Information storage method and device, electronic equipment and computer readable medium

Abstract

The embodiment of the invention discloses an information storage method and device, electronic equipment and a computer readable medium. A specific embodiment of the method comprises the steps of obtaining a historical anomaly detection data set; performing data feature screening to generate a historical anomaly detection feature information set; screening out at least one anomaly detection and recognition model; generating at least one piece of anomaly detection identification information; sending the at least one piece of anomaly detection identification information and the at least one model identifier to an anomaly detection information gathering terminal; sending the historical anomaly detection data set and the anomaly detection summary information to an anomaly detection information checking terminal; and storing the anomaly detection summary information, the user information corresponding to the target user and the anomaly detection verification information to an anomaly detection information server. According to the embodiment, on the basis of information interaction between the current online available computing resources and each terminal, the accurate anomaly detection related information corresponding to the target user can be stored, so that subsequent query and use are facilitated.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computer technology, and in particular to an information storage method, device, electronic device, and computer-readable medium. Background Art

[0002] At present, with the advent of big data, data calculations occupy a large amount of computing resources. How to accurately implement anomaly detection information based on existing computing resources has become one of the current research directions. For the generation of anomaly detection information, the usual method is to directly use the pre-trained anomaly detection recognition model to generate anomaly detection information corresponding to the target user.

[0003] However, when using the above method to generate anomaly detection information, the following technical problems often occur:

[0004] The use of a single anomaly detection model has the problem of low fault tolerance, which may result in inaccurate generation of anomaly detection information. In addition, in the application process, the anomaly detection model faces a large number of users and often occupies a large number of computing resources, which affects the normal operation of other businesses. In addition, when online resources are insufficient, the recognition process may be stuck.

[0005] The above information disclosed in this Background section is only for enhancement of understanding of the background of the inventive concept and therefore it may contain information that does not form the prior art that is already known in this country to a person of ordinary skill in the art. Summary of the invention

[0006] The content of this disclosure is used to introduce concepts in a brief form, which will be described in detail in the detailed implementation section below. The content of this disclosure is not intended to identify the key features or essential features of the technical solution claimed for protection, nor is it intended to limit the scope of the technical solution claimed for protection.

[0007] Some embodiments of the present disclosure propose information storage methods, devices, electronic devices, and computer-readable media to solve one or more of the technical problems mentioned in the above background technology section.

[0008] In a first aspect, some embodiments of the present disclosure provide an information storage method, comprising: obtaining a historical anomaly detection data set corresponding to a target user from a target user database; performing data feature screening on the historical anomaly detection data set to generate a historical anomaly detection feature information set; obtaining the amount of online remaining available computing resources corresponding to the current computing terminal; screening out at least one anomaly detection and recognition model from a target model database according to the amount of online remaining available computing resources, wherein the total amount of computing resources corresponding to the at least one anomaly detection and recognition model is less than the amount of online remaining available computing resources; generating at least one anomaly detection and recognition information using the at least one anomaly detection and recognition model according to the historical anomaly detection feature information set; sending the at least one anomaly detection and recognition information and at least one model identifier corresponding to the at least one anomaly detection and recognition model to an anomaly detection information summary terminal to generate anomaly detection summary information; sending the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to an anomaly detection information verification terminal to generate anomaly detection verification information; in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information verification has passed, storing the anomaly detection summary information, the user information corresponding to the target user, and the anomaly detection verification information in an encrypted form to an anomaly detection information service end.

[0009] In a second aspect, some embodiments of the present disclosure provide an information storage device, comprising: a first acquisition unit, configured to acquire a historical anomaly detection data set corresponding to a target user from a target user database; a first screening unit, configured to perform data feature screening on the above historical anomaly detection data set to generate a historical anomaly detection feature information set; a second acquisition unit, configured to acquire the amount of remaining online available computing resources corresponding to the current computing terminal; a second screening unit, configured to screen out at least one anomaly detection recognition model from a target model database based on the above remaining online available computing resources, wherein the total amount of computing resources corresponding to the above at least one anomaly detection recognition model is less than the above remaining online available computing resources; a generation unit, configured to use the above historical anomaly detection feature information set to obtain the amount of remaining online available computing resources corresponding to the current computing terminal; Using the at least one anomaly detection and recognition model, at least one anomaly detection and recognition information is generated; a first sending unit is configured to send the at least one anomaly detection and recognition information and at least one model identifier corresponding to the at least one anomaly detection and recognition model to the anomaly detection information summary terminal to generate anomaly detection summary information; a second sending unit is configured to send the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to the anomaly detection information verification terminal to generate anomaly detection verification information; a storage unit is configured to store the anomaly detection summary information, the user information corresponding to the target user and the anomaly detection verification information in an encrypted form to the anomaly detection information server in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information has passed the verification.

[0010] In a third aspect, some embodiments of the present disclosure provide an electronic device comprising: one or more processors; a storage device on which one or more programs are stored, and when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation manner in the first aspect.

[0011] In a fourth aspect, some embodiments of the present disclosure provide a computer-readable medium having a computer program stored thereon, wherein when the program is executed by a processor, the method described in any implementation manner in the first aspect is implemented.

