Abnormal information analysis early warning method and system based on association rule algorithm

Abstract

The invention discloses an abnormal information analysis early warning method and system based on an association rule algorithm, and relates to the technical field of information, and the method comprises the steps: collecting different types of data, inputting the data into an analysis model, marking a data source, and judging the association relationship between different data through the association rule algorithm; classifying and summarizing different input data into different databases, distributing corresponding recognition models, and carrying out multi-level anomaly recognition through a multi-level association rule algorithm; and according to an identification result, establishing an abnormity early warning model in combination with an association relationship among different data, judging an abnormal condition, and carrying out abnormity early warning. According to the invention, the data processing flow is optimized, and the anomaly recognition efficiency is improved; corresponding recognition models are formulated for different types of data, so that the recognition accuracy is improved; and a risk level indicating lamp is introduced, so that a user can quickly judge abnormal conditions, and powerful support is provided for practical application.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to an abnormal information analysis and early warning method and system based on an association rule algorithm. Background Art

[0002] In the field of information technology and big data analysis, association rule algorithms, as an important tool for mining potential relationships between data, have been widely used in various abnormal information monitoring systems. With the explosive growth of information volume, how to efficiently and accurately identify and warn of abnormal information has become a hot topic in current research. Although existing technologies can identify abnormal information to a certain extent, they still have many shortcomings when processing large-scale, multi-type data.

[0003] First, the existing technology is relatively simple in data correlation analysis, and often only judges the correlation between data based on simple statistical methods, making it difficult to explore the deep connection between data. In addition, for different types of data, the existing technology lacks effective classification and recognition models, resulting in low accuracy and efficiency in anomaly recognition. In terms of anomaly warning, the existing technology can usually only give simple anomaly prompts and lacks refined warnings for different risk levels. Specifically, the existing technology fails to fully utilize the multi-level analysis capabilities of the association rule algorithm, and the recognition and warning effects of abnormal information need to be improved.

[0004] In view of the above problems, the present invention proposes an abnormal information analysis and early warning method and system based on association rule algorithm. A complete abnormal early warning model is established. The present invention not only improves the accuracy of abnormal information identification, but also realizes refined and multi-level abnormal early warning according to the association relationship between different data, effectively making up for the shortcomings of the existing technology. Summary of the invention

[0005] In view of the above-mentioned existing problems, the present invention collects and analyzes different types of data, uses association rule algorithms to identify abnormal information, and establishes an early warning model based on the correlation between data to achieve early detection and early warning of potential risks, thereby reducing the losses caused by risks and improving the security and stability of the system.

[0006] In order to solve the above technical problems, an abnormal information analysis and early warning method based on association rule algorithm is proposed, including:

[0007] Collect different types of data and input them into the analysis model, mark the data sources, and determine the associations between different data through association rule algorithms. Classify the different input data into different databases, assign corresponding recognition models, and conduct multi-level anomaly recognition through multi-level association rule algorithms. Based on the recognition results and the associations between different data, establish an anomaly warning model to determine abnormal situations and conduct anomaly warnings.

[0008] As a preferred solution of the abnormal information analysis and early warning method based on association rule algorithm described in the present invention, wherein: the labeled data source includes collecting different types of data and classifying the data, including new input data, old input data and combined data;

[0009] Assign the corresponding recognition model to the analysis model trained with different types of data:

[0010] Allocating the new input data to a risk simulation identification model for risk simulation;

[0011] Allocating the old input data to an abnormal risk identification model for risk probability identification;

[0012] The combined data includes old input data carrying new input data, which is assigned to the association recognition model for anomaly recognition;

[0013] Anomalies are identified through a multi-level association rule algorithm, and the data sources of the identified abnormal data are marked with green, yellow, blue, and red risk level indicator lights.

