Data detection method and device

Abstract

The invention discloses a data detection method and device, and relates to the technical field of artificial intelligence. A specific embodiment of the method comprises the steps of determining a feature vector of a target to-be-detected index according to an index feature of the target to-be-detected index and an association relationship between the target to-be-detected indexes, performing clustering operation based on the feature vector, and determining an abnormal index existing in data according to a clustering result; the problem that the accuracy of abnormal index detection is low due to the fact that relevance between the indexes is not considered is solved, the accuracy of data detection is improved, and the user experience is improved.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence technology, and in particular to a method and device for data detection. Background Art

[0002] In business operations, business managers (such as logistics business managers) can obtain data support for business management through various business-related indicator data, among which indicator data that are detected to be abnormal are an important part of the data required for business management.

[0003] At present, the methods for detecting abnormal indicator data mainly include mean square error method, box plot method and other statistical methods using numerical data. The existing methods for detecting abnormal indicators have the problem of low accuracy in detecting abnormal indicators because they only consider the indicator values ​​but not the correlation between indicators, which affects the user experience. Summary of the invention

[0004] In view of this, an embodiment of the present invention provides a method and device for data detection, which can determine the characteristic vector of the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the correlation between the target indicators to be detected, and perform clustering operations based on the characteristic vectors, and determine the abnormal indicators existing in the data according to the clustering results; overcome the problem of low accuracy in detecting abnormal indicators due to not considering the correlation between indicators, improve the accuracy of data detection, and enhance the user experience.

[0005] To achieve the above object, according to one aspect of an embodiment of the present invention, a method for data detection is provided, characterized in that it includes: acquiring multiple indicators to be detected in the data; determining at least two target indicators to be detected having an associated relationship among the multiple indicators to be detected;

[0006] For each of the target indicators to be detected, a feature vector is generated for the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the correlation relationship between the target indicators to be detected; a clustering operation is performed on the feature vectors of each of the target indicators to be detected, and based on the clustering results, the abnormal indicators existing in the data are determined, and the abnormal indicators are provided to the data management end.

[0007] Optionally, generating a feature vector for the target indicator to be detected based on the indicator characteristics of the target indicator to be detected and the correlation relationship between the target indicator to be detected includes: using a pre-trained graph neural network model to loop through the following operations until each target indicator to be detected is processed: selecting two of the target indicators to be detected from the multiple indicators to be detected, and when it is determined that the two indicators to be detected selected in the current cycle are target indicators to be detected that have a correlation relationship, generating an integrated feature vector based on the indicator characteristics of the two target indicators to be detected, otherwise executing the step of selecting two of the target indicators to be detected from the multiple indicators to be detected; multiplying the integrated feature vector with the transposed feature of a preset reference vector to obtain a similarity coefficient between the two target indicators to be detected; and updating the feature vector of each target indicator to be detected selected in the current cycle based on the similarity coefficient.

[0008] Optionally, determining at least two target indicators to be detected that have a correlation relationship among the multiple indicators to be detected includes: obtaining a preset direct correlation relationship between at least two of the indicators to be detected; based on the preset direct correlation relationship, judging whether there is an indirect correlation relationship between the multiple indicators to be detected associated with at least two of the preset direct correlation relationships; and, among the multiple indicators to be detected, determining the indicators to be detected that have a direct correlation relationship or an indirect correlation relationship as target indicators to be detected that have a correlation relationship.

[0009] Optionally, the characteristic vectors of each of the target indicators to be detected are clustered, and based on the clustering results, abnormal indicators present in the data are determined, including: for each of the target indicators to be detected, the characteristic vectors of the target indicators to be detected are clustered with a plurality of cluster clusters included in a pre-trained first cluster detection model, and the characteristic labels of the cluster clusters to which the target indicators to be detected belong are determined, and the characteristic labels are added to the target indicators to be detected; the characteristic vectors of at least two target indicators to be detected with characteristic labels are re-clustered using a pre-trained second cluster detection model to determine one or more cluster center points, and based on the cluster center points, the abnormal indicators present in the data are determined.

[0010] Optionally, determining abnormal indicators existing in the data based on the cluster center points includes: for each of the target indicators to be detected, calculating the distance between the target indicator to be detected and its corresponding cluster center point, and when the distance exceeds a preset distance threshold, determining that the target indicator to be detected is an abnormal indicator.

[0011] Optionally, the data detection method further includes: iteratively training the coefficient vector and preset reference vector contained in the graph neural network model using the indicator characteristics of the training indicators, so as to determine the integrated feature vector of the indicator characteristics of any two training indicators through the coefficient vector, and calculate the similarity coefficient of any two training indicators through the preset reference vector; using a first loss function to evaluate the training effect of the graph neural network model; wherein the first loss function is obtained by combining the structural loss function between the training indicators and the feature construction loss function of the training indicators.

[0012] Optionally, the data detection method further includes: iteratively training the first cluster detection model to be trained until a trained first cluster detection model is determined; for each iterative training cycle, using the first cluster detection model of the current iterative training cycle to perform a clustering operation on the indicator vector of the training indicator to obtain one or more reference cluster centers; calculating the distance from each training indicator to each of the reference cluster centers, and determining the cluster cluster to which the training indicator belongs based on the distance; constructing feature labels for the cluster clusters, and determining the feature labels of the cluster clusters as the feature labels of each training indicator contained in the cluster clusters.

