Data anomaly detection method and device, computer equipment, computer readable storage medium and computer program product

Abstract

The invention relates to a data anomaly detection method and device, computer equipment, a computer readable storage medium and a computer program product. Relates to the technical field of data processing. The method comprises the following steps: acquiring initial data information of at least two modes; using forward diffusion to add noise to the initial data information of each mode so as to remove preset mode features of each mode and obtain corresponding similar mode information; restoring preset modal features of the similar modal information by using back diffusion to obtain corresponding target data information, and aligning modal data corresponding to the preset modal features on the basis of the modal data corresponding to the preset modal features; utilizing an attention mechanism to identify a preset key area of each piece of aligned target data information; and obtaining a residual value of the target data information in each preset key area through residual detection, and determining abnormal data in the corresponding initial data information according to the residual value. By adopting the method, the detection efficiency of the data anomaly detection method can be improved.

Description

Technical Field

[0001] The present application relates to the technical field of data processing, and particularly to a method, device, computer device, computer-readable storage medium, and computer program product for data anomaly detection. Background Art

[0002] Since the training of high-performance artificial intelligence models relies on a large amount of data, and data poisoning attacks are the main means of polluting the underlying data of intelligent services, there have emerged attackers who poison the data. They mainly inject malicious data during the data collection stage, causing the data distribution to skew, thereby disrupting the data analysis results and achieving the attack purpose.

[0003] Currently, the detection methods for data poisoning attacks mainly focus on image-type data and cannot uniformly process different types of data simultaneously. Moreover, to ensure the security of the data set, defense technologies are mainly adopted, which reduces the usability of the data and wastes resources. Therefore, the current data anomaly detection methods have the problem of low detection efficiency. Summary of the Invention

[0004] Based on this, in view of the technical problem of low detection efficiency existing in the above data anomaly detection method, it is necessary to provide a method, device, computer device, computer-readable storage medium, and computer program product for data anomaly detection.

[0005] In a first aspect, the present application provides a method for data anomaly detection, including:

[0006] Obtain initial data information of at least two modalities; the modality represents the type of the initial data information;

[0007] Use the forward diffusion of the diffusion model to add noise to the initial data information of each modality to remove the preset modality features in the initial data information of each modality, and obtain corresponding similar modality information;

[0008] Use the reverse diffusion of the diffusion model to restore the preset modality features of each similar modality information to obtain corresponding target data information, and align the target data information of each modality based on the modality data corresponding to the preset modality features; the modality data is updated in real time based on the diffusion model;

[0009] Use the attention mechanism to identify the preset key regions of each aligned target data information;

[0010] Obtain the residual values of the target data information in each preset key region through residual detection, and determine the abnormal data in the corresponding initial data information according to the residual values.

[0011] In one embodiment, the forward diffusion using the diffusion model adds noise to the initial data information of each modality respectively, including: for the initial data information of each modality, based on a preset noise addition rule and a preset number of steps, gradually add the noise to the corresponding initial data information.

[0012] In one embodiment, the reverse diffusion using the diffusion model restores the preset modal features of each of the similar modality information, including: for the initial data information of each modality after adding the noise, based on a preset noise removal rule and the preset number of steps, gradually remove the noise in the similar modality information to restore the preset modal features of each of the similar modality information.

[0013] In one embodiment, obtaining the residual value of the target data information in each of the preset key regions through residual detection includes: based on the preset modal features of the target data information in each of the preset key regions and the features of the target data information in each of the preset key regions at each of the preset number of steps, obtain the residual value.

[0014] In one embodiment, determining the abnormal data in the corresponding initial data information according to the residual value includes: comparing the magnitudes of the residual values with a preset residual threshold, and determining the abnormal data in the corresponding initial data information based on the comparison result.

[0015] In one embodiment, determining the abnormal data in the corresponding initial data information based on the comparison result includes: in the case where the comparison result is that the residual value is greater than the preset residual threshold, determining the initial data information corresponding to the residual value as the abnormal data.

