Abnormality detection method, device, electronic device, storage medium and program product

Abstract

The present disclosure provides an anomaly detection method, device, electronic equipment, storage medium and program product, which comprises: determining unlabelled data of a task to be detected, performing local feature extraction on the unlabelled data to obtain at least one unlabelled data feature; performing feature matching on the at least one unlabelled data feature through a pre-constructed feature matching model to obtain at least one near-neighbor feature segment corresponding to the at least one unlabelled data feature; performing distance calculation on the at least one unlabelled data feature and the at least one near-neighbor feature segment to obtain at least one anomaly score corresponding to the at least one unlabelled data feature; and performing detection based on the at least one anomaly score to obtain an anomaly region. The present disclosure can improve the detection performance on dynamic data and unknown anomalies, and is closer to actual application.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of quality detection, and particularly relates to an anomaly detection method and device, electronic equipment, storage medium and program product. BACKGROUND

[0002] This section is intended to provide background or context to the embodiments of the present disclosure recited in the claims. The description herein does not constitute admission that the prior art is prior art nor that the present disclosure is not entitled to antedate such prior art by virtue of prior application.

[0003] Anomaly detection aims to identify data points or behaviors that deviate significantly from normal patterns. By establishing a model of normal data, it detects data that is significantly different from the model, and is widely used in industrial quality detection, network security, medical imaging, etc. to find anomalies such as defects, intrusions or diseases.

[0004] However, in the related art, there are problems such as dependence of anomaly detection methods on a large number of labeled samples, large consumption of computing resources, poor adaptability to dynamic change data, and catastrophic forgetting. SUMMARY

[0005] Therefore, the purpose of the present disclosure is to provide an anomaly detection method, device, electronic equipment, storage medium and program product, which at least partially solves one of the technical problems in the related art.

[0006] To achieve the above purpose, in a first aspect, an anomaly detection method is provided, applied to a server, and the method comprises:

[0007] determining unlabeled data of a to-be-detected task, performing local feature extraction on the unlabeled data to obtain at least one unlabeled data feature;

[0008] performing feature matching on the at least one unlabeled data feature through a pre-constructed feature matching model to obtain at least one nearest neighbor feature segment corresponding to the at least one unlabeled data feature;

[0009] performing distance calculation on the at least one unlabeled data feature and the at least one nearest neighbor feature segment to obtain at least one anomaly score corresponding to the at least one unlabeled data feature;

[0010] performing detection based on the at least one anomaly score to obtain an anomaly region.

[0011] Based on the same inventive concept, in a second aspect, an anomaly detection device is provided, comprising:

[0012] a data feature determination module configured to determine unlabeled data of a task to be detected, perform local feature extraction on the unlabeled data, and obtain at least one unlabeled data feature;

[0013] a feature segment determination module configured to perform feature matching on the at least one unlabeled data feature by using a pre-constructed feature matching model, and obtain at least one nearest neighbor feature segment corresponding to the at least one unlabeled data feature;

[0014] an anomaly score determination module configured to perform distance calculation on the at least one unlabeled data feature and the at least one nearest neighbor feature segment, and obtain at least one anomaly score corresponding to the at least one unlabeled data feature;

[0015] an anomaly region determination module configured to perform detection based on the at least one anomaly score, and obtain an anomaly region.

[0016] Based on the same inventive concept, a third aspect of the embodiments of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the processor implements the method of the first aspect when executing the program.

[0017] Based on the same inventive concept, a fourth aspect of the embodiments of the present disclosure provides a non-transitory computer-readable storage medium, which stores computer instructions for causing a computer to execute the method of the first aspect.

[0018] Based on the same inventive concept, a fifth aspect of the embodiments of the present disclosure provides a computer program product, which includes computer program instructions, and when the computer program instructions run on a computer, the computer executes the method of the first aspect.

[0019] As can be seen from the above, the anomaly detection method, device, electronic device, storage medium, and program product provided by the embodiments of the present disclosure, the method includes: determining unlabeled data of a task to be detected, performing local feature extraction on the unlabeled data, and obtaining at least one unlabeled data feature; performing feature matching on the at least one unlabeled data feature by using a pre-constructed feature matching model, and obtaining at least one nearest neighbor feature segment corresponding to the at least one unlabeled data feature; performing distance calculation on the at least one unlabeled data feature and the at least one nearest neighbor feature segment, and obtaining at least one anomaly score corresponding to the at least one unlabeled data feature; and performing detection based on the at least one anomaly score, and obtaining an anomaly region. The present disclosure can improve the detection performance on dynamic data and unknown anomalies, and is closer to actual application. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to more clearly illustrate the technical solutions in the present disclosure or the related art, the drawings needed to be used in the embodiments or the related art description will be briefly introduced. Obviously, the drawings in the following description are only embodiments of the present disclosure, and other drawings can be obtained by those skilled in the art without creative effort on the basis of these drawings.

[0021] Figure 1 An application scenario diagram of the abnormality detection method provided by the exemplary embodiments of the present disclosure is shown.

[0022] Figure 2 A flow diagram of the abnormality detection method provided by the exemplary embodiments of the present disclosure is shown.

[0023] Figure 3 A flow diagram of the abnormality detection method provided by the exemplary embodiments of the present disclosure is shown.

[0024] Figure 4 A feature enhancement flow diagram of the abnormality detection method provided by the exemplary embodiments of the present disclosure is shown.

[0025] Figure 5 A structure diagram of the abnormality detection device provided by the exemplary embodiments of the present disclosure is shown.

[0026] Figure 6 An electronic device hardware structure diagram provided by the exemplary embodiments of the present disclosure is shown. DETAILED DESCRIPTION

[0027] It can be understood that before using the technical solutions disclosed in the embodiments of the present application, the type of personal information involved in the present application, the use range, the use scenario, etc. should be informed to the user and the authorization of the user should be obtained in accordance with relevant laws and regulations.