[0013] Optionally, the data detection method further includes: obtaining training indicators with feature labels output by the first cluster detection model to be trained; using the training indicators with feature labels to train the second cluster detection model to be trained; and using a second loss function to evaluate the training effects of the first cluster detection model and the second cluster detection model, wherein the second loss function includes a similarity calculation relationship between the probability distribution obtained in the current iteration and the actual probability distribution.

[0014] Optionally, the data detection method further includes: encapsulating the graph neural network model used to generate feature vectors for the target indicators to be detected and the first clustering detection model and the second clustering detection model used to perform clustering operations on the feature vectors of each target indicator to be detected into one detection model.

[0015] Optionally, the data detection method further includes: constructing a model loss function of the detection model by combining a first loss function for evaluating the training effect of the graph neural network model and a second loss function for evaluating the training effects of the first cluster detection model and the second cluster detection model; wherein the model loss function includes weight coefficients corresponding to the first loss function and the second loss function; during the training process of the graph neural network model, the first cluster detection model and the second cluster detection model, adjusting the coefficient value of the weight coefficient of the first loss function or the second loss function to evaluate the balance effect between the graph neural network model, the first cluster detection model and the second cluster detection model.

[0016] To achieve the above-mentioned purpose, according to a second aspect of an embodiment of the present invention, a data detection device is provided, characterized in that it includes: an indicator relationship determination module, an indicator vector calculation module and an abnormal indicator determination module; wherein,

[0017] The indicator relationship determination module is used to obtain multiple indicators to be detected in the data; determine at least two target indicators to be detected that have an associated relationship among the multiple indicators to be detected;

[0018] The calculation indicator vector module is used to generate a feature vector for each target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the association relationship between the target indicators to be detected;

[0019] The abnormal indicator determination module is used to perform clustering operations on the feature vectors of each of the target indicators to be detected, determine the abnormal indicators existing in the data according to the clustering results, and provide the abnormal indicators to the data management terminal.

[0020] Optionally, the data detection device is used to generate a feature vector for the target indicator to be detected based on the indicator characteristics of the target indicator to be detected and the correlation relationship between the target indicator to be detected, including: using a pre-trained graph neural network model to loop through the following operations until each target indicator to be detected is processed: selecting two of the target indicators to be detected from the multiple indicators to be detected, and when it is determined that the two indicators to be detected selected in the current cycle are target indicators to be detected that have a correlation relationship, generating an integrated feature vector based on the indicator characteristics of the two target indicators to be detected, otherwise executing the step of selecting two of the target indicators to be detected from the multiple indicators to be detected; multiplying the integrated feature vector with the transposed feature of a preset reference vector to obtain a similarity coefficient between the two target indicators to be detected; and updating the feature vector of each target indicator to be detected selected in the current cycle based on the similarity coefficient.

[0021] Optionally, the data detection device is used to determine at least two target indicators to be detected that have a correlation relationship among the multiple indicators to be detected, including: obtaining a preset direct correlation relationship between at least two of the indicators to be detected; based on the preset direct correlation relationship, judging whether there is an indirect correlation relationship between the multiple indicators to be detected associated with at least two of the preset direct correlation relationships; among the multiple indicators to be detected, determining the indicators to be detected that have a direct correlation relationship or an indirect correlation relationship as target indicators to be detected that have a correlation relationship.

[0022] Optionally, the data detection device is used to perform clustering operations on the feature vectors of each of the target indicators to be detected, and determine the abnormal indicators present in the data based on the clustering results, including: for each of the target indicators to be detected, clustering the feature vector of the target indicator to be detected with multiple cluster clusters included in a pre-trained first cluster detection model, determining the feature labels of the cluster clusters to which the target indicator to be detected belongs, and adding the feature labels to the target indicator to be detected; using a pre-trained second cluster detection model to re-cluster the feature vectors of at least two target indicators to be detected with feature labels, determining one or more cluster center points, and determining the abnormal indicators present in the data based on the cluster center points.

[0023] Optionally, the data detection device is used to determine abnormal indicators existing in the data based on the cluster center point, including: for each of the target indicators to be detected, calculating the distance between the target indicator to be detected and its corresponding cluster center point, and when the distance exceeds a preset distance threshold, determining that the target indicator to be detected is an abnormal indicator.

[0024] Optionally, the data detection device is further used to iteratively train the coefficient vector and preset reference vector contained in the graph neural network model using the indicator characteristics of the training indicators, so as to determine the integrated feature vector of the indicator characteristics of any two training indicators through the coefficient vector, and calculate the similarity coefficient of any two training indicators through the preset reference vector; and evaluate the training effect of the graph neural network model using a first loss function; wherein the first loss function is obtained by combining the structural loss function between the training indicators and the feature construction loss function of the training indicators.

[0025] Optionally, the data detection device is further used to iteratively train the first cluster detection model to be trained until the trained first cluster detection model is determined; for each iterative training cycle, the indicator vector of the training indicator is clustered using the first cluster detection model of the current iterative training cycle to obtain one or more reference cluster centers; the distance from each training indicator to each of the reference cluster centers is calculated, and the cluster cluster to which the training indicator belongs is determined based on the distance; feature labels are constructed for the cluster clusters, and the feature labels of the cluster clusters are determined as the feature labels of the individual training indicators contained in the cluster clusters.

[0026] Optionally, the data detection device is further used to obtain training indicators with feature labels output by the first cluster detection model to be trained; use the training indicators with feature labels to train the second cluster detection model to be trained; and use a second loss function to evaluate the training effects of the first cluster detection model and the second cluster detection model, wherein the second loss function includes a similarity calculation relationship between the probability distribution obtained in the current iteration and the actual probability distribution.