[0016] In a second aspect, the present application further provides a data anomaly detection device, including:

[0017] An information acquisition module, configured to acquire initial data information of at least two modalities; the modality represents the type of the initial data information;

[0018] A noise addition module, configured to use the forward diffusion of the diffusion model to add noise to the initial data information of each modality respectively, so as to remove the preset modal features in the initial data information of each modality and obtain corresponding similar modality information respectively;

[0019] A feature recovery module, configured to use the reverse diffusion of the diffusion model to recover the preset modal features of each piece of the similar modal information, so as to obtain corresponding target data information respectively, and align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model;

[0020] An information recognition module, configured to use an attention mechanism to recognize preset key regions of each piece of the aligned target data information;

[0021] A result determination module, configured to obtain a residual value of the target data information in each preset key region through residual detection, and determine abnormal data in the corresponding initial data information according to the residual value.

[0022] In a third aspect, the present application further provides a computer device, which includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0023] Obtain initial data information of at least two modalities; the modality represents the type of the initial data information;

[0024] Use the forward diffusion of the diffusion model to add noise to the initial data information of each modality respectively, so as to remove the preset modal features in the initial data information of each modality, and obtain corresponding similar modal information respectively;

[0025] Use the reverse diffusion of the diffusion model to recover the preset modal features of each piece of the similar modal information, so as to obtain corresponding target data information respectively, and align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model;

[0026] Use an attention mechanism to recognize preset key regions of each piece of the aligned target data information;

[0027] Obtain a residual value of the target data information in each preset key region through residual detection, and determine abnormal data in the corresponding initial data information according to the residual value.

[0028] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0029] Obtain initial data information of at least two modalities; the modality represents the type of the initial data information;

[0030] The forward diffusion of the diffusion model adds noise to the initial data information of each modality respectively to remove the preset modality features in the initial data information of each modality, and obtains the corresponding similar modality information respectively;

[0031] The reverse diffusion of the diffusion model is used to restore the preset modality features of each of the similar modality information to obtain the corresponding target data information respectively, and align the target data information of each modality based on the modality data corresponding to the preset modality features; the modality data is updated in real time based on the diffusion model;

[0032] The attention mechanism is used to identify the preset key regions of each of the aligned target data information;

[0033] The residual values of the target data information in each of the preset key regions are obtained through residual detection, and the abnormal data in the corresponding initial data information is determined according to the residual values.

[0034] In a fifth aspect, the present application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the following steps are implemented:

[0035] Obtain the initial data information of at least two modalities; the modality represents the type of the initial data information;

[0036] The forward diffusion of the diffusion model adds noise to the initial data information of each modality respectively to remove the preset modality features in the initial data information of each modality, and obtains the corresponding similar modality information respectively;

[0037] The reverse diffusion of the diffusion model is used to restore the preset modality features of each of the similar modality information to obtain the corresponding target data information respectively, and align the target data information of each modality based on the modality data corresponding to the preset modality features; the modality data is updated in real time based on the diffusion model;

[0038] The attention mechanism is used to identify the preset key regions of each of the aligned target data information;

[0039] The residual values of the target data information in each of the preset key regions are obtained through residual detection, and the abnormal data in the corresponding initial data information is determined according to the residual values.

[0040] The above data anomaly detection method, device, computer equipment, storage medium and computer program product, in the process of data anomaly detection, first obtain initial data information of at least two modalities; the modality represents the type of the initial data information; then use the forward diffusion of the diffusion model to add noise to the initial data information of each modality respectively to remove the preset modality features in the initial data information of each modality, and obtain the corresponding similar modality information respectively; then use the reverse diffusion of the diffusion model to restore the preset modality features of each similar modality information to obtain the corresponding target data information respectively, and align the target data information of each modality based on the modality data corresponding to the preset modality features; the modality data is updated in real time based on the diffusion model; then use the attention mechanism to identify the preset key regions of each aligned target data information; finally, obtain the residual values of the target data information in each preset key region through residual detection, and determine the abnormal data in the corresponding initial data information according to the residual values. In the above process, by adding noise to the initial data information to remove the preset modality features and restoring the similar modality information, data alignment between different modalities can be achieved, and the integration ability between modalities can be improved; after using the reverse diffusion of the diffusion model to restore the preset modality features, more realistic and expected target data information can be generated; and through residual detection, abnormal data can be identified. Therefore, the above process improves the detection efficiency of the data anomaly detection method. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for use in the description of the embodiments or related technologies. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0042] Figure 1 It is a schematic flowchart of a data anomaly detection method in an embodiment;

