the C2F scenario more efficient and accurate, and better cope with complex industrial environments with multiple protocols and multiple data types; in addition, the introduction of the mask matrix makes it possible to generate prompt word prefixes and prompt word answers without relying on specific text prompt word templates, which simplifies the modeling process, reduces the model's dependence on specific text prompt words, and enhances the model's versatility and flexibility; secondly, the Hadamard product operation ensures the complementarity of the prompt word prefix and the prompt word answer, allowing the model to perform data segmentation without losing key information, thereby improving the accuracy and robustness of anomaly detection; finally, the generation of complementary data conditions ensures the balance of the prompt word prefix and the prompt word answer in terms of data volume through the calculation of the mask ratio parameter and the total length of the time series, avoids the problem of data skew, and further optimizes the training effect of the model.These steps work together to enable the industrial data anomaly detection method in the C2F scenario to more efficiently process complex industrial data with multiple protocols and data types, thereby improving the accuracy and efficiency of anomaly detection. In addition, by padding the prompt word prefix to generate a padding mask data sequence, the integrity and consistency of the input data are ensured. The padding mask data sequence is input into the C2F application data anomaly detection model for mapping data prediction processing, which enables the model to better adapt to diverse industrial data scenarios. In this way, the model can more accurately capture abnormal data in the data and improve its generalization ability in complex industrial environments. In addition, the difference between the predicted prompt data and the actual answer is processed by the matrix bi-norm, which can measure the overall deviation of the data sequence from a multi-dimensional space. Compared with the single-point error calculation, it can better capture the global abnormal characteristics in complex industrial data. The distribution calibration parameters of the normalization layer and the feature extraction parameters of the feedforward layer are adjusted inversely by the loss value, realizing the adaptability of the model to the dynamic industrial environment. The optimization of the parameters of the normalization layer can eliminate the impact of the dimensional differences of multi-source data on the model and ensure the distribution consistency of the integrated data in the IT / OT field. The iterative update of the parameters of the feedforward layer enhances the expression ability of the industrial large model for local patterns and cross-protocol data features within the time window. In this way, the C2F application data anomaly detection model can fully learn the correlation between normal continuous time data in the C2F scenario, which is convenient for using the C2F application data correlation to generate accurate abnormal data detection results when performing C2F application data anomaly detection in actual applications.

[0149] The present application also provides a C2F application data anomaly detection model training device, which can implement the above-mentioned C2F application data anomaly detection model training method, referring to Fig.11 , the device 1100 comprises: The data sequence division module 1110 is used to obtain a plurality of continuous C2F application data sequences according to a plurality of continuous time series data based on a preset sliding step size; The mask generation module 1120 is used to perform variable mask processing on each C2F application data sequence one by one to obtain a prompt word prefix and a prompt word answer corresponding to each C2F application data sequence, wherein the prompt word prefix and the prompt word answer are complementary to each other; Prediction data generation module 1130, used to input the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data; The model training module 1140 is used to calculate the loss value according to each predicted prompt data and the corresponding prompt word answer, and perform model training on the C2F application data anomaly detection model based on the loss value.

[0150] In some embodiments, the mask generation module 1120 is further configured to: Get the mask matrix, which includes the mask ratio parameter; Generate the prompt word prefix based on the Hadamard product of the mask matrix and the C2F application data sequence; Based on the Hadamard product of the complement of the mask matrix and the C2F application data sequence, the prompt word answer is generated, and the prompt word prefix and the prompt word answer meet the complementary data condition, which is generated based on the mask ratio parameter and the total length of the time series.

[0151] In some embodiments, the mask generation module 1120 is further configured to: Based on one minus the mask ratio parameter, multiplying the total length of the time series and the number of features of the feature data, a first mask data value is obtained, and based on the numerical relationship between the first matrix norm of the prompt word prefix and the first mask data value, a first mask condition is generated; Multiplying the mask ratio parameter, the total length of the time series, and the number of features to obtain a second mask data value, and generating a second mask condition based on the numerical relationship between the second matrix norm of the prompt word answer and the second mask data value; The complementary mask data value is obtained by multiplying the total length of the time series and the number of features, and the mask complementarity condition is generated based on the numerical relationship between the first matrix norm, the second matrix norm and the complementary mask data value.

