Abnormity detection method based on multi-core fusion and neighborhood modeling

Abstract

The invention discloses an anomaly detection method based on multi-core fusion and neighborhood modeling, and belongs to the technical field of computer science and artificial intelligence. In the prior art, the problems of mismatching of training and testing stages, single-stage neighborhood modeling limitation, high calculation complexity and the like exist in anomaly detection, so that abnormal samples are easily mixed into normal clusters, and the detection robustness is reduced. According to the method, sparse multi-kernel learning is adopted, non-linear features of modeling data are fused through multiple kernels, kernel interaction items with the most distinguishing power are screened in combination with a kernel sparse strategy, calculation redundancy is reduced, and detection efficiency is improved. Meanwhile, a double-layer neighborhood comparison mechanism is constructed in a training stage, the aggregability of normal samples is enhanced through a first-layer neighborhood, and abnormal samples are deduced in a second-layer neighborhood, so that the abnormal separation capability of the model is enhanced. In the test stage, a training-test neighborhood comparison strategy is introduced, the neighborhood weight is dynamically adjusted, the difference between an abnormal sample and a normal sample is amplified, and the detection precision and generalization ability are improved.

Description

Technical Field

[0001] The present invention belongs to the field of computer science and artificial intelligence technology, and specifically relates to an anomaly detection method based on multi-core fusion and neighborhood modeling. Background Art

[0002] In modern data-driven applications, anomaly detection has become a crucial technology for ensuring system security and stability. Whether in financial fraud detection, industrial equipment fault diagnosis, network intrusion prevention, or medical data analysis, accurately identifying abnormal patterns is crucial for improving system reliability and decision-making quality. The core task of anomaly detection is to identify data points that deviate from the normal pattern. These data points typically occur at a lower frequency and exhibit distribution characteristics in the feature space that differ from those of regular data.

[0003] As data scale and dimensionality increase, traditional anomaly detection methods face numerous challenges. The sparsity of high-dimensional data, the complexity of feature interactions, and the ambiguity of anomaly samples make it difficult for existing methods to achieve stable and efficient detection results in practical applications. Therefore, developing anomaly detection methods that both preserve local structure and provide global discriminative capabilities has become a key research topic.

[0004] Current anomaly detection methods mainly rely on technologies such as similarity measurement, kernel methods, graph structure modeling, and deep learning. Among them, methods based on similarity measurement usually use distance or density to judge the degree of anomaly, while methods based on kernel methods capture the nonlinear characteristics of data through kernel function mapping. However, these methods have obvious limitations in high-dimensional data environments: (1) Multi-kernel learning methods require the calculation and optimization of multiple kernel matrices, and the computational overhead increases sharply with the growth of data scale, limiting their application on large-scale datasets. In addition, complex kernel combination strategies increase resource consumption, making it difficult for the model to run in a computationally constrained environment; (2) Most existing methods only focus on optimizing data representation based on local neighborhood similarity, while ignoring the role of distant neighbors (extended neighborhoods) in training, resulting in over-aggregation of normal samples and ineffective removal of abnormal samples, thereby reducing detection effectiveness; (3) Existing methods usually use different similarity measurement strategies in the training and testing stages. This mismatch may weaken the generalization ability of the model. This inconsistency in strategy may result in the neighborhood structure used in the training process not being effectively utilized in the testing stage, thereby affecting the final detection performance. Summary of the Invention

[0005] In response to the problems of existing anomaly detection methods such as mismatch between training and testing phases, limitations of single-level neighborhood modeling, and high computational complexity, the present invention provides an anomaly detection method with a multi-core neighborhood structure, aiming to improve the robustness, computational efficiency, and detection accuracy of anomaly detection.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] An anomaly detection method based on multi-kernel fusion and neighborhood modeling includes the following main steps:

[0008] Step 1: Load the input sample dataset And for each sample in the original space, find its k nearest neighbors to form a neighborhood structure based on the original space. Based on the neighborhood structure, use the kernel function to locally estimate the similarity between samples, and generate multiple structure-aware sparse kernel matrices through graph structure construction as the basis for subsequent processing;

