Model training method, anomaly detection method, medium, product and computer equipment

Abstract

The invention relates to a model training method, an anomaly detection method, a medium, a product and computer equipment, and the method comprises the steps: obtaining a processing result of mapping a normal data sample and an abnormal data sample to a high-dimensional spherical space through a to-be-trained network model; and based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing result, determining the loss of the network model so as to train the network model through the loss to obtain a target model, the target model being used for performing anomaly detection. Due to the introduction of the abnormal data sample, the difference between the normal data and the abnormal data can be enhanced, the robustness and universality of the target model can be improved, and an appropriate boundary can be found between the normal data and the abnormal data, so that the target model can balance the false alarm rate and the omission rate of the abnormal detection, and the accuracy of the abnormal detection is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a model training method, anomaly detection method, medium, product and computer equipment. Background Art

[0002] Anomaly detection is a crucial data mining and analysis technology. Its core goal is to accurately identify unusual data points or patterns in a dataset that significantly deviate from normal or expected behavior. Anomaly detection plays a crucial role in today's industrial landscape. Industrial production processes typically generate vast amounts of data, encompassing equipment operating parameters, sensor data, production quality indicators, and more. Anomaly detection technology enables real-time monitoring and analysis of this data, enabling the timely identification of potential issues and anomalies.

[0003] Related technologies use deep learning or machine learning to detect anomalies. Machine learning typically analyzes and summarizes patterns in normal data and uses these patterns to classify normal and abnormal data, resulting in a high rate of missed detections. Deep learning, on the other hand, employs a binary classification approach. While these algorithms can guarantee performance on training and validation sets, they can experience high false alarm rates in field tests due to the variety of abnormal data. These two approaches cannot guarantee the accuracy of anomaly detection. Summary of the Invention

[0004] The embodiments of the present application provide a model training method, anomaly detection method, medium, product and computer equipment, which can solve the technical problem of low accuracy in anomaly detection, balance the false alarm rate and missed detection rate of anomaly detection, and at least partially solve the above technical problems.

[0005] In order to achieve the above objectives, according to the first aspect of the present application, a model training method is provided, the method comprising:

[0006] Obtain processing results of mapping normal data samples and abnormal data samples into high-dimensional spherical space respectively through the network model to be trained;

[0007] Based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing result, the loss of the network model is determined, so as to train the network model through the loss to obtain a target model, and the target model is used for anomaly detection.

[0008] According to a second aspect of the present application, a method for detecting anomalies is provided, the method comprising:

[0009] The data to be detected is input into the target model for anomaly detection processing to obtain a detection result, wherein the target model is trained based on the model training method described in the first aspect above.

[0010] According to a third aspect of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned model training method or the above-mentioned anomaly detection method is implemented.

[0011] According to a fourth aspect of the present application, a computer program product is provided, comprising a computer program, which implements the above-mentioned model training method or the above-mentioned anomaly detection method when executed by a processor.

[0012] According to a fifth aspect of the present application, a computer device is provided, comprising a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute the steps of the model training method described in the first aspect or the steps of the above-mentioned anomaly detection method.

[0013] The model training method, anomaly detection method, medium, product and computer equipment of the embodiment of the present application obtain the processing results of mapping normal data samples and abnormal data samples to high-dimensional spherical space respectively through the network model to be trained; based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing results, the network model is trained through the loss to obtain a target model, and the target model is used for anomaly detection. Due to the introduction of abnormal data samples, the network model not only learns the characteristics of normal data samples, but also learns the difference between normal data and abnormal data, thereby strengthening the difference between normal data and abnormal data, helping the network model to better distinguish normal data from abnormal data, improving the robustness and versatility of the trained network model, and extracting the key features of normal data samples, thereby finding a suitable boundary between normal data and abnormal data, so that the trained target model can balance the false alarm rate and missed detection rate of anomaly detection, thereby improving the accuracy of anomaly detection.

[0014] Other features and advantages of the present application will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] To more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present application. Those skilled in the art can also derive other drawings based on these drawings without inventive effort.