[0014] As a preferred solution of the abnormal information analysis and early warning method based on the association rule algorithm described in the present invention, the determination of the association relationship between different data includes recording the item set A whose occurrence frequency exceeds the threshold in the collected data set, setting the support threshold S, and calculating the support S(A) of all items:

[0015] Among them, S(A) represents the calculation result of the importance of enhancing the support of item set A in the data set, Count(A) is the number of occurrences of statistical item set A in the entire data set, N is the total number of samples in the data set, and k is the adjustment factor;

[0016] After enhancing the support, the pseudo correlation of the data is eliminated:

[0017]

[0018] in, It represents the probability of item set B occurring given item set A; S(A∪B represents the frequency of occurrence of both item sets A and B in the data set; r is the rejection factor, which is used to extract from historical data. When S(A) is zero or less than zero, increasing r reduces the impact on confidence calculation;

[0019] When S(A) exceeds 0.1 and More than 0.7 indicates that the data are strongly correlated;

[0020] When S(A) is less than 0.1 and If it is greater than 0.5, it means that the data are weakly correlated;

[0021] When S(A) is greater than 0 and If it exceeds 0.5, it means that the data are anti-correlated;

[0022] When S(A) is less than 0.1 and A value lower than 0.1 indicates that there is no correlation between the data.

[0023] As a preferred solution of the abnormal information analysis and early warning method based on association rule algorithm described in the present invention, the risk simulation includes directly putting the new input data into the risk simulation database, performing risk simulation through the risk simulation identification model, and calculating the risk score RISK n ;

[0024] Define risk threshold TH RISK =1.5·μ(RISK n ), where μ(RISK n ) is the average risk score of all new input data. n >TH RISK If it is weakly correlated or uncorrelated with the remaining data, it will be considered a separate anomaly;

[0025] When RISK n >TH RISK If two strongly correlated data show anomalies at the same time, it is identified as a combined anomaly;

[0026] When RISK n >TH RISK If more than three data features show abnormal status at the same time, it is considered as a multiple coverage anomaly;

[0027] When data 1 shows abnormality, RISK 1 >TH RISK , but the directly related data 2 of data 1 does not show abnormality, that is, RISK 2 ≤TH RISK , and data 3 related to data 2 shows anomalies, that is, RISK3 >TH RISK , it is judged as interval abnormality.

[0028] As a preferred solution of the abnormal information analysis and early warning method based on association rule algorithm described in the present invention, the risk probability identification includes: inputting the old input data into the known risk database, calculating the risk probability P of the abnormality in the abnormal risk identification model o ;

[0029] When P o If the data is greater than the known risk threshold specified in the known risk database, it is considered that there is a potential problem of such risk, and the output is not allowed. The data is input into the abnormal warning model for abnormal information warning;

[0030] When P o If the known risk threshold specified in the known risk database is not exceeded, it is considered that there is no potential problem and the output is allowed to be input into the system normally for operation.

[0031] As a preferred solution of the abnormal information analysis and early warning method based on association rule algorithm described in the present invention, wherein: the association recognition model includes inputting the combined data into the association recognition model for abnormality recognition:

[0032]

[0033] Among them, F r (X) is the abnormal recognition value combined with the input data X, L is the number of features, Q l is the constant of the lth feature, a l (X) is the abnormality measure of the lth feature on the input data X;

[0034] When F r (X) greater than TH F When , it is judged as a single abnormality, and the single abnormal data is input into the abnormal warning model for abnormal information warning, and then the remaining data is used to judge multiple combined abnormal situations:

[0035]

[0036] Among them, F c (X,Y) is the combined abnormality identification value of the input data combination X and Y, F r (X) and F r (Y) are the anomaly identification values ​​of data X and Y, respectively, ν is the adjustment coefficient for adjusting the impact of combined anomalies, Z is the remaining data feature set combined with data X and Y, and F r (Z) is the anomaly recognition value of the z-th feature, and X∩Y represents the intersection of the two data sets X and Y;

[0037] Set multiple combination threshold TH c =g 1 ·μ(F c (X,Y))+g 2 ·σ(F c (X,Y)), where g 1 is the weight to adjust the expected value, μ is the expected value of the combined anomaly recognition value, g 2 To adjust the weight of the standard deviation, σ is the standard deviation of the combined anomaly identification value;

[0038] When F c (X,Y) is greater than TH c , it is judged as a multi-combination anomaly, and the specific combination anomaly is determined based on the correlation between the data.