[0012] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the information storage method of some embodiments of the present disclosure, based on the information interaction between the currently available online computing resources and each terminal, the accurate abnormal detection related information corresponding to the target user can be stored for subsequent query use. Specifically, the reason why the relevant abnormal detection related information is not accurate enough and the generation process may be stuck is that the use of a single abnormal detection recognition model has a low fault tolerance problem, which may lead to the generation of abnormal detection information not being accurate enough. In addition, in the application process, the abnormal detection recognition model faces a large number of users and often has the problem of occupying high computing resources, which affects the normal operation of other businesses, and in the case of insufficient online resources, the recognition process may be stuck. Based on this, the information storage method of some embodiments of the present disclosure first obtains the historical abnormal detection data set corresponding to the target user from the target user database as the basic data for user abnormal detection judgment, so as to accurately generate abnormal detection related information later. Then, the above-mentioned historical abnormal detection data set is subjected to data feature screening to generate a historical abnormal detection feature information set. Here, by filtering data features, redundant and invalid feature content corresponding to the historical anomaly detection data set is removed to avoid wasting too much computing resources and consuming too long a time to output anomaly detection information in the subsequent application of the anomaly detection and recognition model. Next, the amount of online remaining available computing resources corresponding to the current computing terminal is obtained to filter at least one anomaly detection and recognition model that can be used for the currently available online computing resources. Then, according to the above-mentioned online remaining available computing resources, at least one anomaly detection and recognition model can be accurately filtered out from the target model database, wherein the total amount of computing resources corresponding to the above-mentioned at least one anomaly detection and recognition model is less than the above-mentioned online remaining available computing resources. Here, by filtering the anomaly detection and recognition model by the online remaining available computing resources, the problem of jamming in the subsequent generation of anomaly detection information can be avoided, resulting in a long generation time and occupying too long computing resources. Next, according to the above-mentioned historical anomaly detection feature information set, the above-mentioned at least one anomaly detection and recognition model can be used to accurately generate at least one anomaly detection and recognition information. Secondly, the above-mentioned at least one anomaly detection and recognition information and the at least one model identifier corresponding to the above-mentioned at least one anomaly detection and recognition model are sent to the anomaly detection information summary terminal to accurately generate anomaly detection summary information. Furthermore, the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information are sent to the anomaly detection information verification terminal to generate anomaly detection verification information.Here, through the interaction between the abnormal detection information summary terminal and the abnormal detection information verification terminal, not only can the summary information and abnormal detection verification information for at least one abnormal detection identification information be accurately generated, but also the process interval between the generation process of the abnormal detection identification information and the abnormal detection verification information and the summary process of the summary information can be realized, thereby avoiding occupying more computing resources and ensuring the accuracy of the generation of the abnormal detection information. Finally, in response to determining that the abnormal detection verification information indicates that the abnormal detection summary information has passed the verification, the abnormal detection summary information, the user information corresponding to the target user, and the abnormal detection verification information are stored in an encrypted form to the abnormal detection information service end. The encryption method not only ensures the privacy and security of the user's personal information, but also helps to efficiently query the subsequent abnormal detection information corresponding to the target user. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The above and other features, advantages and aspects of the embodiments of the present disclosure will become more apparent with reference to the following detailed description in conjunction with the accompanying drawings. Throughout the accompanying drawings, the same or similar reference numerals represent the same or similar elements. It should be understood that the drawings are schematic and that components and elements are not necessarily drawn to scale.

[0014] Figure 1 is a flow chart of some embodiments of the information storage method according to the present disclosure;

[0015] Figure 2 is a schematic diagram of the structure of some embodiments of the information storage device according to the present disclosure;

[0016] Figure 3 It is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. DETAILED DESCRIPTION

[0017] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments set forth herein. On the contrary, these embodiments are provided to provide a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0018] It should also be noted that, for ease of description, only the parts related to the invention are shown in the drawings. In the absence of conflict, the embodiments and features in the embodiments of the present disclosure can be combined with each other.

[0019] It should be noted that the concepts such as "first" and "second" mentioned in the present disclosure are only used to distinguish different devices, modules or units, and are not used to limit the order or interdependence of the functions performed by these devices, modules or units.

[0020] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0021] The names of the messages or information exchanged between multiple devices in the embodiments of the present disclosure are only used for illustrative purposes and are not used to limit the scope of these messages or information.

[0022] The present disclosure will be described in detail below with reference to the accompanying drawings and in conjunction with embodiments.

[0023] refer to Figure 1 , shows a process 100 of some embodiments of the information storage method according to the present disclosure. The information storage method comprises the following steps:

[0024] Step 101: Obtain a historical anomaly detection dataset corresponding to a target user from a target user database.

[0025] In some embodiments, the execution subject (e.g., electronic device) of the above-mentioned information storage method can obtain the historical anomaly detection data set corresponding to the target user from the target user database. Among them, the target user database can be a database storing various types of data of each user. For example, the target user database stores a user operation data set and a user value flow anomaly data set. The user value flow anomaly data can be data related to the determination of anomalies existing in the user value flow process. For example, for the credit investigation scenario, the user value flow process can be a user loan process. That is, the user value flow anomaly data can be used for data for determining the user's pre-loan anomaly. The historical anomaly detection data set can be an anomaly detection data set related to the target user within the target historical time period. The target user can be a user to be determined by anomaly detection. The target historical time period can be a historical time period within a predetermined time period before the current time. In practice, for the user loan process in the credit investigation scenario, the corresponding historical anomaly detection data set can be used to determine the pre-loan anomaly data set.

[0026] As an example, first, the execution subject may generate a query statement for the target user and anomaly detection query, and then execute the query statement to obtain a historical anomaly detection dataset corresponding to the target user from the target user database.

[0027] Step 102: Perform data feature screening on the above historical anomaly detection data set to generate a historical anomaly detection feature information set.

[0028] In some embodiments, the execution subject may perform data feature screening on the historical anomaly detection data set to generate a historical anomaly detection feature information set, wherein the historical anomaly detection feature information may be data feature content under each data feature.

[0029] Here, the data dimension obtained by backtracking is relatively high. In order to improve the operation efficiency and reduce the tendency of model overfitting, feature screening is required. Screening is performed based on indicators such as IV value, missing rate, and correlation coefficient to reduce the feature dimension of the data sent to the model. Among them, the larger the IV value of a feature, the more obvious the degree of data discrimination of the feature. By filtering out some features with too low IV values ​​and retaining features with larger IV values, the training effect of the model can be improved. The larger the missing rate of the data, the less sufficient the information on this feature dimension, and the features with larger missing rates should be filtered out. The larger the correlation coefficient between the two features, the greater the overlap of the two features in distinguishing the data. For features with higher correlation coefficients, only one of them can be retained.

[0030] Step 103, obtaining the remaining available online computing resources corresponding to the current computing terminal.

[0031] In some embodiments, the execution subject may obtain the amount of online remaining available computing resources corresponding to the current computing terminal. The current computing terminal may be a terminal used to perform various computing processes. For example, the current computing terminal may be used to execute model applications and model training. The current computing terminal may deploy computing terminals of multiple graphics processing units (GPUs). The amount of online remaining available computing resources may be the total amount of online remaining available computing resources.