[0016] In order to more completely understand the present application and its beneficial effects, the following description will be given in conjunction with the accompanying drawings, wherein the same drawing numbers represent the same parts in the following description.

[0017] Figure 1 is a flowchart of a model training method provided in some embodiments of the present application;

[0018] Figure 2 is a schematic diagram of the process of pre-training feature extraction provided in some embodiments of the present application;

[0019] Figure 3 is a schematic diagram of a process for pre-training a sphere center provided in some embodiments of the present application;

[0020] Figure 4 is a schematic diagram of the training process of the network model provided in some embodiments of the present application;

[0021] Figure 5 is a schematic diagram of a target model testing process provided in some embodiments of the present application;

[0022] Figure 6 1 is a flowchart of pre-training feature extraction for a multi-anomaly detection task provided in some embodiments of the present application;

[0023] Figure 7 is a flowchart of pre-training sphere centers for a multi-anomaly detection task provided in some embodiments of the present application;

[0024] Figure 8 Schematic diagram of the training process of the network model for the multi-anomaly detection task provided in some embodiments of the present application;

[0025] Figure 9 is a flowchart of an anomaly detection method provided in some embodiments of the present application;

[0026] Figure 10 It is a schematic diagram of the structure of a computer device provided in some embodiments of the present application. DETAILED DESCRIPTION

[0027] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the embodiments described are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0028] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance or implicitly specify the number of technical features indicated. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more features. In the description of this application, "plurality" means two or more, unless otherwise specifically defined.

[0029] In the description of this application, the word "for example" is used to mean "used as an example, illustration or illustration". Any embodiment described in this application as "for example" is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is given to enable any person skilled in the art to implement and use the present invention. In the following description, details are listed for the purpose of explanation. It should be understood that a person of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other examples, well-known structures and processes are not elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but is consistent with the widest scope consistent with the principles and features disclosed in this application.

[0030] In related technologies, anomaly detection data can be summarized and organized into a large amount of similar normal data and a small amount of diverse abnormal data. This has led to two different technical approaches. The first is an evolution of traditional machine learning techniques, such as the iteration of support vector machines (SVM) and deep support vector data description (DeepSVDD). These approaches operate on normal data, using traditional or deep learning feature strategies to analyze and summarize patterns in normal data and use these patterns to classify normal and abnormal data. The advantage of these methods is that false alarm rates are generally extremely low because normal data is plentiful and complete, but missed detection rates cannot be guaranteed. The second technical approach is a deep learning classification algorithm approach. The solution is to treat normal and abnormal data as two categories in a binary classification problem. The algorithmic approach is essentially the same as that of popular binary classification problems. These algorithms can guarantee performance on training and validation sets, but in actual field testing, the diverse abnormal data leads to a similarly low false alarm rate.

[0031] In order to solve the above problems, an embodiment of the present application provides a model training method, which obtains the processing results of mapping normal data samples and abnormal data samples to a high-dimensional spherical space respectively through a network model to be trained; based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing results, determines the loss of the network model, and trains the network model through the loss to obtain a target model, which is used for anomaly detection. Due to the introduction of abnormal data samples, the network model not only learns the characteristics of normal data samples, but also learns the difference between normal data and abnormal data, thereby strengthening the difference between normal data and abnormal data, helping the network model to better distinguish normal data from abnormal data, improving the robustness and versatility of the trained network model, and extracting the key features of normal data samples, thereby finding a suitable boundary between normal data and abnormal data, so that the trained target model can balance the false alarm rate and missed detection rate of anomaly detection, thereby improving the accuracy of anomaly detection.

[0032] See also Figure 1 , provides a model training method, which is applied to a computer device. The computer device may be a terminal device or a server. The method includes:

[0033] Step S101: Obtain processing results of mapping normal data samples and abnormal data samples to high-dimensional spherical space through the network model to be trained.

[0034] The network model to be trained may be a neural network model, which is used to minimize the partitioning hypersphere of the calculated data feature space using the neural network model training, and then determine whether the data point is abnormal based on the distance between the center of the sphere and the test data point.