[0027] Optionally, the data detection device is further used to encapsulate the graph neural network model used to generate feature vectors for the target indicators to be detected and the first clustering detection model and the second clustering detection model used to perform clustering operations on the feature vectors of each target indicator to be detected into one detection model.

[0028] Optionally, the data detection device is further used to construct a model loss function of the detection model by combining a first loss function for evaluating the training effect of the graph neural network model and a second loss function for evaluating the training effects of the first cluster detection model and the second cluster detection model; wherein the model loss function includes weight coefficients corresponding to the first loss function and the second loss function; during the training process of the graph neural network model, the first cluster detection model and the second cluster detection model, the coefficient value of the weight coefficient of the first loss function or the second loss function is adjusted to evaluate the balance effect between the graph neural network model, the first cluster detection model and the second cluster detection model.

[0029] To achieve the above-mentioned purpose, according to the third aspect of an embodiment of the present invention, there is provided an electronic device for data detection, characterized in that it comprises: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement any of the methods described in the above-mentioned data detection methods.

[0030] To achieve the above-mentioned purpose, according to a fourth aspect of an embodiment of the present invention, a computer-readable medium is provided, on which a computer program is stored, characterized in that when the program is executed by a processor, any method as described in the above-mentioned data detection method is implemented.

[0031] An embodiment of the above invention has the following advantages or beneficial effects: it can determine the characteristic vector of the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the correlation between the target indicators to be detected, and perform clustering operations based on the characteristic vectors, and determine the abnormal indicators existing in the data according to the clustering results; it overcomes the problem of low accuracy in detecting abnormal indicators due to not considering the correlation between indicators, improves the accuracy of data detection, and enhances user experience.

[0032] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0034] Figure 1 It is a flowchart of a data detection method provided by an embodiment of the present invention;

[0035] Figure 2 It is a schematic diagram of a flow chart of generating a characteristic vector of an indicator provided by an embodiment of the present invention;

[0036] Figure 3 It is a schematic diagram of a process of performing data detection using multiple models provided by an embodiment of the present invention;

[0037] Figure 4 is a structural schematic diagram of a data detection device provided by an embodiment of the present invention;

[0038] Figure 5 is an exemplary system architecture diagram to which embodiments of the present invention may be applied;

[0039] Figure 6 It is a schematic diagram of the structure of a computer system of a terminal device or a server suitable for implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0040] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0041] It should be noted that in the technical solution of the present invention, the collection, use, storage, sharing and transfer of user personal information involved are in compliance with the provisions of relevant laws and regulations, and it is necessary to inform the user and obtain the user's consent or authorization. When applicable, the user's personal information is de-identified and / or anonymized and / or encrypted.

[0042] After collecting the indicator data, we will de-identify the data through technical means. When displaying abnormal indicators, we will desensitize your information by de-identifying or anonymizing it to protect your information security.

[0043] In order to count the usage of our products / services, we will aggregate, analyze and use the technically processed user data and share the processed statistical information with third parties. We will use secure encryption technology and other methods to ensure that the recipient of the information cannot re-identify a specific individual.

[0044] like Figure 1 As shown, an embodiment of the present invention provides a method for data detection, which may include the following steps:

[0045] Step S101: Acquire multiple indicators to be detected in data; and determine at least two target indicators to be detected that have an associated relationship among the multiple indicators to be detected.

[0046] Specifically, the embodiments of the present invention process any application scenario including multiple data corresponding to indicators to be tested. For example, for logistics scenarios, it may include multiple indicators corresponding to order information and logistics distribution, such as order volume, shipment volume, vehicle congestion, express delivery rate, express delivery timeliness rate, unmet indicators and other indicators; for one application scenario, there may be thousands of indicators to be tested; for financial product scenarios, it may include multiple indicators for financial instrument processing, such as transaction volume, transaction volume growth rate, transaction limit trigger rate, transaction value and other indicators.

[0047] Further, according to the business corresponding to the application scenario, there is an association relationship between multiple indicators to be detected (for example, the association relationship is a calculation relationship, etc.), wherein the association relationship includes a direct association relationship and an indirect association relationship; for example: for the express delivery rate, the indicator c is used to represent, c = a / b, wherein a represents the delivered quantity indicator, and b represents the total express delivery quantity indicator to be delivered, then c and a, c and b have a direct association relationship; further, if the total express delivery quantity indicator is formed by the accumulation of the small item quantity indicator d and the large item quantity indicator e, expressed as: b = d+e; then b and d, b and e have a direct association relationship, and since c = a / b, it is determined that c and d, c and e have an indirect association relationship; it can be understood that for two indicators, it can be determined that the two indicators have an indirect association relationship through multiple layers (2 layers to N layers) of direct association relationships; that is, it is determined whether there is an indirect association relationship between the multiple indicators to be detected associated with at least two of the preset direct association relationships; wherein the direct association relationship and the indirect association relationship are both association relationships, and the indicator to be detected with an association relationship is the target indicator to be detected described in the embodiment of the present invention. Among them, the direct correlation relationship between the indicators to be detected can be preset according to the business in the application scenario. The preset method can store multiple calculation relationships between indicators through a data source or indicate the direct correlation relationship between indicators in the business process through text.