[0028] For example, in response to receiving the active request of the user, the prompt information is sent to the user to explicitly prompt the user that the operation requested to be executed will need to obtain and use the personal information of the user. Thus, the user can voluntarily choose whether to provide the personal information to the electronic device, application program, server or storage medium, etc. software or hardware that executes the operation of the technical solutions of the present application according to the prompt information.

[0029] As an optional but not limited implementation manner, in response to receiving the active request of the user, the manner of sending the prompt information to the user may, for example, be the manner of pop-up window, and the prompt information can be presented in the form of text in the pop-up window. In addition, the pop-up window can also carry a selection control for the user to select "agree" or "disagree" to provide the personal information to the electronic device.

[0030] It can be understood that the above notification and user authorization obtaining process is only illustrative, and does not limit the implementation of the present application. Other ways that meet relevant laws and regulations can also be applied to the implementation of the present application.

[0031] It can be understood that the data involved in the technical solution (including but not limited to the data itself, the acquisition or use of the data) should comply with the requirements of relevant laws and regulations and relevant provisions.

[0032] In order to make the purpose, technical solutions and advantages of the present disclosure clearer, the principles and spirits of the present disclosure will be described below with reference to several exemplary embodiments. It should be understood that these embodiments are only given to enable those skilled in the art to better understand and implement the present disclosure, and do not limit the scope of the present disclosure in any way. On the contrary, these embodiments are provided to make the present disclosure more thorough and complete, and to fully convey the scope of the present disclosure to those skilled in the art.

[0033] In this document, it should be understood that any number of elements in the drawings is used for illustration and not limitation, and any naming is only for differentiation and does not have any limiting meaning.

[0034] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present disclosure should be understood as the usual meaning understood by those skilled in the art to which the present disclosure belongs. The "first", "second" and similar words used in the embodiments of the present disclosure do not represent any order, quantity or importance, but are only used to distinguish different components. "Include" or "contain" and similar words mean that the elements or objects before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connected" or "connected" and similar words are not limited to physical or mechanical connection, but can include electrical connection, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to represent relative positional relationship, when the absolute position of the described object changes, the relative positional relationship may also change accordingly. The article "a" or "an" before an element does not exclude the existence of multiple such elements.

[0035] The principles and spirits of the present disclosure will be explained in detail below with reference to several representative embodiments of the present disclosure.

[0036] As described in the background, in the related art, there are problems such as that the anomaly detection method relies on a large number of labeled samples, consumes a large amount of computing resources, has poor adaptability to dynamic change data, and has catastrophic forgetting. Specifically, the purpose of anomaly detection (AD) is to identify data points that deviate significantly from the majority of data. Due to its wide application in different fields, it has attracted widespread attention from academia and industry: such as industrial inspection, medical imaging, scientific discovery, etc.

[0037] In early research, researchers treated anomaly detection as a single classification task, and the proposed solutions also required a large number of normal samples for model training. Such methods are usually referred to as full-shot methods. Recently, the text-image contrast pre-training model CLIP (Contrastive Language-Image Pre-training) developed by the OpenAI team has shown excellent zero-shot migration ability on various computer vision tasks, which opens up a new field for anomaly detection, namely zero-shot anomaly detection method. Compared with traditional methods, zero-shot anomaly detection has higher flexibility and adaptability, and is particularly suitable for handling new categories and dynamic change data scenarios.

[0038] Although the above progress has largely solved the problem of sample labeling difficulty, other major challenges still hinder the deployment of these methods. First, CLIP is not strongly adaptable to specific domain data (such as medical images or industrial detection data), and may need to be fine-tuned, while fine-tuning and subsequent inference processes consume a large amount of computing resources, which is a major challenge for deployment on edge devices with insufficient computing resources. Second, in complex and dynamic real-world environments, the categories of input data may change over time. In this case, the anomaly detection algorithm must successfully run on both old and new categories at the same time. When category changes occur repeatedly, it is usually desirable to train a model on a series of tasks, where each task represents a change in the data. For example, in the process of factory quality inspection, different industrial products appear continuously, and defects need to be identified. However, artificial neural networks often forget old tasks when learning a new task, which is known as catastrophic forgetting. Catastrophic forgetting greatly hinders the deployment of anomaly detection models in real-world scenarios.

[0039] In real-world environments, the classes of input data can change over time, for example, in the field of network security, new types of network attacks can constantly emerge. In such dynamic scenarios, anomaly detection algorithms need to adapt to both known classes and newly introduced classes. However, when learning new tasks, neural networks often adjust weights to adapt to new data, which can cause previously learned knowledge to be overwritten or forgotten, i.e., the catastrophic forgetting phenomenon. For example, an image recognition system may forget previously learned classes when adding new classes. This catastrophic forgetting seriously affects the deployment and application of anomaly detection models in dynamic real-world scenarios.

[0040] To solve the above problems, the present disclosure provides an anomaly detection method, device, electronic equipment, storage medium and program product scheme, which comprises:

[0041] Determine the unlabeled data of the to-be-detected task, perform local feature extraction on the unlabeled data to obtain at least one unlabeled data feature, perform feature matching on the at least one unlabeled data feature through a pre-constructed feature matching model to obtain at least one near-neighbor feature segment corresponding to the at least one unlabeled data feature, perform distance calculation on the at least one unlabeled data feature and the at least one near-neighbor feature segment to obtain at least one anomaly score corresponding to the at least one unlabeled data feature, and perform detection based on the at least one anomaly score to obtain an abnormal region. Traditional anomaly detection methods are mostly based on static training data, but in real-world applications, data is usually dynamic. Such dynamics can cause the model to decline in performance due to catastrophic forgetting. Therefore, the present disclosure proposes a class-incremental anomaly detection method, which is closer to the actual application scenario, but there is currently less related research.

[0042] In view of the limitations of convolutional neural networks (CNN) in understanding global information, the present disclosure introduces a self-attention mechanism to enhance features. By capturing long-range dependencies, strengthening the correlation between features, and improving the ability to perceive multi-scale anomaly patterns, this method can effectively improve the detection effect of unknown anomalies.