[0039] As a preferred solution of the abnormal information analysis and early warning method based on association rule algorithm described in the present invention, the abnormal early warning model includes: when the new input data, the old input data and the combined data are judged to be abnormal or risky, the abnormal early warning model changes the indicator light: green, yellow, blue, red

[0040] The data source where the data that has not been input is located does not have an indicator light marked, indicating that there is no abnormality;

[0041] When the input data is a single anomaly, the data source of the positioning data is marked with a green light;

[0042] When the input data is abnormal in combination, the data source of the positioning data is marked with a yellow light;

[0043] When the input data is multi-coverage anomaly, the data source of the positioning data is marked with a blue light;

[0044] When the input data is abnormally spaced, the data source of the positioning data is marked with a red light.

[0045] Another object of the present invention is to provide an abnormal information analysis and early warning system based on an association rule algorithm. The present invention aims to timely discover abnormal situations in data, including single anomalies, combined anomalies, multi-coverage anomalies and interval anomalies; to issue early warnings for abnormal situations of different risks through early warning models to reduce potential risks and losses; to analyze the correlation between different data to help understand the background and possible impact of the occurrence of anomalies; to provide data support for decision makers to help make more accurate and effective decisions to improve the stability and security of the system.

[0046] As a preferred solution of the abnormal information analysis and early warning system based on the association rule algorithm described in the present invention, it is characterized by comprising a data marking module, an abnormality identification module, and an information early warning module;

[0047] The data labeling module collects different types of data and labels them by category, including new input data, old input data, and combined data; classifies the collected data by type and assigns it to the corresponding recognition model; assigns an identifier to each data source to track the source of the data in subsequent analysis;

[0048] The anomaly identification module uses the risk simulation identification model to perform risk simulation on the new input data, calculates the risk score, and determines whether there is an anomaly based on the risk threshold; uses the anomaly risk identification model to calculate the anomaly risk probability on the old input data to determine whether it exceeds the known risk threshold; uses the association identification model to perform anomaly identification on the combined data to determine whether there is a single anomaly or multiple combined anomalies; uses the multi-level association rule algorithm to analyze the association relationship between the data and perform segmented anomaly identification;

[0049] The information warning module uses the abnormal warning model to judge the abnormal situation according to the output results of the abnormal identification module and activates the warning mechanism; according to the type and severity of the abnormality, the data source is marked with green, yellow, blue and red risk level indicator lights to intuitively display the abnormal status.

[0050] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, the steps of the abnormal information analysis and early warning method based on an association rule algorithm are implemented.

[0051] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the abnormal information analysis and early warning method based on an association rule algorithm are implemented.

[0052] Beneficial effects of the present invention: The present invention realizes clear tracking of data sources, improves data processing accuracy and efficiency, optimizes the identification process, reduces false positives and false negatives, and enhances the adaptability and flexibility of the system. In particular, by eliminating pseudo-correlations by calculating support and confidence, and identifying various types of anomalies by calculating risk scores and risk probabilities, the present invention improves the reliability of data correlation judgment, enhances the system's ability to predict future risks, and provides users with more in-depth anomaly analysis, thereby improving the practicality and overall performance of the early warning system.

[0053] In the abnormal warning model, the present invention intuitively displays the abnormal level through the change of indicator lights. This step provides users with visual signals for quickly identifying risk levels, simplifies the user's understanding of abnormal information, and speeds up emergency response. By identifying single abnormalities, combined abnormalities, multi-coverage abnormalities, and interval abnormalities, and setting combined thresholds to judge specific combined abnormalities, the present invention not only achieves refined classification of abnormal situations, but also improves the granularity of abnormal identification, so that the early warning system can more accurately reflect risk conditions. These technical means work together to effectively reduce the losses that may be caused by abnormal situations, improve the accuracy of the early warning system and the user's emergency handling capabilities. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0055] Figure 1 An overall flow chart of an abnormal information analysis and early warning method based on an association rule algorithm provided by an embodiment of the present invention.