[0048] In one embodiment of the present invention, by obtaining a preset direct correlation relationship between at least two indicators to be detected among the indicators to be detected, an indirect correlation relationship between multiple indicators to be detected is calculated; specifically, the method for calculating the indirect correlation relationship between multiple indicators to be detected can be calculated by constructing an indicator relationship graph or by constructing an indicator adjacency matrix.

[0049] In the case of calculating the indirect association relationship based on constructing an indicator relationship graph, the indicator can be used as a node of the relationship graph, and the direct association relationship between the nodes can be used as an edge, so as to construct an indicator relationship graph containing each indicator to be detected; further, according to the indicator relationship graph, the indirect association relationship between the nodes can be derived based on at least two direct association relationships through traversal and calculation. After the indirect association relationship between each node is derived, the association relationship between each node can be represented by the target adjacency matrix for subsequent detection data processing.

[0050] In the case of calculating the indirect association relationship based on constructing the indicator adjacency matrix, an original adjacency matrix containing each indicator can be constructed, and the element value "1" or "0" of each element in the original adjacency matrix is ​​used to indicate the preset direct association relationship between the two indicators associated with the element; the following schematic adjacency matrix contains three indicators a, b, and c. Assuming that a and b, and a and c have a preset direct association relationship, the constructed original adjacency matrix is ​​expressed as follows;

[0051]

[0052] Further, when the number of indicators is large, the indirect association relationship between nodes can be further derived based on the element value "1" of the element in the constructed adjacency matrix. And the element value of the corresponding element in the original adjacency matrix is ​​updated according to the calculated indirect association relationship to obtain the target adjacency matrix. For example, in the original adjacency matrix, the element value of the element corresponding to a and d is "0", and the result of the derived calculation determines that a and d have an indirect association relationship, then the element value of the element corresponding to a and d is updated to "1"; that is, the target adjacency matrix contains each target indicator to be detected that has an association relationship (direct association relationship and indirect association relationship) among the indicators to be detected.

[0053] That is, determining at least two target indicators to be detected that have a correlation relationship among the multiple indicators to be detected includes: obtaining a preset direct correlation relationship between at least two of the indicators to be detected; based on the preset direct correlation relationship, judging whether there is an indirect correlation relationship between the multiple indicators to be detected associated with at least two of the preset direct correlation relationships; and among the multiple indicators to be detected, determining the indicators to be detected that have a direct correlation relationship or an indirect correlation relationship as target indicators to be detected that have a correlation relationship.

[0054] In the description of the embodiment of the present invention, the indicator to be detected and the target indicator to be detected both include the indicator and data corresponding to the indicator, and determining the abnormal indicator represents determining abnormal data appearing in a certain indicator in the data.

[0055] Step S102: for each of the target indicators to be detected, a feature vector is generated for the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the association relationship between the target indicators to be detected.

[0056] Specifically, after the target indicators to be detected having an associated relationship are determined, a corresponding feature vector is generated for each target indicator to be detected.

[0057] Furthermore, according to the indicator characteristics of the target indicator to be detected and the correlation relationship between the target indicator to be detected, a feature vector is generated for the target indicator to be detected. The indicator characteristics of the target indicator to be detected include, for example, multiple types of characteristics such as indicator value, indicator acquisition time and the value of the indicator with which the indicator has a correlation relationship.

[0058] In an embodiment of the present invention, a pre-trained graph neural network model is utilized, wherein the graph neural network model may include multiple neural network layers, and a feature vector of each target indicator to be detected is output by processing the indicator characteristics of the target indicator to be detected itself and the correlation between the target indicators to be detected.

[0059] The pre-trained graph neural network model in the embodiment of the present invention is, for example, as shown in formula (1):

[0060]

[0061] in, represents the feature vector of the target to be detected index i on the l+1th neural network layer, σ is the activation function of the current neural network layer (for example, a feedforward neural network), k ij represents the similarity coefficient calculated for the target to be detected, W is the parameter determined by model training, N i Represents the target indicator to be detected that has an associated relationship with the target indicator to be detected i.

[0062] k ij That is the similarity coefficient, which can be obtained by formula (2):

[0063]

[0064] Among them, C ij It can be a characteristic value indicating the association relationship between the target to-be-detected indicators i and j, for example: it is the element value of the corresponding position of the target to-be-detected indicator i and the target to-be-detected indicator j in the constructed target adjacency matrix, W i and W j are the matrix parameters determined by model training, The preset reference vector determined by model training; h i and h j It is the indicator feature of the target to be detected indicator i and the target to be detected indicator j, σ is the activation function in the neural network, and the activation function makes the linearization between the input and output of the neural network.

[0065] Through the graph neural network model (such as formula (1) and formula (2)), the indicator characteristics of the target indicator to be detected and the correlation relationship between the target indicator to be detected can be combined to calculate the feature vector of the target indicator to be detected, so as to perform subsequent operations to detect abnormal indicators based on the feature vector.

[0066] Step S103: performing a clustering operation on the feature vectors of each of the target indicators to be detected, determining abnormal indicators existing in the data according to the clustering results, and providing the abnormal indicators to the data management terminal.

[0067] Specifically, after calculating the characteristic vectors of each of the target indicators to be detected, a clustering operation is performed on the characteristic vectors of each of the target indicators to be detected, and based on the clustering results, the abnormal indicators present in the data are determined.