[0152] In some embodiments, the prediction data generation module 1130 is further configured to: Perform padding processing on the prompt word prefix to obtain a padding mask data sequence; The filled mask data sequence port is input into the C2F application data anomaly detection model for mapping data prediction processing to obtain prediction prompt data.

[0153] In some embodiments, the model training module 1140 is further configured to: Based on the difference between each predicted prompt data and the corresponding prompt word answer, matrix bi-norm processing is performed to obtain the data sequence loss value corresponding to each C2F application data sequence; A normalization layer parameter of a normalization layer and / or a feed-forward layer parameter of a feed-forward layer are adjusted based on at least one data sequence loss value.

[0154] In some embodiments, the data sequence partitioning module 1110 is further configured to: Obtain multiple continuous time series data in C2F application data; Perform missing data filling operation on multiple time series data to obtain filled time series data; Normalize the filled time series data to obtain normalized time series data; Based on a preset sliding step, multiple normalized time series data are divided according to the time order in the normalized time series data to obtain multiple continuous C2F application data sequences.

[0155] In the above embodiments, the description of each embodiment has its own emphasis. For the part that is not described in detail in a certain embodiment, the specific implementation of the C2F application data anomaly detection model training device is basically the same as the specific implementation of the above C2F application data anomaly detection model training method, and will not be repeated here.

[0156] In the embodiment of the present application, the C2F application data anomaly detection model training device performs model training on the C2F application data anomaly detection model for multiple time-continuous C2F application data without limiting the limited data detection moment, so as to improve the detection data volume and time series relevance of the detection sample, and use the preset sliding step size to time series divide the time series data, so as to reduce the amount of data processed each time while maintaining the time series relevance of the data, so as to reduce the data processing time, thereby improving the training efficiency of the model training; then, each C2F application data sequence after time series division is masked and divided by using the mask processing based on the variable to obtain the complementary prompt word prefix and prompt word answer representing the C2F scene, and then further use the C2F application data anomaly detection model to train the C2F application data anomaly detection model for the loss value between the predicted prompt data output by the prompt word prefix and the prompt word answer, so that the C2F application data anomaly detection model can learn the relevance of complementary data in normal C2F application data, so that the trained C2F application data can be used in actual applications. When the C2F application data anomaly detection model performs security detection on C2F application data, the loss value between the complementary data obtained by masking in the C2F application data can be used to calculate the C2F application data correlation, and then the C2F application data correlation can be used to accurately obtain the anomaly detection result of the C2F application data, which greatly improves the accuracy and reliability of C2F application data anomaly detection. In addition, by obtaining multiple continuous time series data in the C2F application data, and performing missing data filling, normalization processing and sliding time window division in sequence, the missing data filling operation is used to ensure the integrity of the data, avoid anomaly detection errors caused by missing data, and improve the reliability of detection. Secondly, the normalization processing is used to scale the data to a uniform range, improve the distribution characteristics of the data, accelerate the convergence speed of the subsequent anomaly detection algorithm, and improve the detection efficiency. Finally, the sliding time window division is used to divide the continuous time series data into multiple fixed-size windows, which can effectively capture local patterns and trends in the data and enhance the sensitivity and accuracy of anomaly detection.These steps work together to make industrial data anomaly detection in the C2F scenario more efficient and accurate, and better cope with complex industrial environments with multiple protocols and multiple data types; in addition, the introduction of the mask matrix makes it possible to generate prompt word prefixes and prompt word answers without relying on specific text prompt word templates, which simplifies the modeling process, reduces the model's dependence on specific text prompt words, and enhances the model's versatility and flexibility; secondly, the Hadamard product operation ensures the complementarity of the prompt word prefix and the prompt word answer, allowing the model to perform data segmentation without losing key information, thereby improving the accuracy and robustness of anomaly detection; finally, the generation of complementary data conditions ensures the balance of the prompt word prefix and the prompt word answer in terms of data volume through the calculation of the mask ratio parameter and the total length of the time series, avoids the problem of data skew, and further optimizes the training effect of the model. These steps work together to enable the industrial data anomaly detection method in the C2F scenario to more efficiently process complex industrial data with multiple protocols and data types, thereby improving the accuracy and efficiency of anomaly detection. In addition, by padding the prompt word prefix to generate a padding mask data sequence, the integrity and consistency of the input data are ensured. The padding mask data sequence is input into the C2F application data anomaly detection model for mapping data prediction processing, which enables the model to better adapt to diverse industrial data scenarios. In this way, the model can more accurately capture abnormal data in the data and improve its generalization ability in complex industrial environments. In addition, the difference between the predicted prompt data and the actual answer is processed by the matrix bi-norm, which can measure the overall deviation of the data sequence from a multi-dimensional space. Compared with the single-point error calculation, it can better capture the global abnormal characteristics in complex industrial data. The distribution calibration parameters of the normalization layer and the feature extraction parameters of the feedforward layer are adjusted inversely by the loss value, which realizes the adaptability of the model to the dynamic industrial environment. The optimization of the parameters of the normalization layer can eliminate the impact of the dimensional differences of multi-source data on the model and ensure the distribution consistency of the integrated data in the IT / OT field. The iterative update of the parameters of the feedforward layer enhances the expression ability of the industrial large model for local patterns and cross-protocol data features within the time window. In this way, the C2F application data anomaly detection model can fully learn the correlation between continuous time data in the C2F scenario, which is convenient for using the C2F application data correlation to generate accurate abnormal data detection results when performing C2F application data anomaly detection in actual applications.