[0009] The specific operations of step 1 are:

[0010] Suppose there are m basic kernel matrices Where each basic kernel matrix K v By the basic kernel function k v (x, x') is generated, and the basic kernel function includes multiple similarity functions and Gaussian radial basis kernel function (RBF kernel). Multiple kernel matrices are constructed through different function transformations and bandwidth parameters to enhance expression diversity. For the i-th sample x in the input sample data set i , identify its k nearest neighbors, where k is the preset neighborhood scale parameter, and form a neighborhood structure based on the original space:

[0011]

[0012] Kernel approximation using the Nadaraya-Watson estimator:

[0013]

[0014] Among them, y j Represents sample x j The label value of κ ij Represents sample x i and neighbor x j Based on the kernel similarity between the two, a local normalized similarity matrix S is constructed, which is defined as S = [s ij ],s ij Defined as:

[0015]

[0016] Construct the neighborhood affinity graph matrix A and degree matrix D:

[0017]

[0018] Among them, a ij is an element in the symmetric neighborhood affinity graph matrix A, representing the sample x i with x j The adjacency weight between them;

[0019] Finally, based on the graph structure information, the sparse neighborhood perception kernel matrix K is constructed:

[0020]

[0021] Multiple sparse neighborhood-aware kernel matrices K serve as the input basis for learning local similarity structures in subsequent training stages.

[0022] Step 2: Fuse multiple sparse kernel matrices and learn the expression of each sample in the fusion space by introducing a sample adaptive weight mechanism. Based on this expression, define the adaptive kernel distance D between samples. ψ (x, x'), used for subsequent neighborhood partitioning and relationship modeling;

[0023] The specific operations of step 2 are:

[0024] After obtaining the set of sparse kernel matrices, the system enters the training phase, which aims to jointly optimize the sample adaptive kernel weights and the local similarity structure in the embedding space to improve the model's ability to discriminate abnormal samples.

[0025] Step 2.1: Set the input samples x, x' and use the obtained kernel matrix K to construct a joint embedding representation:

[0026] ψ(x)=[w1(x)φ1(x) T ,…,w m (x)φ m (x) T ] T

[0027] Among them, φ v (x) represents the mapping of the input sample x in the implicit feature space corresponding to the vth kernel function, satisfying κ v (x,x')=<φ v (x),φ v (x')>, T represents transposition, w v (x) is the kernel weight defined by the Sigmoid function, and then a fused kernel function is obtained:

[0028]

[0029] Among them, ψ(x') represents the representation of sample x' in the multi-core joint embedding space; w v (x') represents the structural weight of the sample x' corresponding to the vth basic kernel function; T represents transposition; and Respectively represent the weight parameters and bias terms corresponding to the v-th kernel function;

[0030] Based on the above joint embedding representation, the adaptive kernel distance in the joint embedding space is defined as:

[0031]

[0032] Among them, V,b is the kernel parameter learned in the training phase,

[0033] Step 3: Construct a two-layer neighborhood structure: the first layer of neighborhood aggregates similar samples, and the second layer of neighborhood is used to enhance the separation of abnormal boundaries; design a structural contrast loss function and introduce auxiliary variables And conduct joint optimization training to gradually learn the structural parameters that can distinguish abnormalities from normal ones;

[0034] The specific operations of step 3 are:

[0035] Step 3.1: To enhance the discriminative ability during the training phase, a two-layer neighborhood structure is constructed, and two types of constraints are established through the attraction-repulsion mechanism:

[0036] Attraction constraint: Select the nearest k1 neighbors of each sample to form the first layer of neighborhood Next, a local aggregation constraint is imposed to minimize the distance between the first-layer neighborhood samples:

[0037]

[0038] Among them, ω(x,x') is the similarity weight, which is defined using a polynomial kernel:

[0039]

[0040] Exclusion constraint: Select the nearest k2 neighbors of the first-layer neighbors to form the second-layer neighborhood Next, a separation constraint is imposed to maximize the distance between the second-layer neighborhood samples:

[0041]

[0042] Step 3.2: Integrate the attraction and repulsion constraints into a unified structural contrast loss function and set the optimization goal

[0043]

[0044] Step 3.3: The ratio target is converted to a differential target. In order to avoid the gradient vanishing or exploding problem caused by directly optimizing the ratio structure, an auxiliary coefficient is introduced at iteration t. Used to approximate the optimization objective:

[0045]

[0046] This transformation can decompose the ratio optimization problem into a differential optimization problem, avoiding extreme ratio values during the calculation process and improving optimization stability.