[0068] In an embodiment of the present invention, a pre-trained first clustering detection model and a pre-trained second clustering detection model are used to perform a clustering operation on the feature vectors of each target indicator to be detected, and the abnormal indicators existing in the data are determined according to the clustering results. The first clustering detection model takes the KMeans model as an example; the second clustering detection model takes the DBSCAN model as an example.

[0069] Furthermore, specifically, a pre-trained first clustering detection model is used to perform a clustering operation based on the feature vector of the target indicator to be detected, and the feature labels of each target indicator to be detected belonging to the cluster are determined according to the feature labels of the cluster cluster. The feature labels can be of various types divided according to the application scenarios, such as normal, abnormal, unknown, other, etc., or feature labels can be high, medium, low, invalid, etc.; further, the feature vector with the feature label is input into the second clustering detection model, and the clustering result of the second clustering detection model (DBSCAN) is used to determine the abnormal indicators existing in the data. Specifically, the second clustering detection model performs a clustering operation on the feature vector with the feature label to determine one or more cluster centers, and determines whether the distance between each target indicator to be detected and the cluster center exceeds the set threshold value. Determine whether there is an abnormality in the target indicator to be detected, that is, for each of the target indicators to be detected, perform a clustering operation on the feature vector of the target indicator to be detected and the multiple cluster clusters included in the pre-trained first cluster detection model, determine the feature label of the cluster cluster to which the target indicator to be detected belongs, and add the feature label to the target indicator to be detected; use the pre-trained second cluster detection model to re-cluster the feature vectors of at least two target indicators to be detected with feature labels, determine one or more cluster center points, and determine the abnormal indicators existing in the data based on the cluster center points. Wherein, determining the abnormal indicators existing in the data based on the cluster center points includes: for each of the target indicators to be detected, calculate the distance between the target indicator to be detected and its corresponding cluster center point, and determine the target indicator to be detected as an abnormal indicator when the distance exceeds a preset distance threshold.

[0070] Preferably, in an embodiment of the present invention, the graph neural network model used to generate the feature vector for the target to-be-detected indicator and the first clustering detection model and the second clustering detection model used to perform clustering operations on the feature vectors of each of the target to-be-detected indicators are encapsulated into one detection model. Thus, multiple target to-be-detected indicators can be input into the detection model, and the detection model can be used to output abnormal indicators.

[0071] The determined abnormal indicators are provided (eg, sent) to the data management end of the indicator to be detected, so that the data management end performs further statistics, analysis, and processing on the abnormal indicators to obtain data support for business management associated with the indicators.

[0072] The embodiments of the present invention detect abnormal indicators by sequentially processing data using multiple models included in the detection model, combining the indicator characteristics of the target indicator to be detected itself and the correlation between the target indicators to be detected, thereby overcoming the problem of low accuracy in detecting abnormal indicators due to failure to consider the correlation between indicators in existing detection methods, and improving user experience.

[0073] like Figure 2 As shown, an embodiment of the present invention provides a process for generating a characteristic vector of an indicator, and the process may include the following steps:

[0074] The following steps are executed repeatedly until the process ends:

[0075] Step S201: Select two indicators to be detected from a plurality of indicators to be detected.

[0076] Specifically, the description of the indicators to be detected is consistent with the description of step S101, and will not be repeated here. Further, any two indicators to be detected are selected from the multiple indicators to be detected; by selecting any two indicators to be detected, after multiple cycles, any two indicators to be detected are processed.

[0077] Step S202: Determine whether the two indicators to be detected have a correlation relationship. If yes, execute step S203; otherwise, execute step S201.

[0078] Specifically, the method for determining whether two to-be-detected indicators have a correlation relationship is consistent with the description of steps S101 - S102 , and will not be repeated here.

[0079] Step S203: generating an integrated feature vector according to the indicator features of the two target indicators to be detected.

[0080] Specifically, according to the indicator features of the two target indicators to be detected, the two indicator features are connected in series to generate an integrated feature vector.

[0081] Step S204: multiplying the integrated feature vector and the transposed feature of the preset reference vector to obtain a similarity coefficient of the two target indicators to be detected.

[0082] The following still uses formula (2) as an example to illustrate the calculation of the similarity coefficient in steps S203-S204; in formula (2), [W i h i ,W j h j ] represents the integrated feature vector generated by the target to be detected index i and the target to be detected index j; represents a preset reference vector; A transposed feature representing a preset reference vector; represents multiplying the integrated feature vector by the transposed feature of the preset reference vector; k ij Represents the similarity coefficient of the two target indicators to be detected.

[0083] In one embodiment of the present invention, taking the constructed target adjacency matrix indicating the correlation between the target indicators to be detected as an example, the obtained similarity coefficient can be multiplied with the element position corresponding to the two target indicators to be detected in the target adjacency matrix to determine the correlation between the two target indicators to be detected, and at the same time, one or more indicators to be detected that have no correlation in the target adjacency matrix are screened out to determine each target indicator to be detected that has a correlation.

[0084] Step S205: Based on the similarity coefficient, the feature vector of each target indicator to be detected selected in the current cycle is updated.

[0085] Specifically, based on the calculated similarity coefficient, the feature vector of each target indicator to be detected is updated, so as to obtain the feature vector of each target indicator to be detected. The updating of the feature vector of each target indicator to be detected based on the similarity coefficient can be described by formula (1). The description of formula (1) is consistent with the description of step S102 and will not be repeated here.

[0086] Step S206: Determine whether each indicator to be detected has been processed. If yes, execute step S207 to end the process; otherwise, execute step S201.