[0032] As an example, the execution subject may obtain the remaining available online computing resources corresponding to the current computing terminal by querying the remaining online resource command line.

[0033] Step 104: select at least one anomaly detection and recognition model from the target model database according to the above-mentioned remaining available online computing resources.

[0034] In some embodiments, the execution subject may filter out at least one anomaly detection and recognition model from the target model database according to the remaining available computing resources online. The target model database may be a database storing various model-related data. The anomaly detection and recognition model may be a model for anomaly detection and recognition. In practice, for the credit investigation field, the corresponding anomaly detection and recognition may be pre-loan anomaly recognition. Model-related data may be model-related data content. For example, the model-related data may include: model parameters, model structure information, and model test effect information. For example, at least one anomaly detection and recognition model may include but is not limited to at least one of the following: isolation forest, histogram-based unsupervised anomaly detection algorithm, clustering-based local anomaly factor detection algorithm, principal component analysis, recurrent neural network (RNN) model, long short-term memory network (LSTM). The total computing resources corresponding to the at least one anomaly detection and recognition model are less than the remaining available computing resources online. The total computing resources may be the total computing resources required by at least one anomaly detection and recognition model during the application execution process. Each anomaly detection and recognition model has a corresponding computing resource amount (i.e., the amount of resources required for normal application execution). The total computing resource amount may be a resource amount obtained by summing at least one computing resource amount corresponding to at least one anomaly detection and recognition model.

[0035] In some optional implementations of some embodiments, the execution subject may select at least one anomaly detection and recognition model from the target model database according to the remaining available online computing resources, including the following steps:

[0036] The first step is to select from the target model database a set of anomaly detection and recognition model groups whose corresponding total computing resources are less than the remaining available online computing resources. Among them, each anomaly detection and recognition model group has a model group whose total computing resources corresponding to each anomaly detection and recognition model group are less than the remaining available online computing resources.

[0037] In the second step, the anomaly detection and recognition model groups whose corresponding total recognition duration is greater than or equal to the target duration are removed from the above anomaly detection and recognition model group set to obtain at least one first anomaly detection and recognition model group. The total application recognition duration corresponding to the first anomaly detection and recognition model group is less than the above target duration. The target duration may be the maximum recognition duration required by the server. Each anomaly detection and recognition model has a corresponding recognition duration during the application recognition process. That is, the total recognition duration may be the sum of the durations of the recognition duration groups corresponding to the anomaly detection and recognition model group.

[0038] In the third step, the anomaly detection and recognition model group whose corresponding model parameter byte information is smaller than the target byte size is removed from the at least one first anomaly detection and recognition model group, and at least one second anomaly detection and recognition model group is obtained. The model parameter byte information may be the total byte size of the model parameters corresponding to the first anomaly detection and recognition model group. The target byte size may also be the maximum byte size set by the server. Each first anomaly detection and recognition model has a corresponding model parameter byte size. The corresponding model parameter byte size may be the sum of the byte sizes of the corresponding model parameter byte size groups of the anomaly detection and recognition model group.

[0039] In the fourth step, the second anomaly detection and recognition model group with the highest total accuracy of the corresponding historical model is selected from the at least one second anomaly detection and recognition model group. The total accuracy of the historical model may be the sum of the accuracy of the historical model accuracy group corresponding to the second anomaly detection and recognition model group. Each second anomaly detection and recognition model has a corresponding historical model accuracy. The historical model accuracy may be the model accuracy that characterizes the second anomaly detection and recognition model in a historical time period.

[0040] In the fifth step, each anomaly detection and recognition model included in the second anomaly detection and recognition model group is determined as at least one anomaly detection and recognition model.

[0041] Step 105: Generate at least one anomaly detection identification information based on the above historical anomaly detection feature information set and using the above at least one anomaly detection identification model.

[0042] In some embodiments, the execution subject may generate at least one anomaly detection identification information based on the historical anomaly detection feature information set and using the at least one anomaly detection identification model. For example, there is a one-to-one correspondence between the anomaly detection identification information in the at least one anomaly detection identification information and the anomaly detection identification model in the at least one anomaly detection identification model. The anomaly detection identification information may be the identification result of the anomaly detection. In practice, for the loan process in the credit investigation scenario, the corresponding anomaly detection identification information may be the anomaly identification result of the loan user. In practice, the anomaly detection identification result may be one of the following: an identification result characterizing the existence of pre-loan anomalies, and an identification result characterizing the absence of pre-loan anomalies.

[0043] In some optional implementations of some embodiments, in response to determining that the at least one anomaly detection and recognition model is an unsupervised recognition model, the execution entity may input the historical anomaly detection feature information set into each anomaly detection and recognition model in the at least one anomaly detection and recognition model to generate anomaly detection and recognition information, thereby obtaining at least one anomaly detection and recognition information. The unsupervised recognition model may be an unsupervised model (i.e., a model that does not require a label).

[0044] In some optional implementations of some embodiments, the execution subject may generate at least one anomaly detection identification information based on the historical anomaly detection feature information set and using the at least one anomaly detection identification model, further comprising the following steps:

[0045] The first step is to determine at least one unsupervised recognition model and at least one deep learning model in response to determining that the at least one anomaly detection recognition model includes an unsupervised recognition model and a deep learning model.

[0046] In the second step, the historical anomaly detection feature information set is input into each unsupervised recognition model of the at least one unsupervised recognition model to generate candidate anomaly detection recognition information, thereby obtaining at least one candidate anomaly detection recognition information.

[0047] In the third step, based on the at least one candidate abnormality detection identification information, first abnormality probability information representing the presence of abnormality detection and second abnormality probability information representing the absence of abnormality detection are generated. The first abnormality probability information can be a numerical value representing the probability of the presence of abnormality detection. The second abnormality probability information can be a numerical value representing the probability of the absence of abnormality detection. The probability sum between the first abnormality probability information and the second abnormality probability information is 1.