[0047] Then construct a linearized proxy loss function, the formula is:

[0048]

[0049] The loss function can be decomposed into attraction loss (pulling similar samples closer) and repulsion loss (pushing abnormal samples away), making the optimization process more intuitive; the proxy loss function is fixed at α (t) Based on this, the gradient update is performed on the parameter θ∈{V,b}, and its gradient expression is:

[0050]

[0051] For each kernel parameter v v and bias b v , metric function D ψ The gradient calculation formula is:

[0052]

[0053] Among them, the derivative of the weight function is:

[0054]

[0055] Step 3.4: Update the model parameters using gradient descent:

[0056]

[0057] Among them, η is the learning rate to ensure the stability of the optimization process; the maximization-minimization optimization strategy is adopted to alternately optimize α (t) And parameters V,b, ensure that the loss function gradually decreases, ensuring that the loss function It decreases monotonically and eventually converges to a stable point.

[0058] Through the above iterative optimization process, the original non-convex ratio optimization problem is transformed into a solvable difference problem, and numerical stability and convergence are guaranteed through auxiliary coefficients and convex surrogate functions, thereby realizing efficient adaptive learning of local similarity structures.

[0059] Step 4: Using the structural parameters V,b obtained during training, we perform structural analysis on the new sample in the testing phase. By comparing the distance between it and the neighboring samples, we calculate the anomaly score and determine whether it is an anomaly based on the set threshold.

[0060] The specific operations of step 4 are:

[0061] Step 4.1: In the test phase, adopt the inverse weighting strategy and set the test sample as x * , whose first-level neighborhood is The second-level neighborhood is The metric distance between samples is defined as:

[0062]

[0063] Among them, V,b is the kernel parameter learned in the training phase, and the anomaly score is calculated as follows:

[0064]

[0065] Among them, the molecule calculates the weighted metric distance between the test sample and the first layer of neighborhood samples, and combines the similarity weight w(x * ,x i ) is reverse normalized, and the denominator calculates the metric distance between the first-layer neighborhood samples and their second-layer neighborhood samples, so that the abnormal score of the abnormal sample is higher;

[0066] Based on the calculated anomaly score s(x * ), anomaly detection decision is made by setting the threshold τ to determine whether the sample is an abnormal sample:

[0067]

[0068] Here, τ is set by Extreme Value Theory (EVT) on the verification data to control the false alarm rate.

[0069] Compared with the prior art, the present invention has the following advantages:

[0070] 1) This paper proposes an intra-training neighborhood comparison method. By introducing a dual-force mechanism during the training phase, the first-layer (immediately adjacent) samples are brought closer together, while the second-layer (extended) samples are pushed further away. This method enhances the clustering tightness of normal samples in the embedding space and significantly improves the separability of abnormal samples.

[0071] 2) This paper proposes a training-testing neighborhood comparison method. This strategy addresses the inconsistency between neighborhood information handled by existing methods during training and testing. During training, this method optimizes the embedding structure using local similarity weights, while during testing, it employs an inverse weighting strategy to emphasize the differences between normal and abnormal samples, thereby improving detection robustness.