[0043] Figure 2 It is a schematic diagram of a system of a data anomaly detection method in an embodiment;

[0044] Figure 3 It is a detailed schematic flowchart of a data anomaly detection method in an embodiment;

[0045] Figure 4 It is a schematic flowchart of a multi-modal data poisoning attack detection in an embodiment;

[0046] Figure 5 It is a structural block diagram of a data anomaly detection device in an embodiment;

[0047] Figure 6Internal structure diagram of a computer device in an embodiment. Detailed implementation manners

[0048] To make the objectives, technical solutions and advantages of the present application clearer and more understandable, the present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0049] In one embodiment, as Figure 1 shown, a method for detecting data anomalies is provided. In this embodiment, the application of this method to a terminal is used as an example for illustration. It can be understood that this method can also be applied to a server, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps S102 to step S110. Among them:

[0050] Step S102, obtaining initial data information of at least two modalities; the modality represents the type of the initial data information.

[0051] Among them, the modality refers to different forms of information representation, such as text, image, audio, etc.; the initial data information refers to the unprocessed original data corresponding to different modalities.

[0052] Optionally, each modality has different characteristics and data representation methods. The image modality may include color, texture, and shape information, while the text modality may include vocabulary and grammar structures.

[0053] Step S104, using the forward diffusion of the diffusion model to add noise to the initial data information of each modality respectively, so as to remove the preset modality features in the initial data information of each modality and obtain the corresponding similar modality information respectively.

[0054] Among them, the diffusion model is usually used for image generation and data augmentation, and finally generates new samples by gradually adding noise; the forward diffusion process blurs the data information by continuously adding noise to the data to be processed; the noise is used to refer to random interference; adding noise can help the diffusion model remove overfitting; the similar modality information refers to the data generated after being processed by the diffusion model, and this data retains similarity.

[0055] As an example, the forward diffusion process blurs the initial data information by continuously adding noise to the initial data information, and then removes the preset modality features in the initial data information; the similar modality information may refer to that the processed text and image no longer contain their respective original detailed features.

[0056] Step S106: Use the reverse diffusion of the diffusion model to restore the preset modal features of each similar modal information to obtain the corresponding target data information respectively, and align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0057] Among them, the reverse diffusion process is to learn how to restore the original sample or a sample similar to the original sample from the noise; the target data information is the final data with specific modal features restored after reverse diffusion processing.

[0058] As an example, aligning the target data information of each modality can pair images and texts through the same annotation or frequency to ensure the correct correspondence between the two.

[0059] Step S108: Use the attention mechanism to identify the preset key regions of each aligned target data information.

[0060] Among them, the attention mechanism is a neural network mechanism that can dynamically focus on specific regions of the input data to enhance key information.

[0061] As an example, in multiple target data information, the attention mechanism can identify different modal features corresponding to different modalities.

[0062] Step S110: Obtain the residual values of the target data information in each preset key region through residual detection, and determine the abnormal data in the corresponding initial data information according to the residual values.

[0063] Among them, residual detection refers to evaluating the difference between the actual data and the predicted data to identify potential anomalies; the calculation of the residual values can be used to identify data points with abnormal patterns, that is, abnormal data that needs to be re-evaluated or cleaned.

[0064] In the above data anomaly detection method, during the process of data anomaly detection, first, obtain the initial data information of at least two modalities; the type of the initial data information represented by the modality; then use the forward diffusion of the diffusion model to add noise to the initial data information of each modality respectively to remove the preset modality features in the initial data information of each modality, and obtain the corresponding similar modality information respectively; then use the reverse diffusion of the diffusion model to restore the preset modality features of each similar modality information to obtain the corresponding target data information respectively, and align the target data information of each modality based on the modality data corresponding to the preset modality features; the modality data is updated in real time based on the diffusion model; then use the attention mechanism to identify the preset key regions of each aligned target data information; finally, obtain the residual values of the target data information in each preset key region through residual detection, and determine the abnormal data in the corresponding initial data information according to the residual values. In the above process, by adding noise to the initial data information to remove the preset modality features and restoring the similar modality information, data alignment between different modalities can be achieved, and the integration ability between modalities can be improved; after using the reverse diffusion of the diffusion model to restore the preset modality features, more realistic and expected target data information can be generated; and through residual detection, abnormal data can be identified. Therefore, the above process improves the detection efficiency of the data anomaly detection method.

