Abnormality detection processing method and device

Abstract

The embodiment of the invention provides an anomaly detection processing method and device, and the method comprises the steps: carrying out the feature conversion of a sequence feature of a first data sequence corresponding to a to-be-processed object, and obtaining a conversion feature; according to the conversion feature and an auxiliary sequence feature of a second data sequence corresponding to the to-be-processed object, constructing a position feature of the first data sequence; performing fusion processing on the position feature and the sequence feature to obtain a fusion feature, and calculating a target sequence feature of the first data sequence according to the fusion feature, the auxiliary sequence feature and the sequence feature; and based on the target sequence feature and the sequence feature of the second data sequence, performing anomaly detection on the to-be-processed object to obtain a detection result. By adopting the embodiment of the invention, the accuracy of anomaly detection can be improved.

Description

Technical Field

[0001] This document relates to the field of data processing technology, and in particular to an anomaly detection and processing method and device. Background Art

[0002] With the continuous development of Internet technology and the continuous advancement of social information, more and more business scenarios need to perform anomaly detection in order to ensure stable business operation. Anomaly detection can timely handle and resolve abnormal situations in business scenarios. In the process of anomaly detection, there may be data sequences of multiple dimensions input, and anomaly detection is performed jointly by combining data sequences of multiple dimensions.

[0003] At present, in the process of anomaly detection, data analysis is often performed independently on data sequences of multiple dimensions, and the anomaly detection results are determined by combining the data analysis results, ignoring the connection between the data sequences of multiple dimensions, resulting in low detection accuracy of the entire anomaly detection. Summary of the invention

[0004] An object of one embodiment of the present specification is to provide an anomaly detection processing method and device to improve the accuracy of anomaly detection.

[0005] To solve the above technical problems, an embodiment of this specification is implemented as follows: In a first aspect, an embodiment of the present specification provides an abnormality detection processing method, the method comprising: Performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructing a position feature of the first data sequence according to the conversion feature and an auxiliary sequence feature of the second data sequence corresponding to the object to be processed; fusing the position feature and the sequence feature to obtain a fused feature, and calculating a target sequence feature of the first data sequence according to the fused feature, the auxiliary sequence feature and the sequence feature; Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

[0006] The anomaly detection processing method provided in this embodiment firstly performs feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features, and constructs the position features of the first data sequence according to the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed, so that not only the position features of the first data sequence are constructed by the conversion features of the first data sequence corresponding to the object to be processed, but also the position features of the first data sequence are constructed in combination with the auxiliary sequence features of the second data sequence, thereby improving the comprehensiveness and accuracy of the constructed position features of the first data sequence; secondly, according to the position features, sequence features and auxiliary sequence features of the second data sequence, the target sequence features of the first data sequence are calculated, and on this basis, the target sequence features of the first data sequence are calculated in combination with the target sequence features of the first data sequence. and the sequence characteristics of the second data sequence, perform anomaly detection on the processed object to obtain a detection result, thereby introducing the auxiliary sequence characteristics of the second data sequence in the process of calculating the target sequence characteristics of the first data sequence, so that the position characteristics and sequence characteristics of the first data sequence interact with each other, and the position characteristics and sequence characteristics of the first data sequence also interact with the auxiliary sequence characteristics of the second data sequence, and calculate the target sequence characteristics by using the position characteristics, sequence characteristics of the first data sequence and the auxiliary sequence characteristics of the second data sequence to improve the comprehensiveness of the calculated target sequence characteristics and improve the effectiveness of the target sequence characteristics, and then perform anomaly detection by using more comprehensive and effective target sequence characteristics and sequence characteristics of the second data sequence to improve the accuracy of anomaly detection.

[0007] In a second aspect, another embodiment of the present specification provides an abnormality detection processing device, the device comprising: A feature conversion module, used to perform feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; A feature construction module, used to construct a position feature of the first data sequence according to the conversion feature and the auxiliary sequence feature of the second data sequence corresponding to the object to be processed; a feature calculation module, configured to fuse the position feature and the sequence feature to obtain a fused feature, and calculate a target sequence feature of the first data sequence based on the fused feature, the auxiliary sequence feature and the sequence feature; The anomaly detection module is used to perform anomaly detection on the object to be processed based on the target sequence characteristics and the sequence characteristics of the second data sequence to obtain a detection result.

[0008] In a third aspect, another embodiment of the present specification provides an anomaly detection and processing device, the device comprising: a memory, a processor, and computer executable instructions stored on the memory and executable on the processor, wherein the computer executable instructions, when executed by the processor, implement the steps of the anomaly detection and processing method as described in the first aspect above.

[0009] In a fourth aspect, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the anomaly detection processing method described in the first aspect above are implemented.

[0010] In a fifth aspect, another embodiment of the present specification provides a computer program product, wherein the computer program product includes an anomaly detection processing program, and the anomaly detection processing program is executed by a processor to implement the steps of the anomaly detection processing method as described in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate one or more embodiments of the present specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present specification. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative work. Figure 1 A processing flow chart of an abnormality detection processing method provided by one embodiment of this specification; Figure 2 A schematic diagram of a calculation process of a target sequence feature of a first data sequence provided in one embodiment of the present specification; Figure 3 A schematic diagram of a calculation process of anomaly detection probability provided by one embodiment of this specification; Figure 4 A processing flow chart of an anomaly detection processing method applied to an anomaly detection scenario provided by an embodiment of this specification; Figure 5 A schematic diagram of an abnormality detection and processing device provided in one embodiment of this specification; Figure 6 A schematic diagram of the structure of an abnormality detection and processing device provided in one embodiment of this specification. DETAILED DESCRIPTION

[0012] In order to enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the following will be combined with the drawings in one or more embodiments of this specification to clearly and completely describe the technical solutions in one or more embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this document.

[0013] An example of an abnormality detection method provided in this specification is as follows: The anomaly detection and processing method provided in this embodiment can be executed by a computer device, which can be a terminal or a server, wherein the terminal can include a mobile phone, a laptop computer, an intelligent interactive device, etc., and the server can include an independent physical server, a server cluster composed of multiple servers, or a cloud server capable of cloud computing.