[0048] As an example, first, for each candidate anomaly detection identification information in the at least one candidate anomaly detection identification information, determine the anomaly detection label and anomaly detection probability corresponding to the candidate anomaly detection identification information. Then, according to the anomaly detection label, group the identification information of at least one candidate anomaly detection identification information to obtain a candidate anomaly detection identification information group set, wherein each candidate anomaly detection identification in the candidate anomaly detection identification information group has the same anomaly detection label. The anomaly detection label may be one of the following: a label representing the presence of anomaly detection and a label representing the absence of anomaly detection. Then, for each candidate anomaly detection identification information group in the candidate anomaly detection identification information group set, sum the anomaly detection probability groups corresponding to the candidate anomaly detection identification information group to generate an anomaly detection probability sum. In response to determining that the anomaly detection label corresponding to the candidate anomaly detection identification information group is a label representing the presence of anomaly detection, the anomaly detection probability sum is determined as the first anomaly probability information. In response to determining that the anomaly detection label corresponding to the candidate anomaly detection identification information group is a label representing the absence of anomaly detection, the anomaly detection probability sum is determined as the second anomaly probability information.

[0049] In the fourth step, the first anomaly detection label and the first anomaly probability information are combined to generate first combination information. The first anomaly detection label may represent a label indicating the presence of anomaly detection.

[0050] As an example, the above execution entity may concatenate the anomaly detection label and the first anomaly probability information to generate first combined information.

[0051] In the fifth step, the second anomaly detection label and the second anomaly probability information are combined to generate second combination information, wherein the second anomaly detection label may represent a label without anomaly detection.

[0052] As an example, the above execution entity may concatenate the anomaly detection label and the second anomaly probability information to generate second combined information.

[0053] Step 6: For each of the at least one deep learning model, perform the following generation steps:

[0054] Sub-step 1, input the above-mentioned historical anomaly detection feature information set into the anomaly detection feature information generation layer included in the above-mentioned deep learning model to obtain the first anomaly detection feature information. Among them, the anomaly detection feature information generation layer can be a network layer that generates anomaly detection feature information. The first anomaly detection feature information can be information that represents the semantic content of the anomaly detection feature in vector form. In practice, the anomaly detection feature information generation layer can include: an anomaly detection feature extraction layer and an anomaly detection feature attention layer. The anomaly detection feature extraction layer is used to extract all feature semantic content of anomaly detection. The anomaly detection feature extraction layer can be a 17-layer convolution layer in series. The anomaly detection feature attention layer can be an attention layer that focuses on the feature semantic content under the target aspect. In practice, the target aspect can be manually set by relevant technical personnel to be input during model training to ensure that the features focusing on the target aspect are extracted and processed. It should be noted that in the application stage, the corresponding target aspect information does not need to be input. The anomaly detection feature attention layer can be a multi-head attention mechanism layer.

[0055] Sub-step 2, respectively inputting the first combination information and the second combination information into the feature information generation layer included in the deep learning model to generate second anomaly detection feature information and third anomaly detection feature information. The feature information generation layer may be a network layer that performs feature semantic content extraction and vector conversion. In practice, the feature information generation layer may include: 11 convolutional layers and 3 fully connected layers.

[0056] Sub-step 3: input the first anomaly detection feature information, the second anomaly detection feature information, and the third anomaly detection feature information into the feature information combination layer included in the deep learning model to generate combined feature information. The feature information combination layer may be a network layer that performs feature information combination. In practice, the feature information combination layer may be a network layer that performs feature information splicing.

[0057] In the seventh step, the combined feature information is input into the output layer of the deep learning model to generate anomaly detection identification information. The output layer may be a network layer that outputs anomaly detection identification information. In practice, the output layer may be a 3-layer fully connected layer.

[0058] It should be noted that each of the at least one deep learning model can select a corresponding model training method in a corresponding selection interface according to a corresponding training sample set to perform targeted training of the deep learning model. By selecting a corresponding model training method in a selection interface, the diversity of deep learning models can be greatly improved.

[0059] In some optional implementations of some embodiments, the above method further includes:

[0060] The first step is to determine a deep learning model set in response to determining that the at least one anomaly detection and recognition model includes a deep learning model.

[0061] The second step is to determine at least one model effect measurement indicator corresponding to the deep learning model. The model effect measurement indicator can characterize the model output effect of the deep learning model. For example, the at least one model effect measurement indicator includes: accuracy, precision, stability, explainability, and recall.

[0062] In the third step, the historical anomaly detection feature information set is input into each deep learning model in the deep learning model set to generate pending anomaly detection identification information to obtain pending anomaly detection identification information.

[0063] In a fourth step, for each model effect measure in the at least one model effect measure, the following first classification step is performed:

[0064] Sub-step 1: determine the indicator content of each deep learning model in the deep learning model set under the model effect measurement indicator to obtain the indicator content set.

[0065] Sub-step 2: classify the deep learning models in the deep learning model set according to the indicator content set to generate a deep learning model group set, wherein the difference in indicator content corresponding to each deep learning model in the deep learning model group is less than a preset value.

[0066] Sub-step 3: determining the pending anomaly detection identification information set corresponding to the deep learning model set, wherein there is a one-to-one correspondence between the deep learning models in the deep learning model set and the pending anomaly detection identification information in the pending anomaly detection identification information set.

[0067] Sub-step 4: for each undetermined anomaly detection identification information group in the undetermined anomaly detection identification information group set, perform the following second classification step:

[0068] The first sub-step is to determine the anomaly detection label group corresponding to the pending anomaly detection identification information group.

[0069] The second sub-step is to determine the first number of votes and the first probability subgroup corresponding to the first anomaly detection label in the anomaly detection label group. The second number of votes and the second probability subgroup corresponding to the second anomaly detection label. The first number of votes can represent the number of the pending anomaly detection identification information group as the first anomaly detection label. The second number of votes can represent the number of the pending anomaly detection identification information group as the second anomaly detection label.

[0070] In a third sub-step, in response to determining that the first number of votes is higher than the second number of votes, a detection label corresponding to the above-mentioned anomaly detection label group is generated, which represents that the detection label is the first anomaly detection label and the first detection probability corresponding to the anomaly detection label group is set to be the sum of the probabilities corresponding to the first probability subgroup.

[0071] In a fourth sub-step, in response to determining that the second number of votes is higher than the first number of votes, a signal is generated indicating that the detection label corresponding to the above-mentioned anomaly detection label group is a second anomaly detection label and the second detection probability corresponding to the anomaly detection label group is set to be the sum of the probabilities corresponding to the second probability subgroup.