[0065] In an exemplary embodiment, step S104 uses the forward diffusion of the diffusion model to add noise to the initial data information of each modality respectively, including: for the initial data information of each modality, based on the preset noise addition rule and the preset number of steps, gradually add the noise to the corresponding initial data information.

[0066] Among them, each modality corresponds to different noises, and different noises correspond to different noise addition rules; the noise addition rule refers to the specific method and standard of how to introduce noise into the data during the data processing process; the preset number of steps refers to the number of steps of adding noise specified by the rule during the noise addition process, that is, add noise every certain number of steps, simulating the fluctuations and possible interferences of the data in actual applications; gradually adding noise indicates that the addition of noise is a progressive process, which can better simulate the interference in the real scenario.

[0067] As an example, when the initial data information is image data, the gradual addition of noise can be to gradually introduce effects such as blurring and interfering pixels to the image data.

[0068] In this embodiment, by gradually adding noise to the initial data information, the process of noise that may be encountered in actual applications can be simulated, which helps to learn how to process and resist noise, thereby improving the performance of the diffusion model on unknown data sets; and adding noise with corresponding rules and steps to the initial data information of different modalities can ensure the rationality of data processing.

[0069] In one embodiment, step S106 uses the reverse diffusion of the diffusion model to restore the preset modal features of each similar modal information, including: for the initial data information of each modal after adding noise, based on the preset noise removal rules and the preset number of steps, gradually remove the noise in the similar modal information to restore the preset modal features of each similar modal information.

[0070] Among them, the noise removal rule refers to the method of extracting or restoring data from noisy data during the processing, and the rules may include filtering, signal averaging, waveform restoration, etc.; similarly to the above-mentioned adding noise, the preset number of steps refers to the operation of removing noise according to the set number of steps during the noise removal process; gradually removing indicates that the removal of noise is a progressive process; the similar modal information refers to other modal data similar to the currently processed modal, and can assist in restoring the preset modal features of the target modal information during noise removal; the preset modal features refer to the ideal state or features restored from the original data.

[0071] As an example, in image processing, methods such as bilateral filtering can be used to gradually remove image noise while retaining edge information; in audio signal processing, frequency analysis techniques can be used to gradually remove background noise until a clear audio waveform is restored.

[0072] In this embodiment, gradually removing noise can avoid damaging the signal features, and at the same time improve the restoration accuracy of the preset modal features of the similar modal information. By combining the data features of different modalities and using similarity to make up for the deficiencies in the denoising process of a certain modality, more accurate feature restoration can be achieved.

[0073] Further, in one embodiment, step S110 obtains the residual values of the target data information in each preset key area through residual detection, including: obtaining the residual values based on the preset modal features of the target data information in each preset key area and the features of the target data information in each preset key area at each preset step.

[0074] Among them, the preset key area refers to an important area defined in advance during data processing, which may contain key features or important parameters of the target data information, and is usually used for centralized analysis and processing; the preset modal feature refers to the ideal features or indicators predefined for a specific modality during the initialization stage of data analysis, and is usually used to guide the direction and goal of data processing; each preset step number refers to the segmentation during the feature extraction or processing process, and is used to analyze the performance of the target data information under different processing conditions or parameter configurations stage by stage; the feature refers to the descriptive information extracted from the target data information and is used to characterize the main attributes of the target data, which can be numerical or categorical, etc.; the residual value refers to the difference between the actual feature of the target data information and the preset modal feature, and calculating the residual value helps to evaluate whether the initially input initial modal data has been maliciously modified.

[0075] In this embodiment, by deeply analyzing and processing the target data information within the preset key area, the differences between the original features of the initial modal data and the features obtained through noise removal or other processing methods can be effectively identified, which helps to determine whether the initial modal data is abnormal.