[0014] Reference Figure 1 The abnormality detection and processing method provided in this embodiment specifically includes the following steps S102 to S108.

[0015] Step S102: performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features.

[0016] The object to be processed in this embodiment may be any type of object, for example, the object to be processed may be a user and / or a road condition. In addition, the object to be processed may also be other types of objects, such as system operation status.

[0017] The first data sequence corresponding to the object to be processed refers to the first data sequence related to the object to be processed. The first data sequence may be a sequence composed of one or more data related to the object to be processed. The data category of the second data sequence may be different from the data category of the first data sequence. For example, if the object to be processed is road conditions, the first data sequence is a temperature data sequence, that is, a sequence composed of temperature data at various time points, and the second data sequence is a traffic flow sequence, that is, a sequence composed of traffic flow data at various time points; for another example, if the object to be processed is the system operation status, the first data sequence is an operation time sequence, and the second data sequence is a sequence of the number of visited pages. The first data sequence may be one or more sequences; the second data sequence may also be one or more sequences.

[0018] The sequence characteristics of the first data sequence corresponding to the object to be processed may include sequence characteristics obtained by encoding the first data sequence. The sequence characteristics of the first data sequence may specifically be a sequence characteristic matrix of the first data sequence. For example, the first data sequence is a temperature data sequence, and the temperature data sequence contains n temperature data. Then, the sequence characteristics of the first data sequence may be a sequence characteristic matrix of n rows and x columns, or a sequence characteristic matrix of x rows and n columns, where x may be any value determined according to the actual application scenario, for example, x is set to 16.

[0019] In practical applications, the sequence length of the first data sequence corresponding to the object to be processed is not fixed, that is, the number of data contained in the first data sequence is not fixed. For example, the number of temperature data contained in the temperature data sequence is not fixed, which may lead to the inability to adapt to the auxiliary sequence features of the second data sequence in the subsequent process of constructing the position features of the first data sequence. At the same time, the first data sequence corresponding to the object to be processed may have data sequence errors. In view of this, in order to fix the length of the sequence features of the first data sequence and correct the data sequence errors in the first data sequence; in this embodiment, the sequence features of the first data sequence corresponding to the object to be processed can be subjected to feature conversion to obtain conversion features; Specifically, in the process of performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain the conversion features, feature conversion may be performed on the sequence features of the first data sequence based on the auxiliary features to obtain the conversion features; or the sequence features of the first data sequence and the auxiliary features may be inner-producted to obtain the conversion features; or the row vector of the auxiliary features may be inner-producted with the column vector of the sequence features of the first data sequence to obtain the conversion features; Among them, the auxiliary features may include an auxiliary feature matrix. Continuing with the above example, when the sequence feature of the first data sequence is a sequence feature matrix with n rows and 16 columns, the auxiliary features may be an auxiliary feature matrix with s rows and 8 columns, where s may be any value; the conversion features may include a conversion feature matrix.

[0020] During the specific implementation process, in the process of performing feature conversion on the sequence features of the first data sequence based on the auxiliary features to obtain the conversion features, the values ​​of each row in the auxiliary features can be multiplied by the values ​​of each column of the sequence features of the first data sequence, and the sum of the products of the values ​​of each row and the values ​​of each column is calculated, and the conversion features are constructed based on the sum obtained by the calculation; in this way, not only the sequence features of the first data sequence are converted into conversion features of a fixed length through the auxiliary features, but also the elements in the sequence features of the first data sequence can be fused and interacted with each other, and the data sequence errors appearing in the first data sequence can be corrected to a certain extent through the fusion and interaction.

[0021] For example, the sequence feature matrix of the first data sequence of the object to be processed is n rows and 16 columns, and the auxiliary feature matrix is ​​s rows and 8 columns. The 8 values ​​of the first row of the auxiliary feature matrix are multiplied with the 8 values ​​of the first column of the sequence feature matrix to obtain 8 products, and then the 8 values ​​of the first row are multiplied with the 8 values ​​of the 9th to 16th values ​​of the first column of the sequence feature matrix to obtain 8 products. This cycle is repeated until all the n values ​​of the first column of the sequence feature matrix are multiplied to obtain n products, and then the n products are added to obtain the sum, which is placed in the first row and first column of the conversion feature matrix. This cycle is repeated until the auxiliary feature matrix is ​​multiplied. The 8 values ​​in the first row of the auxiliary feature matrix are multiplied with the values ​​in the 2nd to 16th columns of the sequence feature matrix respectively, and n products are obtained for each column in the 2nd to 16th columns of the sequence feature matrix. The n products of each column are added together, and the sum is placed in the 2nd to 16th columns of the first row of the conversion feature matrix; the above process is repeated until all s rows in the auxiliary feature matrix and the values ​​in the 1st to 16th columns of the sequence feature matrix are calculated, and the conversion features of s rows and 16 columns are obtained; in this way, the length of the sequence feature matrix can be compressed from s aspects through the auxiliary feature matrix of s rows, thereby improving the effectiveness of compression.

[0022] Step S104: constructing a position feature of the first data sequence according to the conversion feature and the auxiliary sequence feature of the second data sequence corresponding to the object to be processed.

[0023] The above step performs feature conversion on the sequence features of the first data sequence of the object to be processed to obtain conversion features. In this step, the position features of the first data sequence are constructed from two aspects: the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed.

[0024] The second data sequence in this embodiment can be a sequence composed of one or more data related to the object to be processed; for example, the second data sequence is a traffic flow sequence, that is, it can be a sequence composed of traffic flow data at various time points, and the traffic flow sequence contains v traffic flow data. Then, the sequence feature of the second data sequence can be a sequence feature matrix of v rows and x columns, or a sequence feature matrix of x rows and v columns, where x can be the same as or different from the x in the sequence feature of the first data sequence.