[0035] Both normal data samples and abnormal data samples are samples used to train the network model to be trained and serve as input data of the network model. That is, the training samples in the network model to be trained include normal data samples and abnormal data samples.

[0036] The processing result is the result of mapping the normal data samples and abnormal data samples into the high-dimensional spherical space by inputting them into the network model to be trained, that is, mapping the normal data samples and abnormal data samples into the high-dimensional spherical space by the network model to be trained (such as a neural network). This process can be completed by the encoder part of the network. The processing result is the representation of each normal data sample and abnormal data sample in the high-dimensional spherical space, denoted as φ(x i ; W), where x i is a normal data sample or an abnormal data sample, and W is the weight of the network in the network model.

[0037] Specifically, the normal data samples and abnormal data samples are mapped to a high-dimensional spherical space through the network model to be trained to obtain the processing results, so that the processing results can accurately characterize the key features of the training samples, and use normal data samples and abnormal data samples simultaneously in the training process. By introducing abnormal data samples, the network model not only learns the features of normal data samples, but also learns the differences between normal data and abnormal data, thereby strengthening the differences between normal data and abnormal data, helping the network model to better distinguish between normal data and abnormal data, and improving the robustness and versatility of the trained network model. It can be understood that in this embodiment, compared with the traditional training that only targets normal data samples, the introduction of abnormal data samples strengthens the differences between normal data and abnormal data.

[0038] Step S102: Based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing result, determine the loss of the network model, and train the network model through the loss to obtain a target model, wherein the target model is used for anomaly detection.

[0039] Specifically, based on the hypersphere corresponding to the normal data samples in the high-dimensional spherical space and the processing results, the loss of the network model can be determined by the single-class deep support vector data description algorithm, so as to train the network model through the loss to obtain the target model.

[0040] The one-class deep support vector data description algorithm (One-Class Deep Support Vector Data Description, One-Class Deep SVDD) is an anomaly detection algorithm based on deep learning, which is mainly used to process the situation where the training samples mainly contain normal data samples. The algorithm maps the data to a low-dimensional feature space through a neural network and constructs a hypersphere with a minimum volume in this space, so that normal data points are concentrated as much as possible inside the hypersphere, while abnormal data points are mapped to the outside of the hypersphere. That is, One-Class Deep SVDD mainly uses normal data samples for training, and in this embodiment, by introducing abnormal data samples, the robustness and versatility of the trained network model can be improved. The One-Class Deep SVDD algorithm can effectively extract the key features of normal data samples, strengthen the difference between normal data and abnormal data, and improve the robustness and versatility of the model, thereby finding a suitable boundary between normal data and abnormal data, so that the trained target model can balance the false alarm rate and missed detection rate of anomaly detection, thereby improving the accuracy of anomaly detection.

[0041] The hypersphere corresponding to the normal data samples in the high-dimensional spherical space is achieved by using normal data samples so that the network model can learn the common characteristics of normal data and then construct a hypersphere that can effectively describe the distribution of normal data samples.

[0042] The target model refers to the anomaly detection model obtained after training the network model to be trained, which is used for anomaly detection tasks.

[0043] Loss refers to the loss value corresponding to the loss function of the network model.

[0044] Specifically, based on the hypersphere corresponding to the normal data samples in the high-dimensional spherical space and the processing results, a one-class deep support vector data description algorithm can be used to determine the loss of the network model, and the network model can be trained based on the loss to obtain a target model. It can be understood that in this embodiment, the one-class deep SVDD algorithm can effectively extract the key features of normal data samples, strengthen the difference between normal data and abnormal data, and improve the robustness and versatility of the model, thereby finding a suitable boundary between normal data and abnormal data, so that the trained target model can balance the anomaly detection false alarm rate and missed detection rate, thereby improving the accuracy of anomaly detection.

[0045] In a specific embodiment, the process of training the network model through loss to obtain the target model can be to optimize the above loss and update the network weight W, the center c and radius R of the hypersphere in the network model. The training process is specifically as follows:

[0046] Forward propagation: Input the training samples including normal data samples and abnormal data samples into the network model, and calculate the processing result of mapping each training sample to the high-dimensional spherical space, that is, the high-dimensional representation φ(x i ; W).