[0043] In addition, the present disclosure also adopts a weight-based anomaly feature selection method. The anomaly features in the feature space are regarded as "pollution", by analyzing the density change of the feature distribution, the low-density area different from the normal samples is identified and marked as an anomaly feature to be excluded. In this way, the model can focus more on learning the features of normal samples, thereby improving the overall performance.

[0044] After introducing the basic principles of the present disclosure, the various non-limiting embodiments of the present disclosure will be specifically introduced below.

[0045] Reference Figure 1Fig. 1 is a schematic diagram of an application scenario of an abnormality detection method provided by an exemplary embodiment of the present disclosure.

[0046] In the application scenario, the terminal device 101 and the server 102 are connected through a wired or wireless communication network to realize data interaction.

[0047] The terminal device 101 can be an electronic device close to a user side with data transmission, multimedia input / output functions, including but not limited to a desktop computer, a mobile phone, a mobile computer, a tablet computer, a media player, a smart wearable device, a personal digital assistant (PDA), or other electronic devices capable of realizing the above functions, etc. The electronic device can include a processor and a display screen with touch input function, the display screen is used to present a graphical user interface, the graphical user interface can display an application interface, the processor is used to process application data, generate a graphical user interface, and control the display of the graphical user interface on the display screen.

[0048] The server 102 can be a stand-alone physical server, a server cluster or a distributed system composed of multiple physical servers, a cloud server providing cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0049] In some exemplary embodiments, the abnormality detection method can run on the terminal device 101 or the server 102.

[0050] When the abnormality detection method runs on the server 102, the server 102 is used to provide an abnormality detection service for a user of the terminal device 101.

[0051] The terminal device 101 determines unlabelled data of a to-be-detected task and transmits the unlabelled data to the server 102;

[0052] The server 102 receives the unlabelled data transmitted by the terminal device 101, and the server 102 performs local feature extraction on the unlabelled data to obtain at least one unlabelled data feature;

[0053] The server 102 performs feature matching on the at least one unlabelled data feature through a pre-constructed feature matching model to obtain at least one near-neighbor feature segment corresponding to the at least one unlabelled data feature;

[0054] The server 102 performs distance calculation on the at least one unlabeled data feature and the at least one neighbor feature segment, to obtain at least one anomaly score corresponding to the at least one unlabeled data feature.

[0055] After the server 102 detects the abnormal region based on the at least one anomaly score, the server 102 transmits the related information of the abnormal region to the terminal device 101.

[0056] It should be noted that the above application scenarios are only shown for the purpose of facilitating understanding of the spirit and principles of the present disclosure, and the embodiments of the present disclosure are not limited in this respect. On the contrary, the embodiments of the present disclosure can be applied to any applicable scenario.

[0057] Reference Figure 2 , an anomaly detection method, the method comprising the following steps:

[0058] In step S210, unlabeled data of a task to be detected is determined, and local feature extraction is performed on the unlabeled data to obtain at least one unlabeled data feature.

[0059] In specific implementation, the unlabeled data of the task to be detected refers to:

[0060] In the anomaly detection task, there is no data pre-labeled as abnormal or not.

[0061] In specific implementation, the manner of performing local feature extraction on the unlabeled data to obtain at least one unlabeled data feature is:

[0062] In the present exemplary embodiment, local feature extraction can be performed on the unlabeled data by using an encoder of a generative adversarial network (GAN), using a pre-trained model (such as ResNet, VGG, BERT, etc.) on a large-scale dataset, using a contrastive learning framework (such as SimCLR, MoCo), using a convolutional neural network, or other technical means, to obtain at least one unlabeled data feature, so as to be matched with the features stored in the pre-constructed feature matching model in the following.

[0063] Specifically, referring to Figure 3 The figure includes a training process block (i.e., a feature matching model training block) and a testing process block; in the testing process block, class 1, class 2, class 3, …, and class k represent several different input image examples, including images of industrial parts such as screws and gears. These images are unlabeled, and local feature extraction is performed on these unlabeled data to obtain at least one unlabeled data feature. These features are usually used to capture detailed information in the image, such as texture, edge, shape, and other local patterns, which are crucial for identifying abnormal regions in the image.

[0064] Step S220, performing feature matching on the at least one unlabeled data feature through a pre-constructed feature matching model to obtain at least one neighbor feature segment corresponding to the at least one unlabeled data feature.

[0065] In the present exemplary embodiment, the feature matching model is constructed by the following method:

[0066] An unlabeled data sample set for training is constructed, and feature extraction is performed on a plurality of unlabeled data sample data of the unlabeled data sample set for training based on a convolutional neural network to obtain an initial feature set of unlabeled sample data for training;

[0067] Based on the initial feature set of unlabeled sample data for training, anomaly extraction is performed to obtain a pure feature set of unlabeled sample data for training;

[0068] Feature sampling is performed on the pure feature set of unlabeled sample data for training to obtain a core feature set;

[0069] A global feature memory bank is constructed, and the core feature set is stored in the global feature memory bank to obtain the feature matching model.

[0070] In specific implementation, constructing an unlabeled data sample set for training, and performing feature extraction on a plurality of unlabeled data sample data of the unlabeled data sample set for training based on a convolutional neural network to obtain an initial feature set of unlabeled sample data for training means:

[0071] Reference Figure 3 , class 1, class 2, class 3…class k represent several different input image examples, including images of industrial parts such as screws and gears, these images are unlabeled, and the unlabeled data sample set for training used for model training will be used for anomaly detection, the pre-trained convolutional neural network (such as WideResNet-50) is used as an encoder to extract the features Layer 2 and Layer 3 of the image, and the patch-level features are extracted from Layer 2 and Layer 3, these features will be further processed to enhance their expression ability.