[0087] Step S207: End the process.

[0088] The description of step S201 to step S207 is: generating a feature vector for the target indicator to be detected according to the indicator feature of the target indicator to be detected and the association relationship between the target indicator to be detected, including:

[0089] Using a pre-trained graph neural network model, the following operations are performed in a loop until each target indicator to be detected is processed: two of the indicators to be detected are selected from the multiple indicators to be detected, and when it is determined that the two indicators to be detected selected in the current cycle are target indicators to be detected that have a correlation, an integrated feature vector is generated based on the indicator features of the two target indicators to be detected; otherwise, the step of selecting two indicators to be detected from the multiple indicators to be detected is performed; the integrated feature vector is multiplied by the transposed feature of a preset reference vector to obtain a similarity coefficient between the two target indicators to be detected; based on the similarity coefficient, the feature vector of each target indicator to be detected selected in the current cycle is updated.

[0090] like Figure 3 As shown, an embodiment of the present invention provides a process for performing data detection using multiple models, and the process may include the following steps:

[0091] Step S301: determining at least two target indicators to be detected that have an associated relationship among a plurality of indicators to be detected.

[0092] Step S302: using a pre-trained graph neural network model, generate a feature vector for the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the correlation relationship between the target indicator to be detected.

[0093] Step S303: clustering the feature vectors of each of the target indicators to be detected using the pre-trained first clustering detection model and the pre-trained second clustering detection model, and determining the abnormal indicators in the data based on the clustering results.

[0094] Specifically, in an embodiment of the present invention, the graph neural network model used to generate feature vectors for the target indicators to be detected and the first clustering detection model and the second clustering detection model used to perform clustering operations on the feature vectors of each target indicator to be detected are encapsulated into one detection model.

[0095] The following describes the model training steps for each model included in the detection model:

[0096] 1) For graph neural network models:

[0097] The coefficient vector and preset reference vector contained in the graph neural network model are iteratively trained using the indicator characteristics of the training indicators, so as to determine the integrated feature vector of the indicator characteristics of any two training indicators through the coefficient vector, and calculate the similarity coefficient of any two training indicators through the preset reference vector; the training effect of the graph neural network model is evaluated using a first loss function; wherein the first loss function is obtained by combining a structural loss function between training indicators and a feature construction loss function of the training indicators.

[0098] Formula (1) and formula (2), as well as the coefficient vector and preset reference vector contained in the training graph neural network model of the indicator characteristics of the training indicator, can be used. It can be understood that the indicator characteristics of the training indicator and the indicator to be detected belong to the same application scenario, and the data of the training indicator (indicator characteristics) can be obtained from the historical data of the indicator data source. The indicator to be detected can be the indicator data within the most recent set time range in the indicator data source. In the iterative training, the training W i and W j , i.e., training vector coefficients, and training That is, the preset reference vector for training. During the training process, the integrated feature vector of the indicator features of any two training indicators is determined by the coefficient vector, and the similarity coefficient of any two training indicators is calculated by the preset reference vector.

[0099] Furthermore, the training effect of the graph neural network model is evaluated using a first loss function; wherein the first loss function is obtained by combining a structural loss function between training indicators and a feature construction loss function of training indicators. For example, L1 is used to represent the first loss function, and the calculation formula of L1 is shown as follows:

[0100]

[0101] Among them, A represents the structural loss function between training indicators, The features representing the training metrics are used to construct the loss function.

[0102] 2) For the first cluster detection model and the second cluster detection model

[0103] Specifically, since the second cluster detection model further performs clustering processing through the feature labels output by the first cluster detection model to obtain abnormal indicators, the training of the first cluster detection model and the second cluster detection model are combined during training.

[0104] Iteratively train the first cluster detection model to be trained until the trained first cluster detection model is determined; for each iterative training cycle, cluster the indicator vector of the training indicator using the first cluster detection model of the current iterative training cycle to obtain one or more reference cluster centers; calculate the distance from each training indicator to each of the reference cluster centers, and determine the cluster cluster to which the training indicator belongs based on the distance; construct feature labels for the cluster clusters, and determine the feature labels of the cluster clusters as the feature labels of each training indicator contained in the cluster cluster. Wherein, the first cluster detection model is, for example, a KMeans cluster model. During training, k indicators are randomly selected from each training indicator as the center of the cluster cluster for the first time, and then the distance between each training indicator and the center of the k cluster clusters is calculated, for example, the calculated Euclidean distance is used as the distance; then for each training indicator, it is divided into the cluster cluster with the closest distance to it; and the feature label of each cluster cluster is updated based on the indicator characteristics of the training indicator. Further, k trained cluster clusters and cluster centers are obtained through iterative training.

[0105] Furthermore, the training indicators with feature labels output by the first cluster detection model to be trained are obtained; the second cluster detection model to be trained is trained using the training indicators with feature labels; specifically, the second cluster detection model (such as the DBSCAN clustering model) is used to re-cluster the feature vectors of at least two training indicators with feature labels based on data density, and after the clustering operation, one or more cluster center points can be determined, and according to the distance between the cluster center point and the training indicator and the cluster center point, according to the distance and a preset abnormal distance threshold, the abnormal indicator present in the data is determined.

[0106] Furthermore, a second loss function is used to evaluate the training effect of the first cluster detection model and the second cluster detection model, wherein the second loss function includes a similarity calculation relationship between the probability distribution obtained in the current iteration and the actual probability distribution.