[0072] 3) This paper proposes a scalable kernel sparsification method. By introducing a kernel sparsification strategy, only the most discriminative kernel interactions are retained, thereby reducing computational overhead, ensuring the scalability of multi-kernel learning, and improving detection performance on large-scale datasets. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 is a diagram of the two-layer neighborhood of the present invention;

[0074] Figure 2 Convergence analysis and AUPRC performance of the present invention on D1;

[0075] Figure 3 Convergence analysis and AUPRC performance of the present invention on D2;

[0076] Figure 4 Convergence analysis and AUPRC performance of the present invention on D4;

[0077] Figure 5 It is a diagram showing the impact of different levels of neighborhood comparison strategies on model performance in the present invention;

[0078] Figure 6 Graph illustrating the effect of kernel sparsification according to the present invention. DETAILED DESCRIPTION

[0079] To gain a deeper understanding of the present invention, we will provide a comprehensive and detailed description thereof. However, the present invention has various implementations and is not limited to the specific examples listed herein. These examples are presented to enhance a comprehensive understanding of the present disclosure.

[0080] An anomaly detection method based on multi-kernel fusion and neighborhood modeling includes the following main steps:

[0081] Step 1: Load the input sample dataset And for each sample in the original space, find its k nearest neighbors to form a neighborhood structure based on the original space. Based on the neighborhood structure, use the kernel function to locally estimate the similarity between samples, and generate multiple structure-aware sparse kernel matrices through graph structure construction as the basis for subsequent processing;

[0082] The specific operations of step 1 are:

[0083] Suppose there are m basic kernel matrices Where each basic kernel matrix K v By the basic kernel function k v (x, x') is generated, and the basic kernel function includes multiple similarity functions and Gaussian radial basis kernel function (RBF kernel). Multiple kernel matrices are constructed through different function transformations and bandwidth parameters to enhance expression diversity. For the i-th sample x in the input sample set i , identify its nearest k samples, where k is a preset neighborhood scale parameter, which is set to 5 in this embodiment, to form a neighborhood structure based on the original space:

[0084]

[0085] Kernel approximation using the Nadaraya-Watson estimator:

[0086]

[0087] Among them, y j Represents sample x j The label value of κ ij Represents sample x i and neighbor x j Based on the kernel similarity between the two, a local normalized similarity matrix S is constructed, which is defined as S = [s ij ],s ij Defined as:

[0088]

[0089] Construct the neighborhood affinity graph matrix A and degree matrix D:

[0090]

[0091] Among them, a ij is an element in the symmetric neighborhood affinity graph matrix A, representing the sample x i with x j The adjacency weight between them;

[0092] Finally, based on the graph structure information, the sparse neighborhood perception kernel matrix K is constructed:

[0093]

[0094] Multiple sparse neighborhood-aware kernel matrices K serve as the input basis for learning local similarity structures in subsequent training stages.

[0095] Step 2: Fuse multiple sparse kernel matrices and learn the expression of each sample in the fusion space by introducing a sample adaptive weight mechanism. Based on this expression, define the adaptive kernel distance D between samples.ψ (x, x'), used for subsequent neighborhood partitioning and relationship modeling;

[0096] The specific operations of step 2 are:

[0097] After obtaining the set of sparse kernel matrices, the system enters the training phase, which aims to jointly optimize the sample adaptive kernel weights and the local similarity structure in the embedding space to improve the model's ability to discriminate abnormal samples.

[0098] Step 2.1: Set the input samples x, x' and use the obtained kernel matrix K to construct a joint embedding representation:

[0099] ψ(x)=[w1(x)φ1(x) T ,…,w m (x)φ m (x) T ] T

[0100] Among them, φ v (x) represents the mapping of the input sample x in the implicit feature space corresponding to the vth kernel function, satisfying k v (x,x')=<φ v (x),φ v (x')>, T represents transposition, w v (x) is the kernel weight defined by the Sigmoid function, and then a fused kernel function is obtained:

[0101]

[0102] Among them, ψ(x') represents the representation of sample x' in the multi-core joint embedding space; w v (x') represents the structural weight of the sample x' corresponding to the vth basic kernel function; T represents transposition; and Respectively represent the weight parameters and bias terms corresponding to the v-th kernel function;

[0103] Based on the above joint embedding representation, the adaptive kernel distance in the joint embedding space is defined as:

[0104]

[0105] Among them, V,b is the kernel parameter learned in the training phase,

[0106] Step 3: Construct a two-layer neighborhood structure: the first layer of neighborhood aggregates similar samples, and the second layer of neighborhood is used to enhance the separation of abnormal boundaries; design a structural contrast loss function and introduce auxiliary variables And conduct joint optimization training to gradually learn the structural parameters that can distinguish abnormalities from normal ones; Figure 1 shown.