[0025] The auxiliary sequence feature of the second data sequence corresponding to the object to be processed may be an auxiliary sequence feature describing the data content of the second data sequence corresponding to the object to be processed; the auxiliary sequence feature may be an auxiliary sequence feature vector; in addition, the auxiliary sequence feature of the second data sequence corresponding to the object to be processed in this embodiment may be directly replaced by the auxiliary sequence features of the first data sequence and the second data sequence, and the auxiliary sequence features of the two may be determined based on the number of sequences of the first data sequence and the second data sequence; the auxiliary sequence features of the two may include not only the first auxiliary sequence feature of the second data sequence, but also the second auxiliary sequence feature of the first data sequence, the first auxiliary sequence feature and the second auxiliary sequence feature may be the first auxiliary sequence feature vector and the second auxiliary sequence feature vector, respectively, and the first auxiliary sequence feature and the second auxiliary sequence feature may be obtained by auxiliary feature encoding based on the first data sequence and the second data sequence, respectively; for example, the first data sequence is a temperature data sequence, the second data sequence is a traffic flow sequence, and the number of sequences of the first data sequence and the second data sequence is 2 in total, so the auxiliary sequence features of the two may be a feature matrix with 2 rows and 16 columns; for another example, the auxiliary sequence features of the two are a matrix with m rows and 16 columns, and m represents that the total number of sequences of the first data sequence and the second data sequence is m.

[0026] The position feature of the first data sequence may be a position feature matrix of the first data sequence, and specifically may be a position embedding matrix of the first data sequence.

[0027] In practical applications, the process of constructing the position features of the first data sequence may be affected by the second data sequence. To this end, in order to improve the accuracy of the position features of the constructed first data sequence, the auxiliary sequence features of the second data sequence of the object to be processed may be introduced to assist in the construction of the position features of the first data sequence. In an optional implementation provided by this embodiment, in the process of constructing the position features of the first data sequence according to the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed, the following operations are performed: The conversion feature and the auxiliary sequence feature are spliced ​​to obtain a spliced ​​feature, and the spliced ​​feature is subjected to position feature screening based on the position screening feature to obtain an intermediate position feature; The intermediate position features are dimensionally upgraded according to the number of rows of the sequence features of the first data sequence to obtain position features.

[0028] Among them, the position screening feature can be a screening feature pre-set for position feature screening; the position screening feature can specifically be a position screening feature matrix; the intermediate position feature can also be an intermediate position feature matrix. The number of columns of the position screening feature can be determined based on the number of rows of the splicing feature, and the number of columns of the specific position screening feature can be the same as the number of rows of the splicing feature; the number of rows of the position screening feature can also be determined based on the number of rows of the splicing feature, and optionally, the number of rows of the position screening feature is less than the number of rows of the splicing feature; optionally, the ratio of the number of rows of the sequence feature of the first data sequence to the number of rows of the position screening feature is a positive integer; optionally, the value contained in the position screening feature is determined based on the number of rows of the position screening feature and the number of rows of the splicing feature, for example, the position screening feature is a matrix with q rows and (s+m) columns.

[0029] Specifically, in the process of performing a splicing process on the conversion feature and the auxiliary sequence feature to obtain the splicing feature, the conversion feature and the auxiliary sequence feature may be spliced ​​to obtain the splicing feature.

[0030] For example, the conversion feature is a matrix with s rows and 16 columns, and the auxiliary sequence feature is a matrix with m rows and 16 columns. The conversion feature and the auxiliary sequence feature are concatenated by rows to obtain a concatenated feature with (s+m) rows and 16 columns. In this way, the concatenated feature carries the information of other input data sequences, thereby improving the accuracy of the subsequent construction of position features.

[0031] In the process of performing position feature screening on the splicing feature based on the position screening feature to obtain the intermediate position feature, the position screening feature and the splicing feature may be inner-producted to obtain the intermediate position feature; or the value of each row in the position screening feature may be multiplied with the value of each column in the splicing feature, and the sum of the multiplication results of the value of each row and the value of each column may be calculated, and the intermediate position feature may be constructed based on the calculated sum.

[0032] For example, the location filter feature is:

[0033] in, represents the position screening feature; Represents the bank indivual ; Represents the bank indivual ; Since q is greater than 1, ; The position screening feature is q rows and (s+m) columns, and the splicing feature is (s+m) rows and 16 columns. Multiply the (s+m) values ​​of the 1st row of the position screening feature with the (s+m) values ​​of the i-th column of the splicing feature. For the i-th column of the splicing feature, obtain (s+m) products. Add the (s+m) products to obtain the sum, and put the sum in the 1st row and i-th column of the middle position feature, where i refers to 1-16. Repeat this cycle until the values ​​of each row in the q rows of the position screening feature are multiplied and added with the (s+m) values ​​of the i-th column of the splicing feature to obtain the middle position feature of q rows and 16 columns.

[0034] On the basis of obtaining the position features by performing dimension-upgrading processing on the intermediate position features according to the number of rows of the sequence features of the first data sequence, in order to make the position features after the dimension-upgrading processing retain the time series information and to facilitate the subsequent calculation with the sequence features of the first data sequence; in an optional implementation manner provided by this embodiment, in the process of obtaining the position features by performing dimension-upgrading processing on the intermediate position features according to the number of rows of the sequence features of the first data sequence, the following operations are performed: Determine a dimension-raising value set according to the number of rows of the sequence features of the first data sequence and the number of rows of the middle position features; Based on the dimension-increased numerical set and the intermediate position features, the position features are calculated.

[0035] The dimension-upgraded value set may be a set consisting of one or more dimension-upgraded values; the dimension-upgraded value may be a value used to upgrade the dimension of the intermediate position feature.