[0072] Sub-step 5: determining the obtained anomaly detection label set as at least one first anomaly detection identification information.

[0073] Sub-step 6: determining a third number of votes corresponding to the first abnormality detection tag and a fourth number of votes corresponding to the second abnormality detection tag in the at least one first abnormality detection identification information.

[0074] Sub-step 7, multiplying the third number of votes, the indicator importance weight of each deep learning model group under the model effect measurement index, the fourth number of votes and the indicator weight corresponding to the model effect measurement index to generate a first value and a second value. Among them, the first value is the product of the third number of votes and the indicator weight. The second value is the product of the fourth number of votes and the indicator weight. The indicator importance weight can represent the importance of the corresponding output content of each deep learning model group under the model effect measurement index.

[0075] In the fifth step, the obtained at least one first value and at least one second value are determined as at least one anomaly detection identification information. Among them, the at least one first value can represent the probability size of the historical anomaly detection feature information set as the first anomaly detection label under each model effect index. Among them, the at least one second value can represent the probability size of the historical anomaly detection feature information set as the second anomaly detection label under each model effect index.

[0076] As one of the invention points, the problem of how to generate at least one anomaly detection identification information based on at least one anomaly detection identification model is solved. Through at least one model effect measurement indicator, at least one anomaly detection identification information corresponding to the historical anomaly detection feature information set under each model effect measurement indicator can be accurately generated.

[0077] Step 106: Send the at least one anomaly detection identification information and at least one model identifier corresponding to the at least one anomaly detection identification model to an anomaly detection information summary terminal to generate anomaly detection summary information.

[0078] In some embodiments, the execution entity may send the at least one anomaly detection identification information and the at least one model identifier corresponding to the at least one anomaly detection identification model to an anomaly detection information summary terminal to generate anomaly detection summary information. The model identifier may represent the model identity information corresponding to the anomaly detection identification model. Each anomaly detection identification model has a corresponding model identifier. The anomaly detection information summary terminal may be a terminal that summarizes identification information for at least one anomaly detection identification information. The anomaly detection summary information may be an anomaly detection interval. For credit investigation scenarios, the corresponding anomaly detection summary information may represent the pre-loan abnormal interval for the target user to obtain a loan.

[0079] In some optional implementations of some embodiments, the above-mentioned anomaly detection summary information is generated by the following steps:

[0080] The first step is to generate model performance evaluation prompt information representing the evaluation of model performance based on at least one model parameter information corresponding to the at least one anomaly detection and recognition model and the at least one model identifier. Among them, the model parameter information in the at least one model parameter information corresponds to the anomaly detection and recognition model in the at least one anomaly detection and recognition model. The model parameter information can be the model parameter content after training corresponding to the anomaly detection and recognition model. The model performance evaluation prompt information can be a prompt word used to generate the model performance evaluation information. The model performance can include but is not limited to at least one of the following: model accuracy, model applicable scenario, and model application time.

[0081] In the second step, the model performance evaluation prompt information is input into the first language model deployed in the anomaly detection information aggregation terminal to generate at least one model performance evaluation information for the at least one model identifier. Among them, the model performance evaluation information in the at least one model performance evaluation information and the model identifier in the at least one model identifier have a one-to-one correspondence. The model performance information may include but is not limited to at least one of the following: model accuracy, model applicable scenarios, model application time, and the importance level of the model for anomaly detection and identification.

[0082] The third step is to generate anomaly detection summary prompt information representing the at least one anomaly detection identification information and the at least one model performance evaluation information. Among them, the anomaly detection summary prompt information includes: generation information corresponding to the at least one anomaly detection identification information, anomaly detection field information, anomaly detection summary generation information and anomaly detection summary generation reason. The generation information can represent which model the anomaly detection identification information is based on. That is, through the generation information, the subsequent first language model can understand how at least one anomaly detection identification information is generated. The anomaly detection field information can be a field identifier of the field to which the anomaly detection belongs. In practice, the anomaly detection field information can include the background content of the anomaly detection. The anomaly detection summary generation information can be the prompt content of the generation of the anomaly detection summary information. The anomaly detection summary generation reason can be the prompt content of the corresponding reason for generating the anomaly detection summary information.

[0083] In the fourth step, the anomaly detection summary prompt information is input into the first language model to generate the anomaly detection summary information and the anomaly detection summary generation reason. The anomaly detection summary generation reason may be a reason for generating the anomaly detection summary information.

[0084] The fifth step is to send the above-mentioned abnormal detection summary generation reason to the above-mentioned abnormal detection information verification terminal.

[0085] And the above anomaly detection verification information is generated through the following steps:

[0086] The first step is to generate a representation to generate a prompt information of the anomaly detection summary explanation reason based on the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information. The anomaly detection summary explanation reason is also the explanation reason for generating the anomaly detection summary information.

[0087] The second step is to send the generated prompt information to the second largest language model deployed in the abnormal detection information verification terminal to generate an abnormal detection summary explanation reason. The second largest language model can be an LLM model.

[0088] The third step is to obtain the reason for generating the abnormal detection summary sent by the abnormal detection information summary terminal.

[0089] In the fourth step, in response to determining that the content difference between the above-mentioned anomaly detection summary explanation reason and the above-mentioned anomaly detection summary generation reason meets the target content difference condition, anomaly detection verification information indicating that the verification has passed is generated. The target content difference condition may be a pre-set content difference condition indicating that the anomaly detection summary explanation reason and the above-mentioned anomaly detection summary generation reason belong to the same reason category.

[0090] In a fifth step, in response to determining that the difference in cause content between the anomaly detection summary explanation cause and the anomaly detection summary generation cause does not satisfy a target content difference condition, anomaly detection verification information indicating failure to pass the verification is generated.

[0091] Step 107: Send the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to the anomaly detection information verification terminal to generate anomaly detection verification information.

[0092] In some embodiments, the execution entity may send the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to an anomaly detection information verification terminal to generate anomaly detection verification information. The anomaly detection information verification terminal may be a terminal that verifies the accuracy of the anomaly detection value interval of the anomaly detection summary information. The anomaly detection verification information may be one of the following: verification information indicating that the anomaly detection summary information has passed the verification, and verification information indicating that the anomaly detection summary information has failed the verification.