[0056] Figure 2 A system solution module diagram of an abnormal information analysis and early warning system based on an association rule algorithm provided by an embodiment of the present invention.

[0057] In the figure: 10, data labeling module; 20, anomaly identification module; 30, information warning module. DETAILED DESCRIPTION

[0058] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0059] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0060] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor is it an embodiment that is mutually exclusive with other embodiments, either individually or selectively.

[0061] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0062] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0063] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0064] Example 1, reference Figure 1 , which is the first embodiment of the present invention, and provides an abnormal information analysis and early warning method based on an association rule algorithm, comprising:

[0065] S1: Collect different types of data and input them into the analysis model, mark the data sources, and determine the association relationship between different data through association rule algorithms.

[0066] Furthermore, different types of data are collected and classified, including new input data, old input data, and combined data;

[0067] Assign the corresponding recognition model to the analysis model trained with different types of data:

[0068] Allocating the new input data to a risk simulation identification model for risk simulation;

[0069] Allocating the old input data to an abnormal risk identification model for risk probability identification;

[0070] The combined data includes old input data carrying new input data, which is assigned to the association recognition model for anomaly recognition;

[0071] Anomalies are identified through a multi-level association rule algorithm, and the data sources of the identified abnormal data are marked with green, yellow, blue, and red risk level indicator lights.

[0072] It should be noted that the item set A whose frequency of occurrence in the collected data set exceeds the threshold is recorded, the support threshold S is set, and the support S(A) of all items is calculated:

[0073]

[0074] Among them, S(A) represents the calculation result of the importance of enhancing the support of item set A in the data set, Count(A) is the number of occurrences of statistical item set A in the entire data set, N is the total number of samples in the data set, and k is the adjustment factor;

[0075] After enhancing the support, the pseudo correlation of the data is eliminated:

[0076]

[0077] in, It represents the probability of item set B occurring given item set A; S(A∪B represents the frequency of occurrence of both item sets A and B in the data set; r is the rejection factor, which is used to extract from historical data. When S(A) is zero or less than zero, increasing r reduces the impact on confidence calculation;

[0078] When S(A) exceeds 0.1 and More than 0.7 indicates that the data are strongly correlated;

[0079] When S(A) is less than 0.1 and If it is greater than 0.5, it means that the data are weakly correlated;

[0080] When S(A) is greater than 0 and If it exceeds 0.5, it means that the data are anti-correlated;

[0081] When S(A) is less than 0.1 and A value lower than 0.1 indicates that there is no correlation between the data.

[0082] S2: According to the different classifications of input data, they are summarized in different databases, and corresponding recognition models are assigned. Multi-level anomaly recognition is carried out through multi-level association rule algorithms.

[0083] Furthermore, the new input data is directly put into the risk simulation database, and the risk simulation is performed through the risk simulation identification model to calculate the risk score:

[0084]

[0085] Among them, RISK n For new input data D n The risk score is M, M is the number of data features, and w is i is the weight of the i-th feature, f i (D n ) is the i-th feature in the new input data D n The value on , α is the constant for adjusting the nonlinear term, T is the consideration for the change in time, is the mean of the new input data features;

[0086] Define risk threshold TH RISK =1.5·μ(RISK n ), where μ(RISK n ) is the average risk score of all new input data. n >TH RISK If it is weakly correlated or uncorrelated with the remaining data, it will be considered a separate anomaly;

[0087] When RISK n >TH RISK If two strongly correlated data show anomalies at the same time, it is identified as a combined anomaly;

[0088] When RISK n >TH RISK If more than three data features show abnormal status at the same time, it is considered as a multiple coverage anomaly;

[0089] When data 1 shows abnormality, RISK 1 >TH RISK , but the directly related data 2 of data 1 does not show abnormality, that is, RISK 2 ≤TH RISK , and data 3 related to data 2 shows anomalies, that is, RISK 3 >TH RISK , it is judged as interval abnormality.