[0076] Furthermore, in one embodiment, step S110 determines the abnormal data in the corresponding initial data information according to the residual value, including: comparing the sizes of the residual values with a preset residual threshold, and determining the abnormal data in the corresponding initial data information based on the comparison result.

[0077] Among them, the preset residual threshold can be set according to the initial data information of different modalities, and is used to compare with the residual value to determine the abnormal data in the initial data information, which can ensure the quality of the initial data information and improve the reliability and effectiveness of the data anomaly detection process.

[0078] In an exemplary embodiment, determining the abnormal data in the corresponding initial data information based on the comparison result includes: when the comparison result is that the residual value is greater than the preset residual threshold, determining the initial data information corresponding to the residual value as abnormal data.

[0079] Among them, the abnormal data refers to the data points that deviate from the normal mode.

[0080] Furthermore, when the comparison result is that the residual value is less than or equal to the preset residual threshold, it can be determined that the initial data information corresponding to the residual value is normal data. Correspondingly, the normal data refers to the data points that conform to the expected mode.

[0081] In this embodiment, through the above comparison process of the residual value and the residual threshold, the abnormal data can be efficiently identified, which helps to improve the accuracy and credibility of data analysis.

[0082] In addition, as Figure 2As shown, a system diagram of a data anomaly detection method is provided, including five steps. Among them, the diffusion model noise addition alignment, the diffusion model denoising alignment, and the attention mechanism are in the same system. To better understand the process of the above data anomaly detection method, in combination with Figure 3 As shown below, a specific process of the data anomaly detection method of the present application is elaborated in detail, including the following steps:

[0083] Step S302, receive initial data information from different modalities.

[0084] Among them, the initial data information of different modalities can include image data, text data, traffic information, etc. These data are important parts of artificial intelligence model training. Attack initiators generally choose to implant backdoors by adding abnormal data to the dataset, so as to achieve the purpose of interfering with the model output.

[0085] Step S304, use forward diffusion to add noise to the initial data information of each modality.

[0086] Among them, in the forward diffusion process, noise will be gradually added to the initial data information of each modality. This process will gradually remove the specific modality information of the data, making the initial data information of all modalities tend to a similar latent distribution space, that is, the diffusion model "blurs" the detailed features of each modality by adding noise.

[0087] As an example, assume that the data of different modalities is , and its corresponding modality features are . Gradually add noise to the data. For each time step t, the expression of forward diffusion is as follows:

[0088]

[0089] Among them represents the initial input feature, represents the feature at time step t, is the noise attenuation coefficient in forward diffusion, gradually reducing the original information in the feature. N represents the normal distribution, represents the probability distribution or correlation under the given initial state condition, and I represents the identity matrix.

[0090] Step S306, use reverse diffusion to restore the modality features to align the target data information.

[0091] Among them, reverse diffusion uses the initial data information of all modalities in the same latent space to recover the corresponding modal features, ensuring that the initial data information of different modalities can be aligned after passing through the diffusion model. Through the alignment process, the initial data information of different modalities will maintain consistency among multiple modalities, making it easier to perform cross-modal comparison and fusion. The step-by-step recovery from the noisy features to the initial data information in reverse diffusion can be expressed by the following expression:

[0092]

[0093] Among them is the mean of the original features estimated from the noise state and is the covariance matrix of the features. Through reverse diffusion, one can learn how to generate the aligned representation of the current modality based on the alignment information of other modalities, ensuring that different modalities are aligned in the shared latent space.

[0094] Step S308, use the attention mechanism to identify the key parts in the target data information.

[0095] Among them, the attention mechanism helps to focus on the possible poisoning areas that may appear in the target data information, and identify the potential abnormal points or poisoning areas in the target data information.

[0096] Step S310, detect abnormal data and locate the poisoning points.

[0097] Based on the results of steps S306 and S308, abnormal points in the alignment of the target data information can be discovered through residual detection. If some features cannot be accurately recovered after reverse diffusion and attention recognition, resulting in a large residual, it can be speculated that there may be poisoning in these areas. Among them, the mathematical expression of the residual is:

[0098]

[0099] If the residual value is too large, it indicates that the features of this modality may have been maliciously modified or poisoned.