[0047] Calculate loss: Based on the above loss, calculate the total loss under the current network model parameters.

[0048] Back propagation: Update the network model parameters W and the center c of the hypersphere by calculating the gradient of the total loss to the network model parameters.

[0049] Update the radius of the hypersphere: In each training iteration, the radius R of the hypersphere is updated according to the model parameters of the current network model and the feature representation of the normal sample data.

[0050] Repeat step: Repeat the above steps until the loss converges or the preset number of iterations is reached.

[0051] In some embodiments, the processing results include the processing results corresponding to the normal data samples and the processing results corresponding to the abnormal data samples; determining the loss of the network model based on the hypersphere corresponding to the normal data samples in the high-dimensional spherical space and the processing results includes: calculating a first loss based on the processing results corresponding to the normal data samples and the center of the hypersphere, and calculating a second loss based on the processing results corresponding to the abnormal data samples and the center of the hypersphere; determining the loss of the network model based on the first loss and the second loss.

[0052] The processing results include processing results corresponding to normal data samples and processing results corresponding to abnormal data samples. Accordingly, the first loss is the processing results corresponding to the normal data samples and the center of the hypersphere. In some embodiments, the first loss is used to indicate the distance from the normal data sample to the center of the sphere; the second loss is the processing results corresponding to the abnormal data sample and the center of the hypersphere. In some embodiments, the second loss is used to indicate the distance from the abnormal data sample to the center of the sphere.

[0053] In some embodiments, the closer the distance between the normal data sample and the center of the sphere is, the smaller the first loss is, that is, the first loss corresponding to the normal data sample can be obtained by minimizing the distance between the normal data sample and the center of the sphere.

[0054] In some embodiments, the closer the distance between the abnormal data sample and the center of the sphere is, the greater the second loss is, that is, the second loss corresponding to the abnormal data sample can be achieved by maximizing the distance between the abnormal data sample and the center of the hypersphere.

[0055] Specifically, a single-class deep support vector data description algorithm can be used to calculate a first loss based on the processing results corresponding to normal data samples and the center of the hypersphere, and a second loss based on the processing results corresponding to abnormal data samples and the center of the hypersphere. It can be understood that by calculating the second loss in this embodiment, a penalty is imposed on abnormal data entering the high-dimensional sphere space. This allows the target model to better identify abnormal data, thereby reducing the possibility of abnormal data being misclassified as normal data and lowering the missed detection rate.

[0056] In some embodiments, the calculating of the first loss based on the processing result corresponding to the normal data sample and the center of the hypersphere includes: determining a first distance parameter of the normal data sample based on the distance between the processing result corresponding to the normal data sample and the center of the hypersphere; and obtaining a first loss based on the first distance parameter.

[0057] Among them, in the single-class deep support vector data description algorithm, the loss includes the distance from the normal data sample to the center of the sphere.

[0058] The first distance parameter is a parameter related to the distance between the processing result corresponding to the normal data sample and the center of the hypersphere. For example, for a given normal data sample, D n ={(x1,y1),...,(x n ,y n )}, where D i y in i =1, the center of the sphere c, the first distance parameter L1 can be calculated by the following formula:

[0059] L1=||φ(x i ;W)-c||;

[0060] The first loss can be the result calculated after the correlation processing of the first distance parameter, which is used to measure the difference between the predicted value and the true value of the network model. For example, the correlation processing can calculate the mean square error (MSE), that is, the square difference between the predicted value and the true value. In some embodiments, the first loss is obtained by averaging the cumulative sum of the squares of the first distance parameters of multiple normal data samples. The first loss S1 can be calculated by the following formula:

[0061] Right now

[0062] Where n is the number of normal data samples.

[0063] Specifically, a single-class deep support vector data description algorithm can be used to determine the first distance parameter of the normal data sample based on the processing results corresponding to the normal data sample and the distance from the center of the hypersphere. Then, based on the first distance parameter, the first loss is obtained, which makes the data points corresponding to the normal data sample as close to the center of the sphere as possible in the high-dimensional spherical space, thereby improving the target model's ability to recognize normal data.