[0072] As a specific embodiment, in a zero-shot class-incremental anomaly detection task, a total of Γ different tasks need to be performed, each task contains multiple categories of data, and the categories between tasks are not completely the same: In this task, the data set is divided into a stream of unmarked subsets, and the training set can be represented as where represents the test set of the cth class in the data set The training set and test set can be represented as , wherein represents the test set of the cth class in the data set For all c, After the s-th incremental session, the model will be tested in the category seen: Each incremental session has C classes participating in anomaly detection, and each class has unlabelled samples. Feature extraction is performed on these unlabelled samples to obtain an initial feature set of unlabelled sample data for training.

[0073] In specific implementation, the way to obtain a pure feature set of unlabelled sample data for training based on the initial feature set of unlabelled sample data for training is:

[0074] Referring to Figure 3 , after enhancement of patch-level features from Layer 2 and Layer 3, anomaly feature recognition is performed, and then the recognized anomaly features are removed, thereby obtaining a pure feature set of unlabelled sample data for training.

[0075] In specific implementation, the way to obtain a core feature set by sampling the pure feature set of unlabelled sample data for training is:

[0076] Referring to Figure 3 , the features after removing the anomaly features (i.e., the pure feature set of unlabelled sample data for training) are sampled to select a core feature set (CoreSet); wherein a subset covering the core features of the sample is selected by optimization methods such as minimization of maximum minimum distance, thereby being able to remove redundant features, reduce feature dimension, and improve matching efficiency.

[0077] As a specific embodiment, after deleting the pollution features, feature sampling is performed on the feature space, and patch weights are discarded in the detection stage. In the sampling process, the feature subset should cover the core features of the sample as much as possible: . , and . After feature sampling, a CoreSet of a single class is obtained, and under the paradigm of class incremental learning, only the CoreSet of a single class cannot meet the demand of dynamic increase of data classes, so a global Memory Bank is set for all sessions of class incremental learning, aiming to include the CoreSet of all seen classes in class incremental learning. Assuming that C classes have been seen in class incremental learning and need to be detected, the core feature set of the cth class is , then: .

[0078] In implementation, a global feature memory bank is constructed, and the core feature set is stored in the global feature memory bank, to obtain the feature matching model.

[0079] Referring to Figure 3 , a global feature storage bank is constructed to store core feature sets of different categories. Specifically, in each session, a core feature set of a new category is added to the Memory Bank (i.e., the global feature memory bank). The feature sets stored in the Memory Bank are classified by category, and the feature set of each category is called a CoreSet, and then a feature matching model is obtained.

[0080] In the above exemplary embodiments, the way of constructing the feature matching model is introduced. Next, the way of obtaining the initial feature set of the unlabeled sample data for training is specifically introduced.

[0081] In this exemplary embodiment, the initial feature set of the unlabeled sample data for training includes a middle-level feature set of the unlabeled sample data for training and a high-level feature set of the unlabeled sample data for training.

[0082] The feature extraction on the several unlabeled data sample data of the unlabeled data sample set based on the convolutional neural network obtains the initial feature set of the unlabeled sample data for training, including:

[0083] The feature extraction on the several unlabeled data sample data of the unlabeled data sample set based on the convolutional neural network obtains the middle-level feature set of the unlabeled sample data for training and the high-level feature set of the unlabeled sample data for training.

[0084] In implementation, the feature extraction on the several unlabeled data sample data of the unlabeled data sample set based on the convolutional neural network obtains the middle-level feature set of the unlabeled sample data for training and the high-level feature set of the unlabeled sample data for training in the following way:

[0085] Based on the above exemplary embodiments, an unlabeled sample set is given , and the convolutional neural network (CNN) is used to extract the features of the sample . It is assumed that the feature map extracted by the lth convolutional layer of the pre-trained model E can be represented as: . The feature vector represents the patch-level feature representation at the position of the image .

[0086] The self-attention mechanism is combined with the traditional convolutional neural network (CNN) model to enhance the model's global perception ability and sensitivity to subtle features. Given a patch-level feature set ;in, Represents the convolutional neural network Layer (for example, It can be expressed as Layer 2, which is the hierarchical feature set in the unlabeled sample data for training or It can be represented as a feature map extracted from Layer 3 (the high-level feature set of unlabeled sample data for training); represents a set of real numbers, meaning that all elements of the feature map are real numbers; Indicates the The width of the layer feature map (width); Indicates the The height of the layer feature map (height); Indicates the The number of channels in the layer feature map. The number of channels corresponds to the number of different features that the feature map can capture. Indicates that from A specific location extracted from the feature map of the layer The feature vector of , this position can be any point on the feature map, such as a pixel or a local area; Represents a one-dimensional vector whose length is , that is, The number of channels of the layer.

[0087] In the above exemplary embodiment, a method for obtaining an initial feature set of unlabeled sample data for training is specifically introduced. Below, a method for obtaining a pure feature set of unlabeled sample data for training is specifically introduced:

[0088] In this example embodiment, anomaly extraction is performed based on the initial feature set of the unlabeled sample data for training to obtain a clean feature set of the unlabeled sample data for training, including:

[0089] Performing average pooling on the mid-level unlabeled sample data feature set for training to obtain the denoised feature set of the unlabeled sample data for training;

[0090] Performing feature enhancement on the training high-level unlabeled sample data feature set to obtain the training unlabeled sample data enhanced feature set;

[0091] Anomaly extraction is performed on the denoising feature set of the unlabeled sample data for training and the enhanced feature set of the unlabeled sample data for training to obtain a pure feature set of the unlabeled sample data for training.