[0107] The specific operations of step 3 are:

[0108] Step 3.1: To enhance the discriminative ability during the training phase, a two-layer neighborhood structure is constructed, and two types of constraints are established through the attraction-repulsion mechanism:

[0109] Attraction constraint: Select the nearest k1 neighbors of each sample to form the first layer of neighborhood Next, a local aggregation constraint is imposed to minimize the distance between the first-layer neighborhood samples:

[0110]

[0111] Among them, ω(x,x') is the similarity weight, which is defined using a polynomial kernel:

[0112]

[0113] Exclusion constraint: Select the nearest k2 neighbors of the first-layer neighbors to form the second-layer neighborhood Next, a separation constraint is imposed to maximize the distance between the second-layer neighborhood samples:

[0114]

[0115] Step 3.2: Integrate the attraction and repulsion constraints into a unified structural contrast loss function and set the optimization goal

[0116]

[0117] Step 3.3: The ratio target is converted to a differential target. In order to avoid the gradient vanishing or exploding problem caused by directly optimizing the ratio structure, an auxiliary coefficient is introduced at iteration t. Used to approximate the optimization objective:

[0118]

[0119] This transformation can decompose the ratio optimization problem into a differential optimization problem, avoiding extreme ratio values during the calculation process and improving optimization stability.

[0120] Then construct a linearized proxy loss function, the formula is:

[0121]

[0122] The loss function can be decomposed into attraction loss (pulling similar samples closer) and repulsion loss (pushing abnormal samples away), making the optimization process more intuitive; the proxy loss function is fixed at α (t) Based on this, the gradient update is performed on the parameter θ∈{V,b}, and its gradient expression is:

[0123]

[0124] For each kernel parameter v v and bias b v , metric function D ψ The gradient calculation formula is:

[0125]

[0126] Among them, the derivative of the weight function is:

[0127]

[0128] Step 3.4: Update the model parameters using gradient descent:

[0129]

[0130] Among them, η is the learning rate to ensure the stability of the optimization process; the maximization-minimization optimization strategy is adopted to alternately optimize α (t) And parameters V,b, ensure that the loss function gradually decreases, ensuring that the loss function It decreases monotonically and eventually converges to a stable point.

[0131] Through the above iterative optimization process, the original non-convex ratio optimization problem is transformed into a solvable difference problem, and numerical stability and convergence are guaranteed through auxiliary coefficients and convex surrogate functions, thereby realizing efficient adaptive learning of local similarity structures.

[0132] Step 4: Using the structural parameters v,b obtained during training, perform structural analysis on the new sample in the test phase. By comparing the distance between it and the neighboring samples, calculate the anomaly score and combine it with the set threshold to determine whether it is an anomaly.

[0133] The specific operations of step 4 are:

[0134] Step 4.1: In the test phase, adopt the inverse weighting strategy and set the test sample as x * , whose first-level neighborhood is The second-level neighborhood is The metric distance between samples is defined as:

[0135]

[0136] Among them, V,b is the kernel parameter learned in the training phase, and the anomaly score is calculated as follows:

[0137]

[0138] Among them, the molecule calculates the weighted metric distance between the test sample and the first layer of neighborhood samples, and combines the similarity weight w(x * ,x i ) is reverse normalized, and the denominator calculates the metric distance between the first-layer neighborhood samples and their second-layer neighborhood samples, so that the abnormal score of the abnormal sample is higher;

[0139] Based on the calculated anomaly score s(x * ), anomaly detection decision is made by setting the threshold τ to determine whether the sample is an abnormal sample:

[0140]

[0141] Here, τ is set by Extreme Value Theory (EVT) on the verification data to control the false alarm rate.