[0064] In some embodiments, the second loss is calculated based on the processing result corresponding to the abnormal data sample and the center of the hypersphere, including: determining a second distance parameter of the abnormal data sample based on the processing result corresponding to the abnormal data sample and the distance from the center of the hypersphere; taking the inverse of the square of the second distance parameter to obtain a third distance parameter of the abnormal data sample; and obtaining the second loss based on the third distance parameter.

[0065] Among them, the second loss is the loss of the distance from the added abnormal data sample to the center of the sphere in the single-class deep support vector data description algorithm, that is, it is proposed to punish the abnormal data samples entering the high-dimensional spherical space.

[0066] The second distance parameter is a parameter related to the distance between the processing result corresponding to the abnormal data sample and the center of the hypersphere. For example, for a given normal data sample, in in = -1, sphere center c, the second distance parameter L2 can be calculated by the following formula:

[0067]

[0068] The third distance parameter refers to a distance parameter obtained by performing corresponding processing on the second distance parameter. For example, the second distance parameter is squared and the reciprocal is taken. The calculation formula of the third distance parameter L3 is as follows:

[0069] The second loss may be a result calculated after correlation processing of the third distance parameter, which is used to measure the inverse of the difference between the predicted value and the true value of the network model. Exemplarily, the correlation processing may calculate the inverse of the mean squared error (MSE), that is, the inverse of the squared difference between the predicted value and the true value. In some embodiments, obtaining the second loss based on the third distance parameter includes: obtaining the second loss based on the third distance parameter and a preset hyperparameter.

[0070] Among them, the preset hyperparameters are the hyperparameters in the pre-set loss, which are used to control the penalty intensity of abnormal data samples.

[0071] In some embodiments, obtaining the second loss based on the third distance parameter and a preset hyperparameter includes:

[0072] The second loss is obtained by averaging the accumulated sum of the third distance parameters of multiple abnormal data samples and the preset hyperparameters.

[0073] In some embodiments, the second loss is obtained by averaging the cumulative sum of the third distance parameter based on multiple abnormal data samples and a preset hyperparameter, including: multiplying the result value of averaging the cumulative sum of the third distance parameter based on multiple abnormal data samples by the preset hyperparameter to obtain the second loss.

[0074] The second loss S2 can be calculated by the following formula:

[0075] Right now

[0076] Among them, m is the number of normal data samples, and v is the preset hyperparameter.

[0077] Specifically, a single-class deep support vector data description algorithm can be used to determine the third distance parameter of the abnormal data sample based on the processing result corresponding to the abnormal data sample and the distance from the center of the hypersphere. Then, based on the third distance parameter and the preset hyperparameter, a second loss is obtained. The processing result of the abnormal data sample is mapped outside the hypersphere, allowing the model to better distinguish between normal data and abnormal data. By calculating the second loss, the model can learn the difference between abnormal data and normal data and push the abnormal data samples away from the hypersphere. This enables the target model to better identify abnormal data, thereby improving the robustness of the model.

[0078] It is worth noting that the role of the preset hyperparameter is to increase the penalty for abnormal data samples. When the preset hyperparameter v is equal to 1, the theoretical segmentation radius is 1. When the preset hyperparameter v is greater than 1, the theoretical segmentation radius is 1 / v. Therefore, the desired balance between false alarm rate and missed detection rate can be obtained by adjusting the hyperparameter. In theory, when the hyperparameter is set to 1, the dividing line between normal data and abnormal data is at a distance of 1 from the center of the sphere. If you want to adjust the false alarm rate and missed detection rate, you can adjust the parameter so that the position of the dividing line between normal data and abnormal data will change, thereby adjusting the false alarm rate and missed detection rate.

[0079] In some embodiments, determining the loss of the network model based on the first loss and the second loss includes: calculating a third loss based on the model weights and regularization parameters of the network model; and determining the loss of the network model based on the first loss, the second loss, and the third loss.