[0036] Specifically, in the process of determining the upgraded dimension value set according to the number of rows of sequence features of the first data sequence and the number of rows of middle position features, the ratio of the number of rows of sequence features of the first data sequence to the number of rows of middle position features can be calculated, and the upgraded dimension value set can be constructed based on a preset value, the ratio, and a value between the preset value and the ratio. For example, the number of rows of sequence features of the first data sequence is n, and the middle position features are q rows and 16 columns. The ratio n / q of the number of rows n of sequence features to the number of rows q of middle position features is calculated. The preset value is 1, and the upgraded dimension value set can be "1, 2, 3...n / q", that is, 1-n / q.

[0037] In the process of calculating the position feature based on the dimension-upgraded value set and the intermediate position feature, the value of each row in the intermediate position feature can be multiplied with each value in the dimension-upgraded value set, and the position feature can be constructed according to the multiplication result.

[0038] For example, multiply the value of the first row of the middle position feature by 1, and place the multiplication result in the first row of the position feature, multiply the value of the first row of the middle position feature by 2, and place the multiplication result in the second row of the position feature, and repeat this process until the value of the first row of the middle position feature is multiplied by n / q, and the multiplication result is placed in the n / qth row of the position feature, and then multiply the value of the second row of the middle position feature by 1-n / q respectively, and place the multiplication results in the [(n / q)+1]th row to the [(n / q)+(n / q)]th row of the position feature; repeat this process until the values ​​of the qth row of the middle position feature are multiplied by each dimension-raising value in the dimension-raising value set to obtain a position feature with n rows and 16 columns.

[0039] Step S106: fusing the position feature and the sequence feature to obtain a fused feature, and calculating a target sequence feature of the first data sequence based on the fused feature, the auxiliary sequence feature and the sequence feature.

[0040] The above-mentioned position features of the first data sequence are constructed from two aspects: the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed. In this step, the target sequence features of the first data sequence are calculated based on the position features, the sequence features of the first data sequence and the auxiliary sequence features of the second data sequence.

[0041] In practical applications, in the process of calculating the target sequence features of the first data sequence, the position information of the data in the first data sequence is also crucial. In view of this, in order to improve the accuracy of the target sequence features of the first data sequence obtained by subsequent calculations, in this embodiment, the position features of the first data sequence and the sequence features of the first data sequence can be fused to obtain fused features; thereby, the position information is fused into the sequence features of the first data sequence, so that the sequence features of the first data sequence carry the position information, which can ensure that in the subsequent process of calculating the target sequence features of the first data sequence in parallel, the data order in the first data sequence can still be identified, thereby improving the calculation efficiency of the target sequence features while ensuring a higher calculation accuracy.

[0042] Specifically, in the process of fusing the position feature and the sequence feature of the first data sequence to obtain the fused feature, the values ​​of the position feature and the sequence feature of the first data sequence at the same position may be added, and the fused feature may be constructed based on the addition result.

[0043] Continuing with the above example, the position feature is n rows and 16 columns, and the sequence feature is n rows and 16 columns. Then, the 16 values ​​of the 1st row of the position feature are added to the 16 values ​​of the 1st row of the sequence feature of the first data sequence, respectively, to obtain 16 addition results, which are placed in the 1st row of the fusion feature. Similarly, the values ​​of the 2nd to nth rows of the position feature are added to the values ​​of the 2nd to nth rows of the sequence feature of the first data sequence, respectively, and the addition results are placed in the 2nd to nth rows of the fusion feature, and finally a fusion feature of n rows and 16 columns is obtained.

[0044] In specific implementation, in order to comprehensively combine data of multiple dimensions in the process of calculating the target sequence features of the first data sequence, improve the comprehensiveness of the calculated target sequence features, and improve the effectiveness of the calculated target sequence features, the auxiliary sequence features of the second data sequence may be introduced, and then the fusion features and the sequence features of the first data sequence may be combined to calculate the target sequence features of the first data sequence; in an optional implementation manner provided by this embodiment, in the process of calculating the target sequence features of the first data sequence according to the fusion features, the auxiliary sequence features and the sequence features, the following operations are performed: Perform row splicing processing on the fusion features and the auxiliary sequence features to obtain row splicing features; Column compression processing is performed on the row concatenation features to obtain column compression features, and target sequence features are calculated in parallel based on the column compression features and the sequence features of the first data sequence.

[0045] The column compression processing here may specifically be column convolution compression processing.

[0046] Specifically, in the process of performing row splicing processing on the fusion feature and the auxiliary sequence feature to obtain the row splicing feature, the auxiliary sequence feature can be spliced ​​after the last row of the fusion feature to obtain the splicing feature.

[0047] For example, Figure 2 As shown, the fusion feature is a matrix of n rows and 16 columns, and the auxiliary sequence feature is a matrix of m rows and 16 columns. The matrix of m rows and 16 columns is spliced ​​after the nth row of the matrix of n rows and 16 columns, and the row splicing feature is a matrix of (n+m) rows and 16 columns. In this way, the row splicing feature carries the relevant information of the second data sequence, which is helpful for the subsequent more comprehensive calculation of the target sequence features of the first data sequence.

[0048] On this basis, in actual application scenarios, since the fusion features in the above-obtained row splicing features and the auxiliary sequence features of the second data sequence do not interact with each other, the auxiliary sequence features of the second data sequence cannot really play an active role in the process of calculating the target sequence features of the first data sequence. Therefore, in order to enable the auxiliary sequence features to interact deeply with the fusion features, so that the auxiliary sequence features actively promote the calculation of the target sequence features of the first data sequence, and at the same time to control the row splicing features within a specific length; in an optional implementation manner provided by this embodiment, in the process of performing column compression processing on the row splicing features and obtaining the column compression features, the following operations are performed: Determine a compressed value set according to the number of rows of the sequence feature of the first data sequence; Calculate column compression features based on the compressed value set and row concatenation features.

[0049] The compressed value set may be a set consisting of one or more compressed values; and the compressed value may be a value used to compress the row splicing feature.