[0142] Data loading and preprocessing: This paper uses four publicly available benchmark datasets for validation, as shown in Table 1. The datasets include multiple high-dimensional datasets for arrhythmia, hepatitis, vertebral, and yeast. The data are stored in .mat format and contain variables X (sample) and Y (label), where the label is 0 for a normal sample and 1 for an abnormal sample.

[0143] The system first loads the dataset and performs standardization on the samples, ensuring that each feature dimension follows a distribution with a mean of 0 and a standard deviation of 1, enhancing the model's adaptability to diverse datasets. The system then partitions the data using a 5-fold cross-validation strategy, dividing it into training and test sets, with 80% of the data used for training and 20% for testing.

[0144] Table 1: Description of the four benchmark datasets

[0145]

[0146] Multi-kernel fusion and kernel sparsification: This method sets multiple base kernel functions in the feature space, including linear kernels, two polynomial kernels, and multiple Gaussian kernels, totaling 12 kernel functions. Each kernel function calculates the kernel similarity between training samples to form an initial kernel matrix set.

[0147] In order to improve the expressiveness and efficiency of the model, a sparse multi-core fusion strategy is adopted. By learning adjustable kernel weight parameters, multiple kernel functions are weighted and combined to form the final fusion kernel matrix. At the same time, a local neighborhood kernel sparsification mechanism is introduced, and the local neighborhood kernel sparsification neighborhood size k=5 is set to form a neighborhood structure based on the original space. Only the high-contribution kernel values among the local neighbors of the sample are retained to reduce redundant calculations.

[0148] Neighborhood Construction and Metric Learning: For each training sample, its first-level neighborhood is first determined based on kernel similarity, followed by its second-level neighborhood. To determine the optimal neighborhood parameter combination, the present invention employs a grid search strategy for neighborhood sizes k1 and k2, ranging from 1 to 5. Experimental results show that when k1 = 1 and k2 = 5, the model achieves optimal detection performance on all benchmark datasets, demonstrating the adaptability and robustness of the present invention in parameter setting.

[0149] The present invention designs a dual-neighborhood comparison mechanism, applying optimization objectives to different neighborhoods:

[0150] (1) Apply attraction loss to the first-layer neighborhood samples to aggregate normal samples;

[0151] (2) Apply repulsive force loss to the second-layer neighborhood samples to keep abnormal samples away from normal samples;

[0152] Based on this, a ratio-based optimization objective is constructed, and through differential transformation, the objective function is converted into a gradient-solvable form to improve the feasibility of optimization.

[0153] Model Training and Optimization: This paper employs an alternating minimization strategy, using gradient descent to optimize the contribution coefficients of the nuclear fusion weight, the attractive term, and the repulsive term. During the optimization process, a learning rate of 0.001 and a maximum number of iterations of 200 are set. The loss function is monitored for monotonic decline at each iteration to ensure stable convergence.

[0154] The output of the training phase includes the final fused kernel weights, the multi-kernel projection matrix, and the abnormal contrast amount of each sample in the training set.

[0155] Anomaly scoring and detection: During the testing phase, the system calculates the weighted kernel distance between each test sample and its nearest k1 neighbors in the training set, and combines the second-layer neighborhood information to calculate the hierarchical contrast ratio.

[0156] Finally, the system uses Extreme Value Theory to fit the abnormal score distribution on the training set and determine the judgment threshold τ. If the score of the test sample is higher than the threshold, it is judged as an abnormal sample.

[0157] Experimental Setup and Performance Verification: Our method was compared with three mainstream baseline methods on four high-dimensional public datasets, using the area under the precision-recall curve (AUPRC) as a performance metric. As shown in Table 2, using a two-layer neighborhood structure in both training and testing phases, our method achieved an average AUPRC of 87%, achieving the highest performance across all four datasets and outperforming existing methods.

[0158] Table 2: AUPRC (%) of all methods on the four datasets

[0159]

[0160] Next, the method of the present invention analyzes the changes in the objective function value during the training process and the performance of the AUPRC performance of the test case during the iteration process, such as Figures 2-4 The objective function reflects the optimization process of the proposed method, while AUPRC measures the performance of real-time anomaly detection. Experimental results show that the objective function exhibits a stable convergence trend, indicating that the optimization process is stable and effectively captures the data structure.