[0107] The second loss function can be expressed as: L 2 =KL(P||Q), where L 2 represents the second loss function, KL divergence (Kullback-Leibler divergence) represents the similarity calculation relationship; P and Q represent the calculated probability distribution and the actual probability distribution in the current iterative training, respectively, where the actual probability distribution can be determined based on the probability distribution obtained by multiple iterative trainings (for example, every 5 trainings).

[0108] Further preferably, in an embodiment of the present invention, in a training detection model, a first loss function for evaluating the training effect of the graph neural network model and a second loss function for evaluating the training effects of the first cluster detection model and the second cluster detection model are combined to construct a model loss function of the detection model; wherein the model loss function includes weight coefficients corresponding to the first loss function and the second loss function; during the training process of the graph neural network model, the first cluster detection model and the second cluster detection model, the coefficient value of the weight coefficient of the first loss function or the second loss function is adjusted to evaluate the balance effect between the graph neural network model, the first cluster detection model and the second cluster detection model.

[0109] The model loss function of the detection model is constructed, for example, using L = L 1 +αL 2 Indicates that, L 1 Represents the first loss function, L 2 Represents the second loss function; α represents the weight coefficient; in the process of training various models, the balance effect between the graph neural network model, the first cluster detection model and the second cluster detection model is evaluated by adjusting the weight coefficient to determine the optimal detection model.

[0110] like Figure 4 As shown, the embodiment of the present invention provides a data detection device 400, including: an indicator relationship determination module 401, an indicator vector calculation module 402 and an abnormal indicator determination module 403; wherein,

[0111] The indicator relationship determination module 401 is used to obtain multiple indicators to be detected in the data; determine at least two target indicators to be detected that have an associated relationship among the multiple indicators to be detected;

[0112] The calculation indicator vector module 402 is used to generate a feature vector for each target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the association relationship between the target indicators to be detected;

[0113] The abnormal index determination module 403 is used to perform a clustering operation on the feature vectors of each target indicator to be detected, determine the abnormal index existing in the data according to the clustering result, and provide the abnormal index to the data management terminal.

[0114] An embodiment of the present invention also provides an electronic device for data detection, comprising: one or more processors; a storage device for storing one or more programs, when the one or more programs are executed by the one or more processors, the one or more processors implement the method provided in any of the above embodiments.

[0115] An embodiment of the present invention further provides a computer-readable medium on which a computer program is stored. When the program is executed by a processor, the method provided in any of the above embodiments is implemented.

[0116] Figure 5 An exemplary system architecture 500 is shown to which the method or apparatus for data detection according to the embodiment of the present invention may be applied.

[0117] like Figure 5 As shown, system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505. Network 504 is used to provide a medium for communication links between terminal devices 501, 502, 503 and server 505. Network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0118] Users can use terminal devices 501, 502, 503 to interact with server 505 through network 504 to receive or send messages, etc. Various client applications can be installed on terminal devices 501, 502, 503, such as e-commerce client applications, web browser applications, search applications, financial applications, etc.

[0119] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting various client applications, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0120] The server 505 may be a server that provides various services, such as a background management server that provides support for client applications used by users using the terminal devices 501, 502, and 503. The background management server may process the received request for detection data and feed back abnormal indicator information determined from the data to the terminal device.

[0121] It should be noted that the data detection method provided in the embodiment of the present invention is generally executed by the server 505 , and accordingly, the data detection device is generally set in the server 505 .

[0122] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0123] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of a terminal device suitable for implementing an embodiment of the present invention. Figure 6The terminal device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0124] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0125] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed, so that a computer program read therefrom is installed into the storage section 608 as needed.

[0126] In particular, according to the embodiments disclosed in the present invention, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present invention include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit (CPU) 601, the above-mentioned functions defined in the system of the present invention are executed.

[0127] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0128] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0129] The modules and / or units involved in the embodiments of the present invention may be implemented in software or hardware. The modules and / or units described may also be arranged in a processor, for example, they may be described as: a processor includes a module for determining an indicator relationship, a module for calculating an indicator vector, and a module for determining an abnormal indicator. The names of these modules do not, in some cases, constitute a limitation on the module itself, for example, the module for determining an indicator relationship may also be described as "a module for determining at least two target indicators to be detected that have an associated relationship among multiple indicators to be detected".

[0130] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently without being assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by a device, the device includes: obtaining multiple indicators to be detected in the data; determining at least two target indicators to be detected with an associated relationship among the multiple indicators to be detected; for each of the target indicators to be detected, generating a feature vector for the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the associated relationship between the target indicators to be detected; performing clustering operations on the feature vectors of each target indicator to be detected, determining the abnormal indicators existing in the data according to the clustering results, and providing the abnormal indicators to the data management terminal.

[0131] The embodiments of the present invention determine the characteristic vector of the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the correlation between the target indicators to be detected, perform clustering operations based on the characteristic vectors, and determine the abnormal indicators present in the data according to the clustering results; thereby overcoming the problem of low accuracy in detecting abnormal indicators due to failure to consider the correlation between the indicators, improving the accuracy of data detection, and enhancing the user experience.

[0132] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A method for data detection, characterized in that: include: Obtain multiple indicators to be detected in the data; Determining at least two target indicators to be detected that have an associated relationship among the multiple indicators to be detected; For each of the target indicators to be detected, generating a feature vector for the target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the association relationship between the target indicators to be detected; A clustering operation is performed on the feature vectors of each of the target indicators to be detected, and based on the clustering results, an abnormal indicator existing in the data is determined, and the abnormal indicator is provided to the data management terminal.