[0100] Furthermore, the flowchart of multi-modal data poisoning attack detection is as shown in Figure 4As shown in the figure, after inputting the initial data information of multiple modalities, forward diffusion and noise addition are performed. If the number of steps reaches the maximum number of steps T, reverse diffusion and noise reduction are performed; on the contrary, if the number of steps does not reach the maximum number of steps T, forward diffusion and noise addition continue; when the reverse diffusion and noise reduction reduces the number of steps to zero, the attention mechanism recognition function is activated to restore the features of the initial data information; on the contrary, if the reverse diffusion and noise reduction does not reduce the number of steps to zero, the noise reduction operation continues; and if the residual value obtained after recognition by the attention mechanism is less than the threshold, it indicates that the data is normal and the process ends; on the contrary, if the residual value is greater than the threshold, it indicates that the data is abnormal. Through the above process, the detection of the data is jointly completed to obtain the detection result of the data.

[0101] Through the above embodiments, based on the diffusion model, by using forward diffusion and noise addition and reverse diffusion and noise reduction, the initial data information of different modalities is aligned, which can handle data of different modalities, cope with different malicious information penetrations, and defend against data poisoning attacks in complex scenarios; by using the attention mechanism to focus on specific areas, while ensuring the availability and security of the data set, the waste of resources is reduced, and residual detection is used to locate the data set containing malicious data while identifying the existence of malicious data.

[0102] It should be understood that although the steps in the flowcharts involved in the above-described embodiments are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-described embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same moment, but can be executed at different moments, and the execution order of these steps or stages is not necessarily sequential, but can be executed alternately or alternately with at least a part of other steps or steps or stages in other steps.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a data anomaly detection device for implementing the data anomaly detection method described above. The implementation solution provided by this device to solve the problem is similar to the implementation solution described in the above method. Therefore, the specific limitations in one or more embodiments of the data anomaly detection device provided below can refer to the limitations on the data anomaly detection method in the above text, and will not be repeated here.

[0104] In an exemplary embodiment, as Figure 5 shown, a data anomaly detection device is provided, including: an information acquisition module 501, a noise addition module 502, a feature recovery module 503, an information recognition module 504, and a result determination module 505, where:

[0105] An information acquisition module 501, configured to acquire initial data information of at least two modalities; the type of the initial data information representing the modalities;

[0106] A noise addition module 502, configured to add noise to the initial data information of each modality respectively using the forward diffusion of a diffusion model to remove preset modality features in the initial data information of each modality, so as to obtain corresponding similar modality information respectively;

[0107] A feature recovery module 503, configured to use the reverse diffusion of the diffusion model to recover the preset modality features of each similar modality information, so as to obtain corresponding target data information respectively, and align the target data information of each modality based on the modality data corresponding to the preset modality features; the modality data is updated in real time based on the diffusion model;

[0108] An information recognition module 504, configured to use an attention mechanism to recognize preset key regions of the aligned target data information of each modality;

[0109] A result determination module 505, configured to obtain the residual values of the target data information in each preset key region through residual detection, and determine the abnormal data in the corresponding initial data information according to the residual values.

[0110] Further, in one embodiment, the noise addition module 502 is further configured to gradually add noise to the corresponding initial data information of each modality based on a preset noise addition rule and a preset number of steps.

[0111] Further, in one embodiment, the feature recovery module 503 is further configured to gradually remove the noise in the similar modality information based on a preset noise removal rule and a preset number of steps for the initial data information of each modality after adding noise, so as to recover the preset modality features of each similar modality information.

[0112] Further, in one embodiment, the result determination module 505 is further configured to obtain the residual values based on the preset modality features of the target data information in each preset key region and the features of the target data information in each preset key region at each preset number of steps.

[0113] Further, in one embodiment, the result determination module 505 is further configured to compare the magnitudes of the residual values with a preset residual threshold, and determine the abnormal data in the corresponding initial data information based on the comparison result.

[0114] Further, in one embodiment, the result determination module 505 is further configured to, when the comparison result is that the residual value is greater than the preset residual threshold, determine the initial data information corresponding to the residual value as abnormal data.