[0050] Specifically, in the process of determining the compressed value set according to the number of rows of the sequence feature of the first data sequence, the intermediate value set can be determined according to the number of rows of the sequence feature of the first data sequence, and the target parameter in the preset algorithm is replaced with each intermediate value in the intermediate value set to obtain a compressed value set composed of compressed values; for example, the preset algorithm is , the number of rows of the sequence feature is 16, the intermediate value set determined based on the number of rows of the sequence feature is "1, 2...16", and the j in the preset algorithm is replaced with each intermediate value in the intermediate value set, and the compressed value set is obtained as " "; where i represents the i-th row of the row splicing feature.

[0051] Furthermore, in an optional implementation manner provided by this embodiment, in the process of calculating the column compression feature according to the compressed value set and the row concatenation feature, the following operations are performed: The product of the value of each column in the row concatenation feature and the compressed value in the compressed value set is calculated; According to the calculated products of the multiple values ​​of each column and the compressed value, the total product of each column is calculated, and the column compression feature is constructed based on the total product.

[0052] The total product of each column may include the sum of the products of multiple values ​​of each column and the compressed value.

[0053] For example, the compressed value set is “ The row splicing feature is a matrix with (n+m) rows and 16 columns. Starting from the 1st column and the i-th row of the row splicing feature, the values ​​of the 1st column and the i-th row of the row splicing feature are compared with the values ​​in the compressed value set. Multiply until the (n+m)th row, obtain the (n+m)th product of the first column, add the (n+m)th products to obtain the total product, and place the total product in the first row and first column of the column compression feature; similarly, divide the values ​​of the first column and the i-th row of the row splicing feature by the values ​​in the compressed value set. Multiply the remaining compressed values ​​​​except , add the (n+m) products obtained in each calculation, and put the total product of this time in the 1st row and jth column of the column compression feature; j represents the middle value of the remaining compressed values; repeat the above process until all 16 columns of the row splicing feature are calculated, and obtain a 16-row and 16-column column compression matrix as shown in Figure 2 As shown; thereby, the column compression feature is processed into a specific length, and the information interaction between different sequences of the first data sequence and the second data sequence can be effectively guaranteed.

[0054] In the above process of calculating the target sequence features of the first data sequence in parallel according to the column compression features and the sequence features of the first data sequence, in order to improve the calculation efficiency of the target sequence features, a parallel calculation method can be adopted. Specifically, the row vector of each row in the column compression features and the sequence features of the first data sequence can be input into the corresponding parallel calculation module for vector calculation to obtain each sub-vector, and the target sequence features of the first data sequence are constructed based on each sub-vector; the corresponding parallel calculation module here refers to the parallel calculation module corresponding to the row vector of each row, that is, each row vector can have its own corresponding parallel calculation module.

[0055] Specifically, in the process of vector calculation, the row vector of each row can be inner-producted with the column compression feature to obtain a sub-vector; in the process of constructing the target sequence feature of the first data sequence based on each sub-vector, each sub-vector can be vector-fused to obtain a fused vector, and the fused vector can be vector-compressed to obtain the target sequence feature of the first data sequence.

[0056] For example, Figure 2As shown, the sequence feature of the first data sequence is a matrix of n rows and 16 columns, and the column compression feature is a matrix of 16 rows and 16 columns. There may be n parallel computing modules. The row vector of the i-th (i=1, 2…n) row of the sequence feature of the first data sequence and the column compression feature are both input into the i-th parallel computing module, that is, parallel computing module i. The i-th parallel computing module multiplies the row vector of the i-th row with the column vector of the first column of the column compression feature, adds the 16 products obtained by the multiplication, and puts the obtained sum in the first column of the i-th subvector. , similarly, until all column vectors of the 16 columns of the column compression feature are calculated, the sub-vectors are obtained as 16-dimensional row vectors, and finally n sub-vectors are obtained; the values ​​of the same positions of the n sub-vectors can be added to obtain a fused vector as a 16-dimensional row vector; in order to prevent the vector value from being too large, which is not conducive to subsequent anomaly detection, in the process of vector compression of the fused vector, the fused vector can be vector compressed using a preset value, and the preset value can be determined based on the number of rows of the sequence feature of the first data sequence. The preset value can be n, for example, Figure 2 As shown, the ratio of each value in the fusion vector to n is calculated to obtain the target sequence feature of the first data sequence as a 16-dimensional row vector.

[0057] In addition, in the process of calculating the target sequence features of the first data sequence according to the fusion features, the auxiliary sequence features and the sequence features of the first data sequence, in order to further improve the calculation efficiency of the target data sequence, the fusion features and the auxiliary sequence features can be input into the first parallel calculation module for feature fusion to obtain column compression features, and the row vectors of each row in the column compression features and the sequence features of the first data sequence are input into the second parallel calculation module for vector calculation to obtain each sub-vector; Among them, the first parallel computing module can be 1; the number of second parallel computing modules can be determined based on the number of rows of the sequence features of the first data sequence. For example, if the sequence features are n rows, the second parallel computing modules can be n, and the row vector and column compression features of the i-th row can be input into the i-th second parallel computing module; the process of feature fusion performed by the first parallel computing module here can be the above-mentioned row splicing processing of the fused features and the auxiliary sequence features to obtain the row splicing features, column compression processing of the row splicing features to obtain the column compression features, which will not be repeated here.

[0058] Step S108: Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

[0059] The sequence characteristics of the second data sequence in this embodiment may include sequence characteristics obtained by encoding the second data sequence. The sequence characteristics of the second data sequence may specifically be a sequence characteristic matrix of the second data sequence. For example, the second data sequence is a traffic flow sequence, and the traffic flow sequence contains v traffic flows. Then the sequence characteristics of the second data sequence may be a characteristic matrix of v rows and x columns, or a characteristic matrix of x rows and v columns, where x may be the same as x in the sequence characteristics of the first data sequence. For example, if the sequence characteristics of the first data sequence are a matrix of n rows and 16 columns, then the sequence characteristics of the second data sequence are a matrix of v rows and 16 columns.

[0060] The detection result may be an abnormality detection probability that an abnormality exists in the object to be processed. The detection result may be a value between 0 and 1, or a result of a detection pass or a detection fail. In addition, it may also be other types of detection results.