2. The method according to claim 1, characterized in that: The generating a feature vector for the target indicator to be detected according to the indicator feature of the target indicator to be detected and the association relationship between the target indicator to be detected includes: Using the pre-trained graph neural network model, the following operations are performed repeatedly until each target indicator to be detected is processed: Selecting two of the indicators to be detected from the multiple indicators to be detected, generating an integrated feature vector according to the indicator features of the two target indicators to be detected according to the condition that the two indicators to be detected selected in the current cycle are target indicators to be detected with an associated relationship, otherwise executing the step of selecting two of the indicators to be detected from the multiple indicators to be detected; Multiplying the integrated feature vector and the transposed feature of the preset reference vector to obtain a similarity coefficient of the two target indicators to be detected; Based on the similarity coefficient, the feature vector of each target indicator to be detected selected in the current cycle is updated.

3. The method according to claim 1, characterized in that The step of determining at least two target indicators to be detected having an associated relationship among the multiple indicators to be detected includes: Obtaining a preset direct correlation relationship between at least two of the indicators to be detected; Based on the preset direct association relationship, determining whether there is an indirect association relationship between the multiple indicators to be detected associated with at least two of the preset direct association relationships; Among the multiple indicators to be detected, indicators to be detected that have a direct correlation relationship or an indirect correlation relationship are determined as target indicators to be detected that have a correlation relationship.

4. The method according to claim 1, characterized in that The clustering operation is performed on the feature vectors of each target indicator to be detected, and according to the clustering result, the abnormal indicator existing in the data is determined, including: For each of the target indicators to be detected, a clustering operation is performed on the feature vector of the target indicator to be detected and a plurality of cluster clusters included in the pre-trained first cluster detection model, a feature label of the cluster cluster to which the target indicator to be detected belongs is determined, and the feature label is added to the target indicator to be detected; The pre-trained second clustering detection model is used to re-cluster the feature vectors of at least two target indicators to be detected with feature labels, determine one or more cluster center points, and determine the abnormal indicators existing in the data based on the cluster center points.

5. The method according to claim 4, characterized in that Determining the abnormal indicators existing in the data according to the cluster center point includes: For each of the target indicators to be detected, the distance between the target indicator to be detected and its corresponding cluster center point is calculated, and when the distance exceeds a preset distance threshold, the target indicator to be detected is determined to be an abnormal indicator.

6. The method according to claim 2, characterized in that Further including: Iteratively train the coefficient vector and the preset reference vector contained in the graph neural network model using the indicator characteristics of the training indicators, so as to determine the integrated feature vector of the indicator characteristics of any two training indicators through the coefficient vector, and calculate the similarity coefficient of any two training indicators through the preset reference vector; A first loss function is used to evaluate the training effect of the graph neural network model; wherein the first loss function is obtained by combining a structural loss function between training indicators and a feature construction loss function of training indicators.

7. The method according to claim 3, characterized in that Further including: Iteratively training the first cluster detection model to be trained until a trained first cluster detection model is determined; For each iterative training cycle, clustering operation is performed on the indicator vector of the training indicator using the first cluster detection model of the current iterative training cycle to obtain one or more reference cluster centers; Calculate the distance from each training indicator to each reference cluster center, and determine the cluster to which the training indicator belongs based on the distance; construct feature labels for the clusters, and determine the feature labels of the clusters as the feature labels of each training indicator contained in the clusters.

8. The method according to claim 7, characterized in that Further including: Obtaining a training indicator with a feature label output by the first cluster detection model to be trained; Training a second cluster detection model to be trained using a training indicator with feature labels; A second loss function is used to evaluate the training effect of the first cluster detection model and the second cluster detection model, wherein the second loss function includes a similarity calculation relationship between the probability distribution obtained in the current iteration and the actual probability distribution.

9. The method according to claim 1, characterized in that: Further including: The graph neural network model used to generate feature vectors for the target indicators to be detected and the first clustering detection model and the second clustering detection model used to perform clustering operations on the feature vectors of each target indicator to be detected are encapsulated into one detection model.

10. The method according to claim 9, characterized in that Further including: Combining a first loss function for evaluating the training effect of the graph neural network model and a second loss function for evaluating the training effects of the first cluster detection model and the second cluster detection model, constructing a model loss function of the detection model; wherein the model loss function includes weight coefficients corresponding to the first loss function and the second loss function; During the training process of the graph neural network model, the first cluster detection model and the second cluster detection model, the coefficient value of the weight coefficient of the first loss function or the second loss function is adjusted to evaluate the balance effect between the graph neural network model, the first cluster detection model and the second cluster detection model.

11. A data detection device, characterized in that: include: Determine the indicator relationship module, calculate the indicator vector module and determine the abnormal indicator module; Among them, The indicator relationship determination module is used to obtain multiple indicators to be detected in the data; determine at least two target indicators to be detected that have an associated relationship among the multiple indicators to be detected; The calculation indicator vector module is used to generate a feature vector for each target indicator to be detected according to the indicator characteristics of the target indicator to be detected and the association relationship between the target indicators to be detected; The abnormal indicator determination module is used to perform clustering operations on the feature vectors of each of the target indicators to be detected, determine the abnormal indicators existing in the data according to the clustering results, and provide the abnormal indicators to the data management terminal.

12. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 10.

13. A computer readable medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 10 is implemented.

Images