[0157] The present application also provides an electronic device, including: at least one memory; at least one processor; at least one program; The program is stored in the memory, and the processor executes the at least one program to implement the C2F application data anomaly detection model training method implemented in this application. The electronic device can be any intelligent terminal including a mobile phone, a tablet computer, a personal digital assistant (PDA), a car computer, etc.

[0158] See also Fig.12 , Fig.12 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes: The processor 1201 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application; The memory 1202 can be implemented in the form of ROM (Read Only Memory), static storage device, dynamic storage device or RAM (Random Access Memory). The memory 1202 can store operating systems and other applications. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1202, and the processor 1201 calls and executes the C2F application data anomaly detection model training method of the embodiment of this application; Input / output interface 1203, used to implement information input and output; The communication interface 1204 is used to realize the communication interaction between the device and other devices. The communication can be realized through a wired manner (such as USB, network cable, etc.) or a wireless manner (such as mobile network, WIFI, Bluetooth, etc.); A bus 1205 that transmits information between various components of the device (e.g., the processor 1201, the memory 1202, the input / output interface 1203, and the communication interface 1204); The processor 1201 , the memory 1202 , the input / output interface 1203 and the communication interface 1204 are connected to each other in communication within the device via the bus 1205 .

[0159] An embodiment of the present application also provides a storage medium, which is a computer-readable storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the above-mentioned C2F application data anomaly detection model training method is implemented.

[0160] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0161] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0162] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0163] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0164] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0165] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0166] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0167] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. The mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0168] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0169] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0170] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0171] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A C2F application data anomaly detection model training method, characterized in that: The method comprises: Based on a preset sliding step, a plurality of continuous C2F application data sequences are obtained according to a plurality of continuous time series data; Performing variable masking processing on each of the C2F application data sequences one by one to obtain a prompt word prefix and a prompt word answer corresponding to each of the C2F application data sequences, wherein the prompt word prefix and the prompt word answer are complementary to each other; Inputting the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data; A loss value is calculated based on each predicted prompt data and the corresponding prompt word answer, and a C2F application data anomaly detection model is trained based on the loss value. The trained C2F application data detection model is used to perform anomaly detection on C2F application data.

2. The C2F application data anomaly detection model training method according to claim 1, characterized in that: The multiple time series data include the total length of the time series, and the variable masking process is performed on each of the C2F application data sequences to obtain the prompt word prefix and prompt word answer corresponding to each of the C2F application data sequences, including: Obtaining a mask matrix, wherein the mask matrix includes a mask ratio parameter; generating the prompt word prefix based on the Hadamard product of the mask matrix and the C2F application data sequence; The prompt word answer is generated based on the Hadamard product of the complement of the mask matrix and the C2F application data sequence, and the prompt word prefix and the prompt word answer satisfy a complementary data condition, and the complementary data condition is generated based on the mask ratio parameter and the total length of the time series.