[0093] Step 108, in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information has passed the verification, the anomaly detection summary information, the user information corresponding to the target user, and the anomaly detection verification information are stored in an encrypted form to the anomaly detection information server.

[0094] In some embodiments, in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information has passed the verification, the execution entity may store the anomaly detection summary information, the user information corresponding to the target user, and the anomaly detection verification information in an encrypted form to the anomaly detection information server. The anomaly detection information server may store an anomaly detection information server corresponding to each user. In practice, the encryption method may be an encryption method based on a symmetric encryption algorithm.

[0095] In some optional implementations of some embodiments, after step 108, the steps further include:

[0096] In the first step, in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information verification has failed, information adjustment prompt information is generated to indicate that the anomaly detection summary information is adjusted according to the historical anomaly detection data set. The information adjustment prompt information may be a prompt word for adjusting the abnormal value of the anomaly detection summary information.

[0097] The second step is to send the information adjustment prompt information to the abnormal detection information adjustment terminal, so that the abnormal detection adjustment terminal generates updated abnormal detection summary information corresponding to the information adjustment prompt information according to the deployed third language model. The abnormal detection summary information can be the summary information after the information is updated and adjusted.

[0098] The third step is to obtain the updated anomaly detection summary information sent by the above anomaly detection information adjustment model.

[0099] The fourth step is to store the updated anomaly detection summary information and the user information in encrypted form to the anomaly detection information server.

[0100] In some optional implementations of some embodiments, after step 108, the steps further include:

[0101] The first step is to generate an anomaly detection information query statement for the target user in response to receiving an anomaly detection query request sent by the target user. The anomaly detection query request may be a request for querying anomaly detection information. The anomaly detection information query statement may be a database statement. The anomaly detection information query statement may correspond to a statement element including: an anomaly detection identifier and a user identifier corresponding to the target user. The anomaly detection information query statement may be an SQL statement.

[0102] The second step is to query the above-mentioned anomaly detection summary information from the above-mentioned anomaly detection information server according to the above-mentioned anomaly detection information query statement.

[0103] In the third step, in response to determining that the abnormal detection display mode is an audio and text display mode, the abnormal audio and abnormal text corresponding to the above-mentioned abnormal detection summary information are sent to the user terminal corresponding to the above-mentioned target user, so as to perform audio playback and text display on the above-mentioned user terminal.

[0104] The above-mentioned embodiments of the present disclosure have the following beneficial effects: through the information storage method of some embodiments of the present disclosure, based on the information interaction between the currently available online computing resources and each terminal, the accurate abnormal detection related information corresponding to the target user can be stored for subsequent query use. Specifically, the reason why the relevant abnormal detection related information is not accurate enough and the generation process may be stuck is that the use of a single abnormal detection recognition model has a low fault tolerance problem, which may lead to the generation of abnormal detection information not being accurate enough. In addition, in the application process, the abnormal detection recognition model faces a large number of users and often has the problem of occupying high computing resources, which affects the normal operation of other businesses, and in the case of insufficient online resources, the recognition process may be stuck. Based on this, the information storage method of some embodiments of the present disclosure first obtains the historical abnormal detection data set corresponding to the target user from the target user database as the basic data for user abnormal detection judgment, so as to accurately generate abnormal detection related information later. Then, the above-mentioned historical abnormal detection data set is subjected to data feature screening to generate a historical abnormal detection feature information set. Here, by filtering data features, redundant and invalid feature content corresponding to the historical anomaly detection data set is removed to avoid wasting too much computing resources and consuming too long a time to output anomaly detection information in the subsequent application of the anomaly detection and recognition model. Next, the amount of online remaining available computing resources corresponding to the current computing terminal is obtained to filter at least one anomaly detection and recognition model that can be used for the currently available online computing resources. Then, according to the above-mentioned online remaining available computing resources, at least one anomaly detection and recognition model can be accurately filtered out from the target model database, wherein the total amount of computing resources corresponding to the above-mentioned at least one anomaly detection and recognition model is less than the above-mentioned online remaining available computing resources. Here, by filtering the anomaly detection and recognition model by the online remaining available computing resources, the problem of jamming in the subsequent generation of anomaly detection information can be avoided, resulting in a long generation time and occupying too long computing resources. Next, according to the above-mentioned historical anomaly detection feature information set, the above-mentioned at least one anomaly detection and recognition model can be used to accurately generate at least one anomaly detection and recognition information. Secondly, the above-mentioned at least one anomaly detection and recognition information and the at least one model identifier corresponding to the above-mentioned at least one anomaly detection and recognition model are sent to the anomaly detection information summary terminal to accurately generate anomaly detection summary information. Furthermore, the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information are sent to the anomaly detection information verification terminal to generate anomaly detection verification information.Here, through the interaction between the abnormal detection information summary terminal and the abnormal detection information verification terminal, not only can the summary information and abnormal detection verification information for at least one abnormal detection identification information be accurately generated, but also the process interval between the generation process of the abnormal detection identification information and the abnormal detection verification information and the summary process of the summary information can be realized, thereby avoiding occupying more computing resources and ensuring the accuracy of the generation of the abnormal detection information. Finally, in response to determining that the abnormal detection verification information indicates that the abnormal detection summary information has passed the verification, the abnormal detection summary information, the user information corresponding to the target user, and the abnormal detection verification information are stored in an encrypted form to the abnormal detection information service end. The encryption method not only ensures the privacy and security of the user's personal information, but also helps to efficiently query the subsequent abnormal detection information corresponding to the target user.

[0105] Further references Figure 2 As an implementation of the methods shown in the above figures, the present disclosure provides some embodiments of an information storage device. These device embodiments are similar to Figure 1 Corresponding to the method embodiments shown, the information storage device can be specifically applied to various electronic devices.