[0092] In particular implementation, the training middle-level unlabeled sample data feature set is average-pooled to obtain the training unlabeled sample data denoising feature set; and the training high-level unlabeled sample data feature set is enhanced to obtain the training unlabeled sample data enhanced feature set in the following manner:

[0093] For Layer 2 feature (i.e. training middle-level unlabeled sample data feature set) enhancement: refer to Figure 3 , the average similarity between the original feature and the enhanced feature of Layer 2 is calculated s . s If the similarity S is less than a preset threshold Figure 4 0, the enhanced feature of Layer 2 is output; otherwise, the original feature of Layer 2 is output. Specifically, refer to , the original feature extracted by Layer 2 is denoted as , the feature map is divided into multiple local regions (patches), and the feature of each patch is denoted as , the original feature is copied once for subsequent processing, and the original feature is average-pooled to reduce the influence of noise; the pooled feature is added to the original feature to obtain the enhanced feature ; the average similarity between the original feature patch-level feature and the enhanced feature enhanced feature s is calculated s . S If , the enhanced feature is output; otherwise, the original feature patch-level feature

[0094] is output. As a specific example, given a patch-level feature set , different feature enhancement strategies can be used for features of different convolution layers. Given the patch-level feature of Layer 2 , the feature can be average-pooled to reduce the influence of noise and retain important feature information: . The pooled feature is , and the feature similarity is calculated as .

[0095] For Layer 3 feature (i.e. high-level unlabeled sample data feature set for training) enhancement: refer to Figure 3 , the original features of Layer 3 are extracted, and the features are copied three times as query (Query), key (Key) and value (Value) respectively, and then the features of query (Query), key (Key) and value (Value) are enhanced through self-attention mechanism, and the similarity between the original features of Layer 3 and the enhanced features is measured s . If the similarity s is less than a preset threshold S 0, the enhanced features are output; otherwise, the original features of Layer 3 are output. Specifically, refer to Figure 4 , the original features extracted from Layer 3 are input , denoted as , the feature map is divided into multiple local regions (patches), and the feature of each patch is denoted as , then is copied three times as query (Query), key (Key) and value (Value); the value (Value) is max-pooled to highlight important features; the query, key and pooled value are flattened to facilitate matrix operation; the dot product of the query and the key is calculated to obtain the attention score matrix; the attention score is normalized by softmax to obtain the attention weight matrix, and then the attention weight matrix is multiplied by the pooled value to obtain the weighted feature; then the weighted feature is reshaped back to the shape of the original feature; and the reshaped feature is added to the original feature to obtain the enhanced feature ; the average similarity between the original feature patch-level feature and the enhanced feature is calculated s , if s < S 0, the enhanced feature is output; otherwise, the original feature patch-level feature is output.

[0096] As a specific example, the self-attention mechanism is introduced for feature enhancement for the patch-level features of layer3 (i.e. high-level unlabeled sample data feature set for training). Given the feature vector in the feature set , the feature vector is copied three times as query, key and value in the Transformer: . Wherein is the depth of the feature vector , represents max-pooling on the feature vector to emphasize nearby features. The vector is obtained by computing the relationship between pixels, which takes into account the connection between remote features. Specifically, the product of the query and the key is used as the weight, and the product of these weights and the softmax value and the feature value is calculated. The obtained is adjusted to the same size as the original feature map, and the similarity between the two is calculated: .

[0097] In implementation, the training unlabeled sample data denoising feature set and the training unlabeled sample data enhanced feature set are extracted for abnormalities, and the training unlabeled sample data pure feature set is obtained.

[0098] Referring to Figure 3 , the output features of Layer 2 (i.e., the training unlabeled sample data denoising feature set) and the output features of Layer 3 (i.e., the training unlabeled sample data enhanced feature set) are spliced to obtain the final feature representation; the local outlier factor (LOF) algorithm is used to identify abnormal features; wherein by calculating the local reachable density of each feature point, the abnormal features in the low density area are identified, and the identified abnormal features are removed, and the normal features (i.e., the training unlabeled sample data pure feature set) are retained.

[0099] As a specific embodiment, in the process of feature extraction for unlabeled samples, the abnormal features of abnormal samples are also extracted, and the abnormal features in the feature space are regarded as a kind of pollution (relative to normal features), which need to be identified and removed. The LOF (local outlier factor) algorithm is used for abnormal feature identification, and the LOF normalizes clusters of different densities by calculating the relative density of each cluster, and also uses local k-nearest neighbor distance as a measurement index to alleviate the overwhelming influence of large clusters. Given the feature patch-level feature , the k-distance of which can be represented as , given the parameter k, the feature to other features The rechability distance is: , represents the k-distance of , that is, the distance of to its kth nearest neighbor, k is the L2-norm representing the direct distance between and . The distance between is less than or equal to​ The data points of The local rechability density (LRD) of is the set of k-nearest neighbors of The number of sets is usually equal to k when there are no repeated neighbors. The effect of large clusters is greatly reduced as the local reachability density of patch-level features increases. To normalize the local density to a relative density, the image-level relative density is defined as:

[0100] Step S230, distance calculation is performed on the at least one unlabeled data feature and the at least one nearest neighbor feature fragment, to obtain at least one anomaly score corresponding to the at least one unlabeled data feature.

[0101] In the present example embodiment, the distance calculation on the at least one unlabeled data feature and the at least one nearest neighbor feature fragment to obtain at least one anomaly score corresponding to the at least one unlabeled data feature comprises:

[0102] Average distance calculation is performed on the distance between the at least one unlabeled data feature and the at least one nearest neighbor feature fragment, to obtain an average Euclidean distance.

[0103] The average Euclidean distance is estimated to obtain the at least one anomaly score corresponding to the at least one unlabeled data feature.

[0104] In specific implementation, average distance calculation is performed on the distance between the at least one unlabeled data feature and the at least one nearest neighbor feature fragment, to obtain an average Euclidean distance; and the average Euclidean distance is estimated to obtain the at least one anomaly score corresponding to the at least one unlabeled data feature.

[0105] Referring to Figure 3 , in the testing process, for each to-be-detected sample (i.e., unlabeled data feature), a K-Nearest Neighbor (KNN) algorithm is used to search for nearest neighbor features in the Memory Bank; specifically, N nearest neighbor features are searched from the Memory Bank to construct a local feature library; and according to the similarity between the nearest neighbor features and the to-be-detected sample features, an anomaly score is calculated.