[0061] In practical applications, since the number of first data sequences and second data sequences corresponding to the object to be processed may be large, resulting in a large number of target sequence features and sequence features of the second data sequence, if these data are directly used to perform anomaly detection on the object to be processed, it may lead to a large amount of calculation for anomaly detection and a low efficiency of anomaly detection. In view of this, in order to improve the detection efficiency of anomaly detection, in the process of performing anomaly detection on the object to be processed based on the target sequence features and the sequence features of the second data sequence to obtain the detection results, the sequence features of the second data sequence can be converted into target sequence features of the second data sequence, and the target sequence features of the first data sequence and the target sequence features of the second data sequence are numerically converted respectively to obtain first numerical values ​​and second numerical values, and anomaly detection is performed on the object to be processed according to the first numerical values ​​and the second numerical values ​​to obtain the detection results.

[0062] Converting the sequence features of the second data sequence into target sequence features of the second data sequence may include: performing feature conversion on the sequence features of the second data sequence corresponding to the object to be processed to obtain a second conversion feature, constructing a position feature of the second data sequence according to the second conversion feature and an auxiliary sequence feature of the first data sequence corresponding to the object to be processed, fusing the position feature with the sequence features of the second data sequence to obtain a second fused feature, and calculating the target sequence features of the second data sequence according to the second fused feature, the auxiliary sequence feature and the sequence features of the second data sequence; the specific process of calculating the target sequence features of the second data sequence is similar to the process of calculating the target sequence features of the first data sequence, and will not be described in detail in this embodiment.

[0063] In the process of numerically converting the target sequence features of the first data sequence and the target sequence features of the second data sequence respectively to obtain the first numerical value and the second numerical value, the target sequence features of the first data sequence and the target sequence features of the second data sequence can be input into a neural network for numerical conversion to obtain the first numerical value and the second numerical value; the neural network here can be a single-layer neural network, the numerical conversion can be a nonlinear calculation, and the single-layer neural network can be a single-layer DNN (Deep Neural Network).

[0064] In the process of performing anomaly detection on the processed object based on the first numerical value and the second numerical value to obtain the detection result, the first numerical value and the second numerical value can be spliced, and the processed object can be detected for anomaly based on the spliced ​​result to obtain the detection result; specifically, in the process of performing anomaly detection on the processed object based on the spliced ​​result to obtain the detection result, the spliced ​​result can be input into the neural network for numerical conversion to obtain a third numerical value, and the processed object can be detected for anomaly based on the third numerical value to obtain the detection result; the neural network here can also be a single-layer neural network, specifically a single-layer DNN; in the process of performing anomaly detection on the processed object based on the third numerical value to obtain the detection result, the third numerical value can be input into the activation function to calculate the anomaly detection probability to obtain the anomaly detection probability, after which the anomaly detection probability can be matched with multiple preset probability intervals, and the detection result is determined according to the preset probability interval matched with the anomaly detection probability.

[0065] Among them, the activation function can be a Sigmoid function; the neural network set here can not only convert the splicing result into a single third value, which is convenient for subsequent activation functions to perform probability calculations, but also increase the generalization ability of anomaly detection.

[0066] For example, the object to be processed is the road condition, and the multiple preset probability intervals are (0, 0.2], (0.2, 0.4], (0.4, 0.8] and (0.8, 1), (0, 0.2] indicates that there is no abnormality in the road condition and no attention is needed; (0.2, 0.4] indicates that there is a slight abnormality in the road condition and attention is needed; (0.4, 0.8] indicates that there is a moderate abnormality in the road condition and attention is needed; (0.8, 1) indicates that there is a severe abnormality in the road condition and it needs to be solved in time; assuming that the anomaly detection probability is 0.3, the anomaly detection probability matches the preset probability interval (0.2, 0.4], then the detection result is determined to be that there is a slight abnormality in the road condition.

[0067] For another example, Figure 3As shown, the first value can be one or more, the second value can be one or more, the first value and the second value are spliced ​​to obtain a splicing result, the splicing result is input into a single-layer neural network for numerical conversion to obtain a third value, the third value can be one, the third value is input into a Sigmoid function to calculate the anomaly detection probability, and obtain the anomaly detection probability.

[0068] It should be noted that steps S102 to S108 in the anomaly detection processing method provided in this embodiment can be executed by an anomaly detection model; the anomaly detection model can be obtained by performing model training on the to-be-trained model; in the process of performing model training on the to-be-trained model, feature conversion can be performed on the sequence features of the first sequence samples corresponding to the sample objects to obtain conversion features, and position features of the first sequence samples can be constructed according to the conversion features and the auxiliary sequence features, and target sequence features of the first sequence samples can be calculated according to the position features, the auxiliary sequence features and the sequence features of the first sequence samples, and anomaly detection is performed on the sample objects based on the target sequence features and the sequence features of the second sequence samples to obtain a detection result, and parameters of the to-be-trained model can be adjusted based on the detection result and the annotation label of the sample objects to obtain an anomaly detection model; Referring to the above model training process, iterative training can be performed until the model converges; it should be supplemented that, in the process of model training for the model to be trained, the auxiliary sequence features can also be updated according to the target sequence features of the first sequence samples and the target sequence features of the second sequence samples, that is, the target sequence features of the first sequence samples and the target sequence features of the second sequence samples obtained in each round of calculation can not only be used for anomaly detection, but also can be used to update the auxiliary sequence features. In the process of updating the auxiliary sequence features, the row vectors of corresponding rows in the auxiliary sequence features can be updated according to the target sequence features of the first sequence samples and the target sequence features of the second sequence samples, for example, the target sequence features of the first sequence samples update the row vectors of the first row in the auxiliary sequence features, and the target sequence features of the second sequence samples update the row vectors of the second row in the auxiliary sequence features.

[0069] It should be supplemented that each optional implementation method or each feasible execution method in steps S102 to S108 provided in this embodiment can be executed independently as needed, or can be combined and referenced with each other. At the same time, each specific execution step in each optional implementation method or each feasible execution method can also be executed independently, and this embodiment does not make specific limitations.