[0115] Each module in the above data anomaly detection device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above modules can be embedded in the processor of the computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0116] In an exemplary embodiment, a computer device is provided. The computer device can be a server, and its internal structure diagram can be as Figure 6 shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, abbreviated as I / O), and a communication interface. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data anomaly detection data. The input / output interface of the computer device is used to exchange information between the processor and external devices. The communication interface of the computer device is used to communicate with external terminals through a network connection. When the computer program is executed by the processor, it implements a data anomaly detection method.

[0117] Those skilled in the art can understand that Figure 6 the structure shown in

[0118] is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0119] In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, it implements the steps in each of the above method embodiments.

[0120] In an embodiment, a computer program product is provided, including a computer program. When the computer program is executed by a processor, it implements the steps in each of the above method embodiments.

[0121] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data that have been authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant regulations.

[0122] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods. Among them, any reference to a memory, database, or other medium used in the various embodiments provided in this application can include at least one of non-volatile and volatile memories. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the various embodiments provided in this application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the various embodiments provided in this application can be general-purpose processors, central processors, graphics processors, digital signal processors, programmable logic devices, data processing logics based on quantum computing, etc., without limitation.

[0123] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the various technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered to be within the scope described in this specification.

[0124] The above-described embodiments merely represent several implementation manners of the present application. The description thereof is relatively specific and detailed, but it should not be construed as a limitation to the patent scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all fall within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A data anomaly detection method, characterized in that: The method comprises: Acquire initial data information of at least two modes; the modes represent the types of the initial data information; Using the forward diffusion of the diffusion model, noise is added to the initial data information of each mode respectively, so as to remove the preset modal features in the initial data information of each mode, and obtain the respectively corresponding similar modal information; Using the reverse diffusion of the diffusion model to restore the preset modal features of each of the similar modal information to obtain the corresponding target data information, and aligning the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model; Using an attention mechanism to identify preset key areas of each of the aligned target data information; The residual value of the target data information in each of the preset key areas is obtained through residual detection, and the abnormal data in the corresponding initial data information is determined according to the residual value.

2. The method according to claim 1, characterized in that The forward diffusion using the diffusion model adds noise to the initial data information of each mode respectively, including: For the initial data information of each mode, based on a preset noise adding rule and a preset number of steps, the noise is gradually added to the corresponding initial data information.

3. The method according to claim 2, characterized in that The using the reverse diffusion of the diffusion model to restore the preset modal features of each of the similar modal information includes: For the initial data information of each modality after adding the noise, based on the preset noise removal rule and the preset number of steps, the noise in the similar modal information is gradually removed to restore the preset modal features of each similar modal information.

4. The method according to claim 3, characterized in that: The obtaining the residual value of the target data information in each of the preset key areas by residual detection includes: The residual value is obtained based on the preset modal features of the target data information in each of the preset key areas and the features of the target data information in each of the preset key areas at each of the preset steps.

5. The method according to claim 4, characterized in that The determining, according to the residual value, the abnormal data in the corresponding initial data information includes: The residual values ​​are compared with a preset residual threshold, and abnormal data in the corresponding initial data information is determined based on the comparison result.

6. The method according to claim 5, characterized in that The determining, based on the comparison result, the abnormal data in the corresponding initial data information includes: When the comparison result is that the residual value is greater than the preset residual threshold, it is determined that the initial data information corresponding to the residual value is the abnormal data.

7. A data anomaly detection device, characterized in that: The device comprises: An information acquisition module, used to acquire initial data information of at least two modes; the modes represent the types of the initial data information; A noise adding module, used for adding noise to the initial data information of each mode respectively by using the forward diffusion of the diffusion model, so as to remove the preset modal features in the initial data information of each mode, and obtain respectively corresponding similar modal information; A feature recovery module, used to recover the preset modal features of each of the similar modal information using reverse diffusion of the diffusion model to obtain the corresponding target data information, and align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model; An information recognition module, used for identifying preset key areas of each aligned target data information by using an attention mechanism; The result determination module is used to obtain the residual value of the target data information in each preset key area through residual detection, and determine the abnormal data in the corresponding initial data information according to the residual value.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images