[0090] It should be noted that the old input data is input into the known risk database, and the risk probability of abnormal occurrence is calculated in the abnormal risk identification model:

[0091]

[0092] Among them, P ois the risk probability of the old input data, fre o is the number of exceptions for the old input data, To take into account the attenuation factor of abnormal occurrence, λ is the attenuation constant, OV o is the data associated with the old input data, N o is the total number of old input data, m is the number of features of the old input data, d j (X) is the adjustment factor related to the jth feature, D o is the cumulative amount of the old data set;

[0093] When P o If the data is greater than the known risk threshold specified in the known risk database, it is considered that there is a potential problem of such risk, and the output is not allowed. The data is input into the abnormal warning model for abnormal information warning;

[0094] When P o If the known risk threshold specified in the known risk database is not exceeded, it is considered that there is no potential problem and the output is allowed to be input into the system normally for operation.

[0095] It should also be noted that the combined data is input into the association recognition model for anomaly recognition:

[0096]

[0097] Among them, F r (X) is the abnormal recognition value combined with the input data X, L is the number of features, Q l is the constant of the lth feature, a l (X) is the abnormality measure of the lth feature on the input data X;

[0098] When F r (X) greater than TH F When , it is judged as a single abnormality, and the single abnormal data is input into the abnormal warning model for abnormal information warning, and then the remaining data is used to judge multiple combined abnormal situations:

[0099]

[0100] Among them, F c (X,Y) is the combined abnormality identification value of the input data combination X and Y, F r (X) and F r (Y) are the anomaly identification values ​​of data X and Y, respectively, ν is the adjustment coefficient for adjusting the impact of combined anomalies, Z is the remaining data feature set combined with data X and Y, and F r (Z) is the anomaly recognition value of the z-th feature, and X∩Y represents the intersection of the two data sets X and Y;

[0101] Set multiple combination threshold THc =g 1 ·μ(F c (X,Y))+g 2 ·σ(F c (X,Y)), where g 1 is the weight to adjust the expected value, μ is the expected value of the combined anomaly recognition value, g 2 To adjust the weight of the standard deviation, σ is the standard deviation of the combined anomaly identification value;

[0102] When F c (X,Y) is greater than TH c , it is judged as a multi-combination anomaly, and the specific combination anomaly is determined based on the correlation between the data.

[0103] S3: Based on the recognition results and the correlation between different data, an abnormal warning model is established to determine abnormal situations and issue abnormal warnings.

[0104] Furthermore, when new input data, old input data, and combined data are judged to be abnormal or risky, the abnormal warning model changes the indicator light: green, yellow, blue, red

[0105] The data source where the data that has not been input is located does not have an indicator light marked, indicating that there is no abnormality;

[0106] When the input data is a single anomaly, the data source of the positioning data is marked with a green light;

[0107] When the input data is abnormal in combination, the data source of the positioning data is marked with a yellow light;

[0108] When the input data is multi-coverage anomaly, the data source of the positioning data is marked with a blue light;

[0109] When the input data is abnormally spaced, the data source of the positioning data is marked with a red light.

[0110] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0111] Embodiment 2, the second embodiment of the present invention, is different from the first two embodiments in that:

[0112] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, and other media that can store program codes.