[0106] ​​​​As a specific example, in the paradigm of class-incremental learning, the test data of the c-th class in the s-th session is , and the corresponding feature set to be detected is . For each sample to be detected , the K-nearest neighbor method is used for anomaly detection. The application searches for the corresponding N nearest neighbors in the Memory Bank to construct a local feature library, and takes the average distance of the N nearest neighbors to perform anomaly detection on the feature patch of the test sample, where the feature patch to be detected is denoted as : , where is a distance calculation function (i.e., an Euclidean distance calculation function).

[0107] The average Euclidean distance is used to estimate the anomaly score: ; where is the original anomaly score of the sample to be detected , and is proportional to , that is, the greater the distance , the higher the anomaly score : ; is a global parameter used to control the influence of the exponential function; is an exponential function of the original anomaly score , and the exponential function is used to amplify the value of , especially when is large, the exponential function will significantly increase its value.

[0108] Step S240, detecting based on the at least one anomaly score to obtain an abnormal region.

[0109] In the example embodiment, detecting based on the at least one anomaly score to obtain an abnormal region includes:

[0110] determining whether the at least one anomaly score is within a preset index value range, and in response to the at least one anomaly score being greater than the preset index value range, regarding the at least one unlabeled data feature region corresponding to the at least one anomaly score greater than the preset index value range as the abnormal region.

[0111] In specific implementation, detecting based on the at least one anomaly score to obtain an abnormal region means:

[0112] Referring to Figure 3 , according to the anomaly score, it is determined whether the sample to be detected is abnormal, and the abnormal region is located, and finally the anomaly detection result is output, including anomaly determination and location of the abnormal region.

[0113] As a specific example, first, an anomaly score of each unlabeled data feature region is calculated, which reflects the degree of deviation of the feature region from the normal data distribution. Then, the anomaly scores are compared with a preset index value range to determine whether each feature region is abnormal. If at least one anomaly score exceeds the preset index value range, it indicates that the corresponding feature region has a significant difference from the normal sample, and therefore is marked as an abnormal region. This process allows the system to automatically identify and locate anomalies in the data without human intervention, thereby improving the automation and efficiency of anomaly detection.

[0114] It should be noted that the method of the embodiments of the present disclosure can be executed by a single device, such as a computer or a server, etc. The method of the embodiments can also be applied in a distributed scenario, and be completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only execute one or more steps in the method of the embodiments of the present disclosure, and the multiple devices can interact with each other to complete the method.

[0115] It should be noted that some embodiments of the present disclosure have been described above. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims can be performed in a different order than the order described above and still achieve desirable results. Additionally, the processes depicted in the figures do not necessarily require the particular order shown, or sequential order to achieve the desired results. In certain implementations, multitasking and parallel processing can be advantageous.

[0116] Based on the same inventive concept, the present disclosure also provides an anomaly detection device corresponding to any of the above-mentioned embodiment methods.

[0117] Reference Figure 5 , the anomaly detection device comprises:

[0118] The data feature determination module 510 is configured to determine unlabeled data of a to-be-detected task, perform local feature extraction on the unlabeled data, and obtain at least one unlabeled data feature.

[0119] The feature segment determination module 520 is configured to perform feature matching on the at least one unlabeled data feature through a pre-constructed feature matching model, and obtain at least one near-neighbor feature segment corresponding to the at least one unlabeled data feature.

[0120] The anomaly score determination module 530 is configured to perform distance calculation on the at least one unlabeled data feature and the at least one near-neighbor feature segment, and obtain at least one anomaly score corresponding to the at least one unlabeled data feature.

[0121] The abnormal region determination module 540 is configured to detect an abnormal region based on the at least one abnormal score.

[0122] In this example embodiment, the data feature determination module 510 is specifically configured to:

[0123] determine unlabeled data of a to-be-detected task, and perform local feature extraction on the unlabeled data to obtain at least one unlabeled data feature.

[0124] In this example embodiment, the feature segment determination module 520 is specifically configured to:

[0125] perform feature matching on the at least one unlabeled data feature through a pre-constructed feature matching model to obtain at least one nearest neighbor feature segment corresponding to the at least one unlabeled data feature; wherein the feature matching model is constructed through the following method: constructing a training unlabeled data sample set, performing feature extraction on a plurality of unlabeled data sample data of the training unlabeled data sample set based on a convolutional neural network to obtain a middle-level feature set of the training unlabeled sample data and a high-level feature set of the training unlabeled sample data; performing average pooling on the middle-level unlabeled sample data feature set to obtain a denoised feature set of the training unlabeled sample data; performing feature enhancement on the high-level unlabeled sample data feature set to obtain an enhanced feature set of the training unlabeled sample data; performing abnormal extraction on the denoised feature set of the training unlabeled sample data and the enhanced feature set of the training unlabeled sample data to obtain a pure feature set of the training unlabeled sample data; performing feature sampling on the pure feature set of the training unlabeled sample data to obtain a core feature set; constructing a global feature memory bank, storing the core feature set to the global feature memory bank to obtain the feature matching model.

[0126] In this example embodiment, the abnormal score determination module 530 is specifically configured to:

[0127] perform average distance calculation on distances between the at least one unlabeled data feature and the at least one nearest neighbor feature segment to obtain an average Euclidean distance, and estimate the average Euclidean distance to obtain the at least one abnormal score corresponding to the at least one unlabeled data feature.

[0128] In this example embodiment, the abnormal region determination module 540 is specifically configured to:

[0129] determining whether the at least one anomaly score is within a preset index value range, and in response to the at least one anomaly score being greater than the preset index value range, regarding the at least one un-labeled data feature region corresponding to the at least one anomaly score greater than the preset index value range as the anomaly region.

[0130] For the convenience of description, the above apparatus is described in various modules in terms of functions. Of course, the functions of the modules can be implemented in one or more software and / or hardware when implementing the present disclosure.

[0131] The apparatus of the above embodiments is used to implement the corresponding anomaly detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not described here again.

[0132] Based on the same inventive concept, the present disclosure also provides an electronic device corresponding to the method of any of the above embodiments, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the anomaly detection method of any of the above embodiments when executing the program.