[0161] Then, we further explored the impact of different levels of neighborhood comparison strategies on model performance. The experiment set up four configurations, namely: the first configuration uses one-layer neighborhood in both training and testing stages; the second configuration (i.e., RMKN method) uses one-layer neighborhood in training stage and two-layer neighborhood in testing stage; the third configuration uses two-layer neighborhood in training stage and still uses one-layer neighborhood in testing stage; the fourth configuration (the method of the present invention) uses two-layer neighborhood in both training and testing stages. The experimental results are as follows. Figure 5 As shown, the two-layer neighborhood plays a particularly critical role during training. Compared to the first configuration, which only uses a one-layer neighborhood, the third configuration achieves a 10.62% improvement in AUPRC, while the second configuration improves by 7.35%. Further comparison reveals that the fourth configuration achieves an additional 10.58% improvement over the second configuration, demonstrating that using a two-layer neighborhood during both training and testing further enhances the model's anomaly detection capabilities. Overall, the introduction of a two-layer neighborhood helps capture the complex structural information of the data, improves the separation of anomaly samples, and results in more accurate detection results.

[0162] Finally, to verify the effectiveness of the sparse multi-core strategy, the complete core method (i.e., the present invention w / o SK without core sparsification) is systematically compared with the present invention method (with core sparsification). Figure 6 As shown in Figure 3, in all datasets, the proposed method outperforms the variant without sparse strategy, with an average AUPRC improvement of 7.11%.

[0163] In summary, this embodiment clearly illustrates the complete implementation process of the present invention from data loading, feature modeling, metric optimization to anomaly detection. It has good practicality and scalability and is suitable for anomaly detection tasks in multiple fields such as financial risk control, network security, industrial monitoring, and medical diagnosis.

[0164] Any matters not described in detail in this specification are prior art known to those skilled in the art. Although the above description of the present invention is based on specific embodiments to facilitate understanding of the present invention by those skilled in the art, it should be understood that the present invention is not limited to the scope of the specific embodiments. As long as various modifications are within the spirit and scope of the present invention as defined and determined by the appended claims, such modifications will be obvious to those skilled in the art, and all inventions and creations utilizing the concepts of the present invention are protected.

Claims

1. An anomaly detection method based on multi-core fusion and neighborhood modeling, characterized in that: The main steps include: Step 1: Load the input sample dataset And for each sample in the original space, find its k nearest neighbors to form a neighborhood structure based on the original space. Based on the neighborhood structure, use the kernel function to locally estimate the similarity between samples, and generate multiple structure-aware sparse kernel matrices through graph structure construction as the basis for subsequent processing; Step 2: Fuse multiple sparse kernel matrices and learn the expression of each sample in the fusion space by introducing a sample adaptive weight mechanism. Based on this expression, define the adaptive kernel distance D between samples. ψ (x, x'), used for subsequent neighborhood partitioning and relationship modeling; Step 3: Construct a two-layer neighborhood structure: the first layer of neighborhood aggregates similar samples, and the second layer of neighborhood is used to enhance the separation of abnormal boundaries; design a structural contrast loss function and introduce auxiliary variables And conduct joint optimization training to gradually learn the structural parameters that can distinguish abnormalities from normal ones; Step 4: Using the structural parameters V,b obtained in training, we perform structural analysis on the new sample in the testing phase. By comparing the distance relationship between it and the neighboring samples, we calculate the anomaly score and determine whether it is an anomaly based on the set threshold.

2. The anomaly detection method based on multi-core fusion and neighborhood modeling according to claim 1 is characterized in that: The specific operations of step 1 are: Suppose there are m basic kernel matrices Where each basic kernel matrix K v By the basic kernel function κ v (x,x') is generated, for the i-th sample x in the input sample data set i , identify its k nearest neighbors, where k is the preset neighborhood scale parameter, and form a neighborhood structure based on the original space: Kernel approximation using the Nadaraya-Watson estimator: Among them, y j Represents sample x j The label value of k ij Represents sample x i and x j Based on the kernel similarity between the two, a local normalized similarity matrix S is constructed, which is defined as S = [s ij ],s ij Defined as: Construct the neighborhood affinity graph matrix A and degree matrix D: Among them, a ij is an element in the symmetric neighborhood affinity graph matrix A, representing the sample x i with x j The adjacency weight between them; Finally, based on the graph structure information, the sparse neighborhood perception kernel matrix K is constructed: Multiple sparse neighborhood-aware kernel matrices K serve as the input basis for learning local similarity structures in subsequent training stages.