[0106] like Figure 2As shown, an information storage device 200 includes: a first acquisition unit 201, a first screening unit 202, a second acquisition unit 203, a second screening unit 204, a generation unit 205, a first sending unit 206, a second sending unit 207 and a storage unit 208. The first acquisition unit 201 is configured to acquire a historical anomaly detection data set corresponding to a target user from a target user database; the first screening unit 202 is configured to perform data feature screening on the above historical anomaly detection data set to generate a historical anomaly detection feature information set; the second acquisition unit 203 is configured to acquire the amount of online remaining available computing resources corresponding to the current computing terminal; the second screening unit 204 is configured to screen out at least one anomaly detection recognition model from the target model database according to the above online remaining available computing resources, wherein the total computing resources corresponding to the above at least one anomaly detection recognition model is less than the above online remaining available computing resources; the generation unit 205 is configured to, according to the above historical anomaly detection feature information set, use the above at least one anomaly detection recognition model to generate a historical anomaly detection feature information set. The detection and recognition model is used to generate at least one anomaly detection recognition information; the first sending unit 206 is configured to send the at least one anomaly detection recognition information and the at least one model identifier corresponding to the at least one anomaly detection recognition model to the anomaly detection information summary terminal to generate anomaly detection summary information; the second sending unit 207 is configured to send the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to the anomaly detection information verification terminal to generate anomaly detection verification information; the storage unit 208 is configured to store the anomaly detection summary information, the user information corresponding to the target user and the anomaly detection verification information in an encrypted form to the anomaly detection information server in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information verification has passed.

[0107] It is understandable that the units recorded in the information storage device 200 and the reference Figure 1 Therefore, the operations, features and beneficial effects described above for the method are also applicable to the information storage device 200 and the units contained therein, and will not be described in detail here.

[0108] Reference below Figure 3 , which shows a structural schematic diagram of an electronic device (eg, an electronic device) 300 suitable for implementing some embodiments of the present disclosure. Figure 3 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0109] like Figure 3As shown, the electronic device 300 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. In the RAM 303, various programs and data required for the operation of the electronic device 300 are also stored. The processing device 301, the ROM 302, and the RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0110] Typically, the following devices may be connected to the I / O interface 305: input devices 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; output devices 307 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 308 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 309. The communication devices 309 may allow the electronic device 300 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 3 The electronic device 300 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 3 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0111] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0112] It should be noted that the computer-readable medium in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0113] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0114] The above-mentioned computer-readable medium may be included in the above-mentioned electronic device; or it may exist independently without being assembled into the electronic device. The above-mentioned computer-readable medium carries one or more programs. When the above-mentioned one or more programs are executed by the electronic device, the electronic device: obtains the historical anomaly detection data set corresponding to the target user from the target user database; performs data feature screening on the above-mentioned historical anomaly detection data set to generate a historical anomaly detection feature information set; obtains the amount of online remaining available computing resources corresponding to the current computing terminal; based on the above-mentioned online remaining available computing resources, screens out at least one anomaly detection recognition model from the target model database, wherein the total amount of computing resources corresponding to the above-mentioned at least one anomaly detection recognition model is less than the above-mentioned online remaining available computing resources; based on the above-mentioned historical anomaly detection feature information set, uses The at least one anomaly detection recognition model mentioned above generates at least one anomaly detection recognition information; the at least one anomaly detection recognition information and at least one model identifier corresponding to the at least one anomaly detection recognition model are sent to the anomaly detection information summary terminal to generate anomaly detection summary information; the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information are sent to the anomaly detection information verification terminal to generate anomaly detection verification information; in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information verification has passed, the anomaly detection summary information, the user information corresponding to the target user and the anomaly detection verification information are stored in an encrypted form to the anomaly detection information server.

[0115] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0116] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0117] The units described in some embodiments of the present disclosure may be implemented by software or by hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a first acquisition unit, a first screening unit, a second acquisition unit, a second screening unit, a generation unit, a first sending unit, a second sending unit and a storage unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the first acquisition unit may also be described as "a unit for acquiring a historical anomaly detection data set corresponding to a target user from a target user database".

[0118] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0119] The above descriptions are only some preferred embodiments of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the embodiments of the present disclosure is not limited to the technical solutions formed by a specific combination of the above-mentioned technical features, but should also cover other technical solutions formed by any combination of the above-mentioned technical features or their equivalent features without departing from the above-mentioned inventive concept. For example, the above-mentioned features are replaced with the technical features with similar functions disclosed in the embodiments of the present disclosure (but not limited to) and the technical solutions formed.

Claims

1. An information storage method, comprising: Obtain the historical anomaly detection dataset corresponding to the target user from the target user database; Performing data feature screening on the historical anomaly detection data set to generate a historical anomaly detection feature information set; Obtain the remaining available online computing resources corresponding to the current computing terminal; According to the amount of remaining available online computing resources, at least one anomaly detection and recognition model is screened out from the target model database, wherein the total amount of computing resources corresponding to the at least one anomaly detection and recognition model is less than the amount of remaining available online computing resources; Generate at least one anomaly detection identification information according to the historical anomaly detection feature information set and using the at least one anomaly detection identification model; Sending the at least one anomaly detection identification information and at least one model identifier corresponding to the at least one anomaly detection identification model to an anomaly detection information summary terminal to generate anomaly detection summary information; Sending the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to the anomaly detection information verification terminal to generate anomaly detection verification information; In response to determining that the anomaly detection verification information indicates that the anomaly detection summary information has passed the verification, the anomaly detection summary information, the user information corresponding to the target user, and the anomaly detection verification information are stored in an anomaly detection information service end in an encrypted form.

2. The method according to claim 1, wherein: The step of generating at least one anomaly detection identification information according to the historical anomaly detection feature information set and using the at least one anomaly detection identification model comprises: In response to determining that the at least one anomaly detection and recognition model is an unsupervised recognition model, the historical anomaly detection feature information set is input into each anomaly detection and recognition model in the at least one anomaly detection and recognition model to generate anomaly detection and recognition information, thereby obtaining at least one anomaly detection and recognition information.