[0070] It should also be added that, in this embodiment, obtaining the first data sequence and the second data sequence and other data corresponding to the object to be processed is performed on the premise of obtaining authorization.

[0071] In summary, the anomaly detection processing method provided in this embodiment first performs feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features, and performs splicing processing on the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed to obtain splicing features, so that the splicing features carry the information of other input data sequences, thereby improving the accuracy of subsequent construction of position features; based on the position screening features, the splicing features are screened for position features to obtain intermediate position features, and the intermediate position features are dimensionally upgraded according to the number of rows of the sequence features of the first data sequence to obtain the position features of the first data sequence; in this way, the position features after the dimension upgrade process retain the time series information, and at the same time, in order to facilitate the subsequent calculation with the sequence features of the first data sequence; Secondly, the position features and the sequence features of the first data sequence are fused to obtain fused features, the fused features and the auxiliary sequence features are row-joined to obtain row-joined features, the row-joined features are column-compressed to obtain column-compressed features, and the target sequence features of the first data sequence are calculated in parallel based on the column-compression features and the sequence features of the first data sequence; thereby, the calculation efficiency of the target sequence features is improved while ensuring a high calculation accuracy; finally, based on the target sequence features and the sequence features of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result; anomaly detection is performed by using more comprehensive and effective target sequence features and sequence features of the second data sequence to improve the accuracy of anomaly detection.

[0072] The following combination Figure 4 , taking the application of the anomaly detection processing method provided by this embodiment in an anomaly detection scenario as an example, the anomaly detection processing method provided by this embodiment is further described. Figure 4 ,The anomaly detection processing method applied to anomaly detection scenarios specifically includes the following steps.

[0073] Step S402: performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features.

[0074] Step S404: performing concatenation processing on the conversion feature and the auxiliary sequence feature of the second data sequence corresponding to the object to be processed to obtain a concatenated feature.

[0075] Step S406, performing position feature screening on the concatenated features based on the position screening features to obtain intermediate position features, and performing dimension upscaling processing on the intermediate position features according to the number of rows of the sequence features of the first data sequence to obtain position features of the first data sequence.

[0076] Step S408: fusing the position feature with the sequence feature of the first data sequence to obtain a fused feature.

[0077] Step S410, performing row concatenation processing on the fusion feature and the auxiliary sequence feature of the second data sequence to obtain row concatenation features, and performing column compression processing on the row concatenation features to obtain column compression features.

[0078] Step S412: Input the column compression feature and the row vector of each row in the sequence feature of the first data sequence into the corresponding parallel computing module for vector calculation, obtain the sub-vector corresponding to each row, and construct the target sequence feature of the first data sequence based on each sub-vector.

[0079] Step S414: Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

[0080] It should be noted that any one of steps S402 to S414 or any combination of multiple steps can be replaced by the corresponding technical means provided in the above steps S102 to S108 according to the needs of implementation and deployment, and will not be described one by one here.

[0081] Figure 5 A schematic diagram of an abnormality detection and processing device provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the device comprises: A feature conversion module 502 is used to perform feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; A feature construction module 504 is used to construct a position feature of the first data sequence according to the conversion feature and the auxiliary sequence feature of the second data sequence corresponding to the object to be processed; A feature calculation module 506 is used to fuse the position feature and the sequence feature to obtain a fused feature, and calculate a target sequence feature of the first data sequence according to the fused feature, the auxiliary sequence feature and the sequence feature; The anomaly detection module 508 is used to perform anomaly detection on the object to be processed based on the target sequence characteristics and the sequence characteristics of the second data sequence to obtain a detection result.

[0082] The anomaly detection processing device provided in this embodiment first performs feature conversion on the sequence features of the first data sequence corresponding to the object to be processed by running the feature conversion module 502 to obtain conversion features, runs the feature construction module 504 to construct the position features of the first data sequence according to the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed, then runs the feature calculation module 506 to fuse the position features and the sequence features to obtain fusion features, and calculates the target sequence features of the first data sequence according to the fusion features, the auxiliary sequence features and the sequence features, and finally runs the anomaly detection module 508 to perform anomaly detection on the object to be processed based on the target sequence features and the sequence features of the second data sequence to obtain a detection result, so as to improve the accuracy of anomaly detection.

[0083] The abnormality detection and processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0084] Furthermore, an embodiment of the present specification also provides an abnormality detection processing device, Figure 6 A schematic diagram of the structure of an abnormality detection and processing device provided in an embodiment of this specification is shown in FIG. Figure 6 As shown, the device includes: a memory 601, a processor 602, a bus 603 and a communication interface 604. The memory 601, the processor 602 and the communication interface 604 communicate through the bus 603, and the communication interface 604 may include an input and output interface, which includes but is not limited to a keyboard, a mouse, a display, a microphone, a loudspeaker, etc.

[0085] Figure 6 In the embodiment, the memory 601 stores computer executable instructions that can be run on the processor 602. When the computer executable instructions are executed by the processor 602, the following process is implemented: Performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructing a position feature of the first data sequence according to the conversion feature and an auxiliary sequence feature of the second data sequence corresponding to the object to be processed; fusing the position feature and the sequence feature to obtain a fused feature, and calculating a target sequence feature of the first data sequence according to the fused feature, the auxiliary sequence feature and the sequence feature; Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

[0086] The anomaly detection processing device provided in this embodiment performs feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features through the cooperation of the memory 601, the processor 602, the bus 603 and the communication interface 604; constructs the position features of the first data sequence according to the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed; performs fusion processing on the position features and the sequence features to obtain fusion features, and calculates the target sequence features of the first data sequence according to the fusion features, the auxiliary sequence features and the sequence features; performs anomaly detection on the object to be processed based on the target sequence features and the sequence features of the second data sequence to obtain a detection result, so as to improve the accuracy of anomaly detection.