[0133] Figure 6 A more specific hardware structure of an electronic device is shown in the embodiment, which can include a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other through the bus 1050 for communication within the device.

[0134] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, etc., for executing related programs to implement the technical solutions provided by the embodiments of the present disclosure.

[0135] The memory 1020 can be implemented by a ROM (Read Only Memory), a RAM (Random Access Memory), a static storage device, a dynamic storage device, etc. The memory 1020 can store an operating system and other application programs, and when the technical solutions provided by the embodiments of the present disclosure are implemented by software or firmware, the related program codes are stored in the memory 1020 and executed by the processor 1010.

[0136] The input / output interface 1030 is configured to connect an input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure) or externally connected to the device to provide corresponding functions. The input device can include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device can include a display, a speaker, a vibrator, an indicator light, etc.

[0137] The communication interface 1040 is configured to connect a communication module (not shown in the figure) to realize communication interaction between the device and other devices. The communication module can realize communication through a wired manner (such as USB, network cable, etc.) or through a wireless manner (such as mobile network, WIFI, Bluetooth, etc.).

[0138] The bus 1050 includes a channel to transmit information between various components (such as the processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040) of the device.

[0139] It should be noted that although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040, and the bus 1050, in the specific implementation process, the device can also include other components necessary for normal operation. In addition, those skilled in the art can understand that the above device can also only contain components necessary for implementing the embodiments of the present disclosure, and does not have to contain all the components shown in the figure.

[0140] The electronic device of the above embodiments is used to implement the corresponding anomaly detection method in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not repeated here.

[0141] Based on the same inventive concept, the disclosure also provides a non-transitory computer-readable storage medium storing computer instructions for causing the computer to execute the anomaly detection method according to any of the above embodiments.

[0142] The computer readable medium of the present embodiments includes permanent and non-permanent, removable and non-removable media, which can be implemented by any method or technology to store information. The information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible by a computing device.

[0143] The above non-transitory computer readable storage medium can be any available medium or data storage device that can be accessed by a computer, including but not limited to magnetic storage (e.g. floppy disk, hard disk, magnetic tape, magneto-optical disk (MO) and the like), optical storage (e.g. CD, DVD, BD, HVD and the like), and semiconductor memory (e.g. ROM, EPROM, EEPROM, non-volatile memory (NAND FLASH), solid state disk (SSD)) and the like.

[0144] The storage medium of the above embodiments stores computer instructions for causing the computer to perform the anomaly detection method as described in any of the above exemplary method embodiments, and has the beneficial effects of the corresponding method embodiments, which are not repeated here.

[0145] Based on the same inventive concept, the present disclosure also provides a computer program product comprising computer program instructions corresponding to the anomaly detection method described in any of the above embodiments. In some embodiments, the computer program instructions can be executed by one or more processors of a computer to cause the computer and / or the processor to perform the anomaly detection method described. The processor performing the corresponding step can belong to the corresponding execution subject corresponding to each step in each embodiment of the anomaly detection method.

[0146] The computer program product of the above embodiments is used to cause the computer and / or the processor to perform the anomaly detection method as described in any of the above embodiments, and has the beneficial effects of the corresponding method embodiments, which are not repeated here.

[0147] Those skilled in the art will appreciate that embodiments of the disclosure can be devised for a system, method, or computer program product. Accordingly, the disclosure can be embodied in hardware and / or in software (including firmware, resident software, micro-code, etc.) that runs on a processor such as a computerized platform. Furthermore, the disclosure can be embodied as computer-readable code carried on a computer readable medium of a computer program product. Such program code can be supplied to or downloaded into the computerized platform by, for example, such computer-readable media, a manufacturer of the computerized platform, or an owner of software.

[0148] Any combination of one or more computer readable medium can be utilized. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this document, a computer readable storage medium can be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0149] A computer readable signal medium can include a propagated data signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal can take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium can be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device.

[0150] Program code embodied on a computer readable medium can be transmitted using any appropriate medium, including but not limited to wireless, wire line, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0151] Computer program code for carrying out operations of the present disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider).

[0152] It should be understood that each block of the flowchart and / or block diagram illustrations, and combinations of blocks in the flowchart and / or block diagram illustrations, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0153] These computer program instructions can also be stored in a computer- readable medium that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable medium produce an article of manufacture including instructions which implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0154] The computer program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0155] Further, while operations of the present disclosure are described in a particular order in the figures, this is not meant to be limiting or to imply that the operations must be performed in the particular order, or that all of the illustrated operations must be performed to achieve the desired result. Rather, the steps depicted in the flowcharts can be changed, executed in a different order, omitted, combined, and / or divided into multiple steps. Additionally or alternatively, certain steps can be performed in parallel with one another.

[0156] The computer program product of the first aspect of the present application can comprise a computer readable storage medium having stored thereon instructions which, when executed by a computer, can cause the computer to carry out the steps of the above-described method. The computer program product of the first aspect of the present application can comprise a computer readable storage medium having stored thereon the computer program of the second aspect of the present application.

[0157] It should be noted that while the foregoing detailed description has set forth various embodiments of the devices of the actions for performance, no limitation of the scope of the application is intended by such division into modules or units. Indeed, one of ordinary skill in the art will recognize that a plurality of the described modules or units can be implemented as a single module or unit. Alternatively, one of ordinary skill in the art will also recognize that a module or unit described herein can be implemented as a plurality of separate modules or units.

[0158] It should be noted that the discussion of the above embodiments has been presented for purposes of clarity and that, therefore, many of the inventive concepts described above can be implemented in ways other than those specifically set forth herein. Numerous specific implementations are described herein in order to provide a thorough and enabling disclosure. It will be apparent, however, to those skilled in the art that embodiments in accordance with the present application can be practiced without limitations to these specific implementations. In this regard, this description does not pose a limitation on the scope of the application. Additionally, expressions of quantity such as "one," "another," "at least one," "one, but not both," and the like mean that there is one, at least one, but not both of something or something one time, and so on.