3. The method according to claim 1, wherein: The step of selecting at least one anomaly detection and recognition model from a target model database according to the remaining available online computing resources includes: Filter out, from the target model database, a set of anomaly detection and recognition models whose corresponding total computing resources are less than the remaining available online computing resources; Remove the anomaly detection and recognition model group whose corresponding total recognition time is greater than or equal to the target time from the anomaly detection and recognition model group set to obtain at least one first anomaly detection and recognition model group; Remove the anomaly detection and recognition model group whose corresponding model parameter byte information is smaller than the target byte size from the at least one first anomaly detection and recognition model group to obtain at least one second anomaly detection and recognition model group; Filtering out the second anomaly detection and recognition model group having the highest total accuracy of the corresponding historical model from the at least one second anomaly detection and recognition model group; Each anomaly detection and recognition model included in the second anomaly detection and recognition model group is determined as at least one anomaly detection and recognition model.

4. The method according to claim 2, wherein: The step of generating at least one anomaly detection identification information according to the historical anomaly detection feature information set and using the at least one anomaly detection identification model further includes: In response to determining that the at least one anomaly detection recognition model includes an unsupervised recognition model and a deep learning model, determining at least one unsupervised recognition model and at least one deep learning model; Inputting the historical anomaly detection feature information set into each unsupervised recognition model of the at least one unsupervised recognition model to generate candidate anomaly detection recognition information, thereby obtaining at least one candidate anomaly detection recognition information; generating, based on the at least one candidate abnormality detection identification information, first abnormality probability information characterizing the presence of abnormality detection and second abnormality probability information characterizing the absence of abnormality detection; combining the first abnormality detection label and the first abnormality probability information to generate first combined information; combining the second anomaly detection label and the second anomaly probability information to generate second combined information; For each deep learning model in the at least one deep learning model, the following generating steps are performed: Inputting the historical anomaly detection feature information set into an anomaly detection feature information generation layer included in the deep learning model to obtain first anomaly detection feature information; Inputting the first combination information and the second combination information into a feature information generation layer included in the deep learning model respectively to generate second abnormality detection feature information and third abnormality detection feature information; Inputting the first abnormality detection feature information, the second abnormality detection feature information, and the third abnormality detection feature information into a feature information combination layer included in the deep learning model to generate combined feature information; The combined feature information is input into an output layer included in the deep learning model to generate anomaly detection identification information.

5. The method according to claim 1, wherein: The anomaly detection summary information is generated by the following steps: Generate model performance evaluation prompt information representing the evaluation of model performance according to at least one model parameter information corresponding to the at least one anomaly detection and recognition model and the at least one model identifier; Inputting the model performance evaluation prompt information into the first language model deployed in the abnormal detection information aggregation terminal to generate at least one model performance evaluation information for the at least one model identifier; Generate anomaly detection summary prompt information representing the at least one anomaly detection identification information and the at least one model performance evaluation information, wherein the anomaly detection summary prompt information includes: generation information corresponding to the at least one anomaly detection identification information, anomaly detection field information, anomaly detection summary generation information, and anomaly detection summary generation reason; Inputting the anomaly detection summary prompt information into the first language model to generate the anomaly detection summary information and the reason for generating the anomaly detection summary; sending the abnormal detection summary generation reason to the abnormal detection information verification terminal; and The anomaly detection verification information is generated by the following steps: Generate a prompt message representing the reason for generating anomaly detection summary explanation based on the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information; Sending the generated prompt information to the second largest language model deployed by the abnormal detection information verification terminal to generate an abnormal detection summary explanation reason; Obtaining a reason for generating the abnormal detection summary sent by the abnormal detection information summary terminal; In response to determining that a content difference between the anomaly detection summary explanation reason and the anomaly detection summary generation reason satisfies a target content difference condition, generating anomaly detection verification information indicating that the verification has passed; In response to determining that the difference in cause content between the anomaly detection summary explanation cause and the anomaly detection summary generation cause does not satisfy a target content difference condition, anomaly detection verification information indicating failure to pass verification is generated.

6. The method according to claim 5, wherein: The method further comprises: In response to determining that the anomaly detection verification information indicates that the anomaly detection summary information verification has failed, generating information adjustment prompt information indicating that information adjustment is performed on the anomaly detection summary information according to the historical anomaly detection data set; Sending the information adjustment prompt information to the abnormality detection information adjustment terminal, so that the abnormality detection adjustment terminal generates updated abnormality detection summary information corresponding to the information adjustment prompt information according to the deployed third language model; Obtaining updated anomaly detection summary information sent by the anomaly detection information adjustment model; The updated anomaly detection summary information and the user information are stored in encrypted form in the anomaly detection information server.

7. The method according to claim 1, wherein: The method further comprises: In response to receiving an anomaly detection query request sent by the target user, generating an anomaly detection information query statement for the target user; According to the anomaly detection information query statement, query the anomaly detection summary information from the anomaly detection information server; In response to determining that the abnormal detection display mode is an audio and text display mode, the abnormal audio and abnormal text corresponding to the abnormal detection summary information are sent to the user terminal corresponding to the target user, so as to perform audio playback and text display at the user terminal.

8. An information storage device, comprising: A first acquisition unit is configured to acquire a historical anomaly detection data set corresponding to a target user from a target user database; a first screening unit, configured to perform data feature screening on the historical anomaly detection data set to generate a historical anomaly detection feature information set; A second acquisition unit is configured to acquire the amount of online remaining available computing resources corresponding to the current computing terminal; A second screening unit is configured to screen out at least one anomaly detection and recognition model from the target model database according to the amount of remaining online available computing resources, wherein the total amount of computing resources corresponding to the at least one anomaly detection and recognition model is less than the amount of remaining online available computing resources; a generating unit configured to generate at least one anomaly detection identification information based on the historical anomaly detection feature information set and using the at least one anomaly detection identification model; A first sending unit is configured to send the at least one abnormality detection identification information and at least one model identifier corresponding to the at least one abnormality detection identification model to an abnormality detection information summary terminal to generate abnormality detection summary information; A second sending unit is configured to send the historical anomaly detection data set corresponding to the target user and the anomaly detection summary information to the anomaly detection information verification terminal to generate anomaly detection verification information; The storage unit is configured to store the anomaly detection summary information, the user information corresponding to the target user and the anomaly detection verification information in an encrypted form to the anomaly detection information service end in response to determining that the anomaly detection verification information indicates that the anomaly detection summary information verification has passed.

9. An electronic device, comprising: one or more processors; a storage device having one or more programs stored thereon, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 7.

10. A computer readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images