[0113] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0114] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0115] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0116] Example 3, reference Figure 2 , which is the third embodiment of the present invention, and which provides an abnormal information analysis and early warning system based on an association rule algorithm, comprising a data marking module 10, an abnormality identification module 20, and an information early warning module 30;

[0117] The data labeling module 10 collects different types of data and labels them by category, including new input data, old input data, and combined data; classifies the collected data by type and assigns it to the corresponding recognition model; assigns an identifier to each data source to track the source of the data in subsequent analysis;

[0118] The anomaly identification module 20 uses the risk simulation identification model to perform risk simulation on the new input data, calculates the risk score, and determines whether there is an anomaly based on the risk threshold; uses the anomaly risk identification model to calculate the anomaly risk probability of the old input data to determine whether it exceeds the known risk threshold; uses the association identification model to perform anomaly identification on the combined data to determine whether there is a single anomaly or multiple combined anomalies; uses the multi-level association rule algorithm to analyze the association relationship between the data and perform segmented anomaly identification;

[0119] The information warning module 30 uses the abnormal warning model to judge the abnormal situation according to the output results of the abnormal identification module, and activates the warning mechanism; according to the type and severity of the abnormality, the data source is marked with green, yellow, blue and red risk level indicator lights to intuitively display the abnormal status.

[0120] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An abnormal information analysis and early warning method based on association rule algorithm, characterized by: include, Collect different types of data and input them into the analysis model, mark the data source, and use the association rule algorithm to determine the association relationship between different data; According to the different input data classification and induction in different databases, the corresponding recognition model is assigned, and multi-level anomaly recognition is carried out through multi-level association rule algorithm; Based on the recognition results and the correlation between different data, an abnormal warning model is established to judge abnormal situations and issue abnormal warnings.

2. The abnormal information analysis and early warning method based on association rule algorithm as claimed in claim 1, characterized in that: The labeling of data sources includes collecting different types of data and classifying the data, including new input data, old input data, and combined data; Assign the corresponding recognition model to the analysis model trained with different types of data: Allocating the new input data to a risk simulation identification model for risk simulation; Allocating the old input data to an abnormal risk identification model for risk probability identification; The combined data includes old input data carrying new input data, which is assigned to the association recognition model for anomaly recognition; Anomalies are identified through a multi-level association rule algorithm, and the data sources of the identified abnormal data are marked with green, yellow, blue, and red risk level indicator lights.

3. The abnormal information analysis and early warning method based on association rule algorithm as claimed in claim 2 is characterized by: The determination of the association relationship between different data includes recording the item set A whose occurrence frequency exceeds a threshold in the collected data set, setting a support threshold S, and calculating the support S(A) of all items: Among them, S(A) represents the calculation result of the importance of enhancing the support of item set A in the data set, Count(A) is the number of occurrences of statistical item set A in the entire data set, N is the total number of samples in the data set, and k is the adjustment factor; After enhancing the support, the pseudo correlation of the data is eliminated: in, It represents the probability of item set B occurring given item set A; S(A∪B represents the frequency of occurrence of both item sets A and B in the data set; r is the rejection factor, which is used to extract from historical data. When S(A) is zero or less than zero, increasing r reduces the impact on confidence calculation; When S(A) exceeds 0.1 and More than 0.7 indicates that the data are strongly correlated; When S(A) is less than 0.1 and If it is greater than 0.5, it means that the data are weakly correlated; When S(A) is greater than 0 and If it exceeds 0.5, it means that the data are anti-correlated; When S(A) is less than 0.1 and A value lower than 0.1 indicates that there is no correlation between the data.

4. The abnormal information analysis and early warning method based on association rule algorithm as claimed in claim 3 is characterized by: The risk simulation includes directly placing the new input data into the risk simulation database, performing risk simulation through the risk simulation identification model, and calculating the risk score RISK n ; Define risk threshold TH RISK =1.5·μ(RISK n ), where μ(RISK n ) is the average risk score of all new input data. n >TH RISK If it is weakly correlated or uncorrelated with the remaining data, it will be considered a separate anomaly; When RISK n >TH RISK If two strongly correlated data show anomalies at the same time, it is identified as a combined anomaly; When RISK n >TH RISK If more than three data features show abnormal status at the same time, it is considered as a multiple coverage anomaly; When data 1 shows abnormality, RISK1>TH RISK , but the direct correlation data 2 of data 1 does not show abnormality, that is, RISK2≤TH RISK , and data 3 related to data 2 shows abnormality, that is, RISK3>TH RISK , it is judged as interval abnormality.