[0080] In some embodiments, the third loss is calculated based on the model weights and regularization parameters of the network model, including: obtaining the third loss according to the cumulative sum of the F-norms of the weights of each layer in the model weights and the regularization parameters.

[0081] In some embodiments, the third loss is obtained based on the cumulative sum of the F-norms of the weights of each layer in the model weights and the regularization parameter, including: multiplying the cumulative sum of the F-norms of the weights of each layer in the model weights by half of the regularization parameter to obtain the third loss.

[0082] In some embodiments, the third loss is obtained based on the cumulative sum of the F-norms of the weights of each layer in the model weights and the regularization parameter, including: multiplying the cumulative sum of the F-norms of the weights of each layer in the model weights by half of the regularization parameter to obtain the third loss.

[0083] The third loss is a regularization term for the model weights of the network model, which is used to prevent overfitting. The third loss S3 can be calculated using the following formula:

[0084] Among them, ||W l || 2 is the F-norm of the l-th layer weight in the model weights, where L is the total number of layers of model weights, i.e., the Frobenius norm. λ is the regularization parameter, which is used to control the strength of regularization.

[0085] In some embodiments, the loss of the network model is determined based on the first loss, the second loss, and the third loss, including: summing the first loss, the second loss, and the third loss, and taking minimization of the sum value as the optimization goal to obtain the loss of the network model.

[0086] Among them, the loss S of the network model can be calculated by the following formula:

[0087] Right now

[0088]

[0089] Specifically, loss minimization is the optimization goal, so that normal data samples are penalized by the MSE of the normal data samples to the center of the sphere, meaning that normal data samples are preferred to be as close to the center of the sphere as possible; abnormal data samples are penalized by the inverse of the MSE of the abnormal data samples to the center of the sphere, meaning that abnormal data are preferred to be as far away from the center of the sphere as possible. Therefore, the theory of separating normal data from abnormal data in high-dimensional spherical space can be naturally implemented. That is, normal data is clustered in a hypersphere with a radius of 1 and a center of c in high-dimensional spherical space, while abnormal data is positioned as far away from this hypersphere as possible. Normal data is mapped to the center of the sphere, while abnormal data is infinitely far away from the center of the sphere, which naturally has robustness.

[0090] In some embodiments, the training of the network model through the loss to obtain the target model includes: adjusting the model weights of the network model through the loss by a stochastic gradient descent algorithm to train the network model and obtain the target model.

[0091] Among them, Stochastic Gradient Descent (SGD) is an optimization function used to update the weights of neural networks in order to minimize the loss.

[0092] Specifically, the computer device uses the SGD algorithm to adjust the model weights of the network model through loss to train the network model, which can accelerate the convergence of the model to improve the optimization efficiency, improve the training efficiency of the network model, and improve the performance of the target model.

[0093] In some embodiments, the model weights of the network model are not all zero.

[0094] Specifically, reasonable model weight initialization can accelerate the convergence of the network model and improve the network training efficiency. Non-all-zero initialization is key to ensuring that the network can learn the data characteristics, avoiding network symmetry problems and hypersphere collapse.

[0095] In some embodiments, the hidden layer in the network model is provided with an offset term.

[0096] Among them, the bias term (Bias) is a trainable parameter of each neuron in the neural network, which is added to the weighted input before the activation function of the neuron.

[0097] Specifically, the offset term provides more degrees of freedom for the network model, enabling the model to better fit complex data distributions.

[0098] In some embodiments, before obtaining the processing results of mapping normal data samples and abnormal data samples to a high-dimensional spherical space respectively through the network model to be trained, the method also includes: determining the center of the hypersphere corresponding to the normal data sample in the high-dimensional spherical space based on the autoencoder network and the normal data sample.

[0099] Specifically, to improve the convergence speed and performance of the network model, an auto-encoder (AE) can be used to pre-train the network model. The goal of pre-training is to initialize the network parameters so that the network model can better extract the features of normal data samples. Then, the encoder portion of the auto-encoder network is used to extract features from all normal data samples. The mean of these feature representations is calculated as the center c of the hypersphere.