[0087] The abnormality detection processing device provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0088] Furthermore, another embodiment of the present specification provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the following process is implemented: Performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructing a position feature of the first data sequence according to the conversion feature and an auxiliary sequence feature of the second data sequence corresponding to the object to be processed; fusing the position feature and the sequence feature to obtain a fused feature, and calculating a target sequence feature of the first data sequence according to the fused feature, the auxiliary sequence feature and the sequence feature; Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

[0089] The computer-readable storage medium provided in this embodiment performs feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructs the position features of the first data sequence according to the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed; fuses the position features and the sequence features to obtain fusion features, and calculates the target sequence features of the first data sequence according to the fusion features, the auxiliary sequence features and the sequence features; performs anomaly detection on the object to be processed based on the target sequence features and the sequence features of the second data sequence to obtain a detection result, so as to improve the accuracy of anomaly detection.

[0090] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0091] A computer-readable storage medium provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0092] Furthermore, another embodiment of the present specification also provides a computer program product, which implements the following process when executed by a processor: Performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructing a position feature of the first data sequence according to the conversion feature and an auxiliary sequence feature of the second data sequence corresponding to the object to be processed; fusing the position feature and the sequence feature to obtain a fused feature, and calculating a target sequence feature of the first data sequence according to the fused feature, the auxiliary sequence feature and the sequence feature; Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

[0093] The computer program product provided in this embodiment performs feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructs the position features of the first data sequence according to the conversion features and the auxiliary sequence features of the second data sequence corresponding to the object to be processed; fuses the position features and the sequence features to obtain fusion features, and calculates the target sequence features of the first data sequence according to the fusion features, the auxiliary sequence features and the sequence features; performs anomaly detection on the object to be processed based on the target sequence features and the sequence features of the second data sequence to obtain a detection result, so as to improve the accuracy of anomaly detection.

[0094] A computer program product provided in an embodiment of this specification can implement each process in the aforementioned method embodiment and achieve the same functions and effects, which will not be repeated here.

[0095] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] Memory may include non-permanent storage in a computer-readable storage medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable storage medium.

[0101] Computer-readable storage media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer-readable storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable storage media does not include temporary computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0102] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0103] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0104] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. An abnormality detection processing method, characterized in that: The method comprises: Performing feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; constructing a position feature of the first data sequence according to the conversion feature and an auxiliary sequence feature of the second data sequence corresponding to the object to be processed; fusing the position feature and the sequence feature to obtain a fused feature, and calculating a target sequence feature of the first data sequence according to the fused feature, the auxiliary sequence feature and the sequence feature; Based on the target sequence characteristics and the sequence characteristics of the second data sequence, anomaly detection is performed on the object to be processed to obtain a detection result.

2. The abnormality detection processing method according to claim 1, characterized in that: The step of constructing the position feature of the first data sequence according to the conversion feature and the auxiliary sequence feature of the second data sequence corresponding to the object to be processed includes: The conversion feature and the auxiliary sequence feature are spliced ​​to obtain a spliced ​​feature, and the spliced ​​feature is subjected to position feature screening based on the position screening feature to obtain an intermediate position feature; The intermediate position feature is processed by dimension increase according to the number of rows of the sequence feature of the first data sequence to obtain the position feature.

3. The abnormality detection processing method according to claim 2, characterized in that: The step of performing dimension-upgrading processing on the intermediate position feature according to the number of rows of the sequence feature of the first data sequence to obtain the position feature includes: Determine a dimension-raising value set according to the number of rows of the sequence features of the first data sequence and the number of rows of the intermediate position features; The position feature is calculated based on the dimension-increased numerical value set and the intermediate position feature.

4. The abnormality detection processing method according to claim 1, characterized in that: The calculating the target sequence feature of the first data sequence according to the fusion feature, the auxiliary sequence feature and the sequence feature includes: Performing row splicing processing on the fusion feature and the auxiliary sequence feature to obtain a row splicing feature; Column compression processing is performed on the row concatenation features to obtain column compression features, and the target sequence features are calculated in parallel based on the column compression features and the sequence features of the first data sequence.

5. The abnormality detection processing method according to claim 4, characterized in that: The performing column compression processing on the row splicing feature to obtain the column compression feature includes: Determine a compressed value set according to the number of rows of the sequence feature of the first data sequence; The column compression feature is calculated according to the compressed value set and the row splicing feature.

6. The abnormality detection processing method according to claim 5, characterized in that: The calculating the column compression feature according to the compressed value set and the row splicing feature includes: Calculating the product of the value of each column in the row splicing feature and the compressed value in the compressed value set; According to the calculated product of the multiple values ​​of each column and the compressed value, the total product of each column is calculated, and the column compression feature is constructed based on the total product.

7. An abnormality detection processing device, characterized in that: The device comprises: A feature conversion module, used to perform feature conversion on the sequence features of the first data sequence corresponding to the object to be processed to obtain conversion features; A feature construction module, used to construct a position feature of the first data sequence according to the conversion feature and the auxiliary sequence feature of the second data sequence corresponding to the object to be processed; a feature calculation module, configured to fuse the position feature and the sequence feature to obtain a fused feature, and calculate a target sequence feature of the first data sequence based on the fused feature, the auxiliary sequence feature and the sequence feature; The anomaly detection module is used to perform anomaly detection on the object to be processed based on the target sequence characteristics and the sequence characteristics of the second data sequence to obtain a detection result.

8. An abnormality detection processing device, characterized in that: The device includes a memory and a processor, wherein the memory stores computer executable instructions, and when the computer executable instructions are executed on the processor, the steps of the method described in any one of claims 1 to 6 can be implemented.

9. A computer-readable storage medium having computer-executable instructions stored therein, characterized in that: When the computer executable instructions are executed by a processor, the steps of the method described in any one of claims 1 to 6 can be implemented.

10. A computer program product, characterized in that The computer program product comprises an anomaly detection processing program, and when the anomaly detection processing program is executed by a processor, the steps of the method described in any one of claims 1 to 6 can be implemented.

Images