[0159] Further, to simplify illustration and discussion, and so as not to obscure the inventive embodiments, known power / ground connections of integrated circuits (ICs) and other components can or can not be shown in the provided figures. Furthermore, as is conventional in the art, some of the drawings can not be drawn to scale and / or to scale. Also, as is conventional in the art, some of the drawings can show devices in block diagram form, in order to avoid obscuring the inventive embodiments. This is also in consideration of the fact that the details regarding the implementation of the devices of these block diagrams are highly dependent on the platform to which the inventive embodiments are being implemented (i.e., these details should be well within the purview of one of ordinary skill in the art). Where specific details are set forth in order to describe an illustrative embodiment of the inventive embodiments, it should be apparent to one of ordinary skill in the art that the inventive embodiments can be practiced without, or with variation of, these specific details. The description is thus to be considered exemplary only and not restrictive.

[0160] While the present application has been described in connection with certain embodiments thereof, many modifications, substitutions, and alterations, thereof, will be apparent to those of ordinary skill in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) can use the embodiments discussed.

[0161] It is intended to encompass all such alternatives, modifications, and variations that fall within the broad scope of the appended claims. Accordingly, any one or more features of any element in the drawings, or the specification, can be combined to create modifications, equivalents, or alternatives.

[0162] While the principles of the disclosure have been described above in connection with specific embodiments, it is to be understood that this disclosure is not limited to the disclosed embodiments, but is instead applicable to various modifications and equivalent arrangements. The scope of the disclosure encompasses various modifications and equivalent arrangements. The scope of the appended claims encompasses all such modifications and arrangements.

Claims

1. A method for detecting anomalies, characterized in that: include: Determining unlabeled data for a task to be detected, performing local feature extraction on the unlabeled data, and obtaining at least one unlabeled data feature; Performing feature matching on the at least one unlabeled data feature using a pre-built feature matching model to obtain at least one neighboring feature segment corresponding to the at least one unlabeled data feature, wherein the feature matching model is built by the following method: Constructing a training unlabeled data sample set, performing feature extraction on a plurality of unlabeled data sample data in the unlabeled data sample set based on a convolutional neural network to obtain an initial feature set of the training unlabeled sample data, wherein the initial feature set of the training unlabeled sample data includes: a mid-level feature set of the training unlabeled sample data and a high-level feature set of the training unlabeled sample data; Performing average pooling on the mid-level unlabeled sample data feature set for training to obtain a denoised feature set of the unlabeled sample data for training; Performing feature enhancement on the training high-level unlabeled sample data feature set to obtain a training unlabeled sample data enhanced feature set; Performing anomaly extraction on the denoising feature set of the unlabeled training sample data and the enhanced feature set of the unlabeled training sample data to obtain a pure feature set of the unlabeled training sample data; Performing feature sampling on the pure feature set of the unlabeled sample data for training to obtain a core feature set; Constructing a global feature memory library, storing the core feature set in the global feature memory library, and obtaining the feature matching model; performing a distance calculation on the at least one unlabeled data feature and the at least one neighboring feature segment to obtain at least one anomaly score corresponding to the at least one unlabeled data feature; Detection is performed based on the at least one anomaly score to obtain an abnormal region.

2. The method according to claim 1, characterized in that The performing distance calculation on the at least one unlabeled data feature and the at least one neighboring feature segment to obtain at least one anomaly score corresponding to the at least one unlabeled data feature includes: Calculating an average distance between the at least one unlabeled data feature and the at least one neighboring feature segment to obtain an average Euclidean distance; The average Euclidean distance is estimated to obtain the at least one anomaly score corresponding to the at least one unlabeled data feature.

3. The method according to claim 1, characterized in that The detecting based on the at least one anomaly score to obtain an abnormal area includes: Determine whether the at least one anomaly score is within a preset indicator value range; in response to the at least one anomaly score being greater than the preset indicator value range, use the at least one unlabeled data feature region corresponding to the at least one anomaly score greater than the preset indicator value range as the anomaly region.

4. An abnormality detection device, characterized in that: include: a data feature determination module configured to determine unlabeled data for a task to be detected, perform local feature extraction on the unlabeled data, and obtain at least one unlabeled data feature; The feature segment determination module is configured to perform feature matching on the at least one unlabeled data feature using a pre-built feature matching model to obtain at least one neighboring feature segment corresponding to the at least one unlabeled data feature, wherein the feature matching model is constructed by the following method: Constructing a training unlabeled data sample set, performing feature extraction on a plurality of unlabeled data sample data in the unlabeled data sample set based on a convolutional neural network to obtain an initial feature set of the training unlabeled sample data, wherein the initial feature set of the training unlabeled sample data includes: a mid-level feature set of the training unlabeled sample data and a high-level feature set of the training unlabeled sample data; Performing average pooling on the mid-level unlabeled sample data feature set for training to obtain a denoised feature set of the unlabeled sample data for training; Performing feature enhancement on the training high-level unlabeled sample data feature set to obtain a training unlabeled sample data enhanced feature set; Performing anomaly extraction on the denoising feature set of the unlabeled training sample data and the enhanced feature set of the unlabeled training sample data to obtain a pure feature set of the unlabeled training sample data; Performing feature sampling on the pure feature set of the unlabeled sample data for training to obtain a core feature set; Constructing a global feature memory library, storing the core feature set in the global feature memory library, and obtaining the feature matching model; an anomaly score determination module, configured to perform a distance calculation between the at least one unlabeled data feature and the at least one neighboring feature segment to obtain at least one anomaly score corresponding to the at least one unlabeled data feature; The abnormal region determination module is configured to perform detection based on the at least one abnormality score to obtain an abnormal region.

5. An electronic device, characterized in that: The method comprises a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method according to any one of claims 1 to 3 is implemented.

6. A non-transitory computer-readable storage medium, characterized in that The non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to cause a computer to execute the method according to any one of claims 1 to 3.

7. A computer program product, characterized in that The method comprises computer program instructions, which, when executed on a computer, cause the computer to execute the method according to any one of claims 1 to 3.

Images