5. The abnormal information analysis and early warning method based on association rule algorithm as claimed in claim 4 is characterized by: The risk probability identification includes inputting old input data into a known risk database and calculating the risk probability P of an abnormality in an abnormal risk identification model. o ; When P o If the data is greater than the known risk threshold specified in the known risk database, it is considered that there is a potential problem of such risk, and the output is not allowed. The data is input into the abnormal warning model for abnormal information warning; When P o If the known risk threshold specified in the known risk database is not exceeded, it is considered that there is no potential problem and the output is allowed to be input into the system normally for operation.

6. The abnormal information analysis and early warning method based on association rule algorithm as claimed in claim 5, characterized in that: The association recognition model includes inputting the combined data into the association recognition model for abnormality recognition: Among them, F r (X) is the abnormal recognition value combined with the input data X, L is the number of features, Q l is the constant of the lth feature, a l (X) is the abnormality measure of the lth feature on the input data X; When F r (X) greater than TH F When , it is judged as a single abnormality, and the single abnormal data is input into the abnormal warning model for abnormal information warning, and then the remaining data is used to judge multiple combined abnormal situations: Among them, F c (X,Y) is the combined abnormality identification value of the input data combination X and Y, F r (X) and F r (Y) are the anomaly identification values ​​of data X and Y, respectively, ν is the adjustment coefficient for adjusting the impact of combined anomalies, Z is the remaining data feature set combined with data X and Y, and F r (Z) is the anomaly recognition value of the z-th feature, and X∩Y represents the intersection of the two data sets X and Y; Set multiple combination threshold TH c =g1·μ(F c (X,Y))+g2·σ(F c (X,Y)), where g1 is the weight for adjusting the expected value, μ is the expected value of the combined anomaly recognition value, g2 is the weight for adjusting the standard deviation, and σ is the standard deviation of the combined anomaly recognition value; When F c (X,Y) is greater than TH c , it is judged as a multi-combination anomaly, and the specific combination anomaly is determined based on the correlation between the data.

7. The abnormal information analysis and early warning method based on association rule algorithm as claimed in claim 6, characterized in that: The abnormal warning model includes: when the new input data, the old input data and the combined data are judged to be abnormal or risky, the abnormal warning model changes the indicator light: green, yellow, blue, red The data source where the data that has not been input is located does not have an indicator light marked, indicating that there is no abnormality; When the input data is a single anomaly, the data source of the positioning data is marked with a green light; When the input data is abnormal in combination, the data source of the positioning data is marked with a yellow light; When the input data is multi-coverage anomaly, the data source of the positioning data is marked with a blue light; When the input data is abnormally spaced, the data source of the positioning data is marked with a red light.

8. A system using an abnormal information analysis and early warning method based on an association rule algorithm as claimed in any one of claims 1 to 7, characterized in that: Including data marking module, anomaly identification module, and information warning module; The data labeling module collects different types of data and labels them by category, including new input data, old input data, and combined data; classifies the collected data by type and assigns it to the corresponding recognition model; assigns an identifier to each data source to track the source of the data in subsequent analysis; The anomaly identification module uses the risk simulation identification model to perform risk simulation on the new input data, calculates the risk score, and determines whether there is an anomaly based on the risk threshold; Use the abnormal risk identification model to calculate the abnormal risk probability for the old input data to determine whether it exceeds the known risk threshold; Use the association recognition model to identify anomalies on the combined data to determine whether there are single anomalies or multiple combined anomalies; Use multi-level association rule algorithms to analyze the associations between data and perform segmented anomaly identification; The information warning module uses the abnormal warning model to judge the abnormal situation according to the output results of the abnormal identification module and activates the warning mechanism; according to the type and severity of the abnormality, the data source is marked with green, yellow, blue and red risk level indicator lights to intuitively display the abnormal status.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the abnormal information analysis and early warning method based on the association rule algorithm described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of an abnormal information analysis and early warning method based on an association rule algorithm as described in any one of claims 1 to 7 are implemented.

Images