3. The anomaly detection method based on multi-core fusion and neighborhood modeling according to claim 2 is characterized in that: The specific operations of step 2 are: Step 2.1: Set the input samples x, x' and use the obtained kernel matrix K to construct a joint embedding representation: ψ(x)=[w1(x)φ1(x) T ,…,w m (x)φ m (x) T ] T Among them, φ v (x) represents the mapping of the input sample x in the implicit feature space corresponding to the vth kernel function, satisfying κ v (x,x')=<φ v (x),φ v (x')>, T represents transposition, w v (x) is the kernel weight defined by the Sigmoid function, and then a fused kernel function is obtained: Among them, ψ(x') represents the representation of sample x' in the multi-core joint embedding space; w v (x') represents the structural weight of the sample x' corresponding to the vth basic kernel function; T represents transposition; and Respectively represent the weight parameters and bias terms corresponding to the v-th kernel function; Based on the above joint embedding representation, the adaptive kernel distance in the joint embedding space is defined as: Among them, V,b is the kernel parameter learned in the training phase, 4. The anomaly detection method based on multi-core fusion and neighborhood modeling according to claim 3 is characterized in that: The specific operations of step 3 are: Step 3.1: Construct a two-layer neighborhood structure and establish two types of constraints through the attraction-repulsion mechanism: Attraction constraint: Select the nearest k1 neighbors of each sample to form the first layer of neighborhood Next, a local aggregation constraint is imposed to minimize the distance between the first-layer neighborhood samples: Among them, ω(x,x') is the similarity weight, which is defined using a polynomial kernel: Exclusion constraint: Select the nearest k2 neighbors of the first-order neighbors to form the second-level neighborhood Next, a separation constraint is imposed to maximize the distance between the second-layer neighborhood samples: Step 3.2: Integrate the attraction and repulsion constraints into a unified structural contrast loss function and set the optimization goal Step 3.3: Convert the ratio target to the difference target and introduce the auxiliary coefficient at iteration t Used to approximate the optimization objective: Then construct a linearized proxy loss function, the formula is: The proxy loss function is fixed at α (t) Based on this, the gradient update is performed on the parameter D∈{V,b}, and its gradient expression is: For each kernel parameter v v and bias b v , metric function D ψ The gradient calculation formula is: Among them, the derivative of the weight function is: Step 3.4: Update the model parameters using gradient descent: Among them, η is the learning rate to ensure the stability of the optimization process; the maximization-minimization optimization strategy is adopted to alternately optimize the auxiliary coefficient α (t) And parameters V,b, ensure that the loss function gradually decreases, ensuring that the loss function It decreases monotonically and eventually converges to a stable point.

5. The anomaly detection method based on multi-core fusion and neighborhood modeling according to claim 4 is characterized in that: The specific operations of step 4 are: In the testing phase, the reverse weighting strategy is adopted, and the test sample is x * , whose first-level neighborhood is The second-level neighborhood is The metric distance between samples is defined as: Among them, V,b is the kernel parameter learned in the training phase, and the anomaly score is calculated as follows: Among them, the molecule calculates the weighted metric distance between the test sample and the first layer of neighborhood samples, and combines the similarity weight w(x * ,x i ) is reverse normalized, and the denominator calculates the metric distance between the first-layer neighborhood samples and their second-layer neighborhood samples; Based on the calculated anomaly score s(x * ), anomaly detection decision is made by setting the threshold τ to determine whether the sample is an abnormal sample: Among them, τ is set by extreme value theory on the verification data to control the false alarm rate.

Images