3. The C2F application data anomaly detection model training method according to claim 2, characterized in that: The time series data includes a plurality of feature data, the complementary data condition includes a first mask condition, a second mask condition and a mask complementary condition, and the steps of generating the complementary data condition include: Based on one minus the mask ratio parameter, multiplying the total length of the time series and the number of features of the feature data, a first mask data value is obtained, and based on the numerical relationship between the first matrix norm of the prompt word prefix and the first mask data value, the first mask condition is generated; Multiplying the mask ratio parameter, the total length of the time series and the number of features to obtain a second mask data value, and generating the second mask condition based on the numerical relationship between the second matrix norm of the prompt word answer and the second mask data value; The total length of the time series and the number of features are multiplied to obtain a complementary mask data value, and the mask complementarity condition is generated based on a numerical relationship among the first matrix norm, the second matrix norm and the complementary mask data value.

4. The C2F application data anomaly detection model training method according to claim 1, characterized in that: The step of inputting the prompt word prefix into the C2F application data anomaly detection model for data prediction to generate prediction prompt data includes: Performing padding processing on the prompt word prefix to obtain a padding mask data sequence; The filling mask data sequence port is input into the C2F application data anomaly detection model to perform mapping data prediction processing to obtain the prediction prompt data.

5. The C2F application data anomaly detection model training method according to claim 1, characterized in that: The C2F application data anomaly detection model includes a normalization layer and a feedforward layer, and the loss value is calculated according to each of the predicted prompt data and the corresponding prompt word answer, and the C2F application data anomaly detection model is trained based on the loss value, including: Based on the difference between each predicted prompt data and the corresponding prompt word answer, matrix bi-norm processing is performed to obtain a data sequence loss value corresponding to each C2F application data sequence; A normalization layer parameter of the normalization layer and / or a feed-forward layer parameter of the feed-forward layer are adjusted based on at least one of the data sequence loss values.

6. The C2F application data anomaly detection model training method according to claim 1, characterized in that: The method of obtaining a plurality of continuous C2F application data sequences based on a preset sliding step size and a plurality of continuous time series data comprises: Obtain multiple continuous time series data in C2F application data; Performing a missing data filling operation on the multiple time series data to obtain filled time series data; Normalizing the filled time series data to obtain normalized time series data; Based on the preset sliding step size, the multiple normalized time series data are divided according to the time order in the normalized time series data to obtain the multiple continuous C2F application data sequences.

7. A method for detecting anomalies in C2F application data, characterized in that: The method comprises: Get the target C2F application data; Masking the target C2F application data to obtain a target prompt word prefix and a target prompt word answer; Inputting the target prompt word prefix into the C2F application data anomaly detection model obtained after training as claimed in claim 1 to perform data prediction processing to obtain target prediction prompt data; Based on the loss value between the target prediction prompt data and the target prompt word answer, a target anomaly detection result of the target C2F application data is obtained.

8. A C2F application data anomaly detection model training device, characterized in that: The device comprises: A data sequence partitioning module, used for obtaining a plurality of continuous C2F application data sequences according to a plurality of continuous time series data based on a preset sliding step size; a mask generation module, configured to perform variable mask processing on each of the C2F application data sequences one by one, to obtain a prompt word prefix and a prompt word answer corresponding to each of the C2F application data sequences, wherein the prompt word prefix and the prompt word answer are complementary to each other; A prediction data generation module, used for inputting the prompt word prefix into the C2F application data anomaly detection model to perform data prediction and generate prediction prompt data; The model training module is used to calculate a loss value according to each of the predicted prompt data and the corresponding prompt word answer, and perform model training on the C2F application data anomaly detection model based on the loss value.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the C2F application data anomaly detection model training method according to any one of claims 1 to 6 or the C2F application data anomaly detection method according to claim 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the computer program implements the C2F application data anomaly detection model training method according to any one of claims 1 to 6 or the C2F application data anomaly detection method according to claim 7.

Images