[0100] In some embodiments, the autoencoding network includes an encoding network and a first decoding network; determining the center of the hypersphere corresponding to the normal data sample in the high-dimensional spherical space based on the autoencoding network and the normal data sample includes: training the encoding network based on the normal data sample to obtain a trained autoencoding network, the trained autoencoding network includes the encoding network and a second decoding network; determining the center of the sphere based on the encoding network and the second decoding network and the normal data sample.

[0101] The self-encoding network includes an encoding network and a first decoding network.

[0102] In some embodiments, determining the center of the sphere based on the encoding network, the second decoding network and the normal data samples includes: encoding each of the normal data samples through the encoding network to obtain encoding features corresponding to the normal data samples; decoding multiple encoding features through the second decoding network to obtain multiple decoding results; and determining the center of the hypersphere based on the multiple decoding results.

[0103] In some embodiments, determining the center of the hypersphere based on the multiple decoding results includes: obtaining the center of the hypersphere based on an average of the multiple decoding results.

[0104] In some embodiments, the backbone network in the encoding network is determined to be the backbone network of the network model. In some embodiments, the network model also includes at least one target decoding network connected to the backbone network, and each target decoding network corresponds to a detection task. The encoding network includes a backbone network, and the backbone network is the backbone network of the network model. In this way, for different anomaly detection tasks, multiple decoding networks can share the same backbone to achieve different anomaly detection tasks.

[0105] Specifically, an encoding network is trained based on normal data samples to obtain a trained autoencoding network, and each normal data sample is encoded by the encoding network to obtain encoding features corresponding to the normal data samples; multiple encoding features are decoded by a second decoding network to obtain multiple decoding results; and the center of the hypersphere is obtained based on the mean of the multiple decoding results.

[0106] In one embodiment, Figure 2-Figure 4 As shown in Figure 1, it is a schematic diagram of the training process of the network model to be trained, where: Figure 2 Schematic diagram of the process of extracting features for pre-training, Figure 3 This is a flowchart for pre-training the center of the sphere. Figure 4 The following is a diagram of the training process of the network model. The training process of the network model to be trained is as follows:

[0107] First, only normal data is used for initialization; the backbone network is provided as the encoding network of the Auto-Encoder network, and the decoding network W_1 of the Auto-Encoder network is customized;

[0108] Then, the AE network is trained to extract the core information of normal data through the backbone and restore the information through the decoding network. The loss function is MSE.

[0109] Next, replace the Auto-Encode decoding network W_2 and lock the parameters of the backbone network. For the new decoding network, the loss function is also MSE. The goal of MSE is to aggregate the output of the decoding network of normal data to the same center point. The target benchmark is the mean of all normal data outputs after the previous epoch.

[0110] Finally, the training ends with a backbone, a decoding network W_2 and the center of the sphere (center point).

[0111] In some embodiments, the method further includes: mapping a normal data test sample to a high-dimensional spherical space through the target model to obtain a test result; and determining a performance score for measuring the detection performance of the target model based on the test result and the distance between the centers of the hypersphere.

[0112] Among them, the performance score is an evaluation indicator used to evaluate the detection performance of the target model.

[0113] The test results are the feature representations of normal data test samples in high-dimensional spherical space.

[0114] Specifically, a normal data test sample is mapped to a high-dimensional spherical space through a network model to obtain a test result, and a performance score for measuring the detection performance of the network model is determined based on the test result and the distance between the centers of the hypersphere.

[0115] In a specific embodiment, for a data point x∈X of a normal data test sample, the performance score may be defined as the distance between the data point corresponding to the test result and the center c of the sphere.

[0116] s(x)=||φ(x;W * )-c|| 2

[0117] Where s(x) represents the performance score, W * Represents the weight of the model after training.

[0118] It is worth noting that the goal is to cluster normal data within the center of the sphere, and abnormal data should be clustered as far away from the center as possible. By modifying the s(x) index, a balance between false alarm rate and missed detection rate can be achieved. The closer the s(x) value is to 0, the lower the missed detection rate.

[0119] In one embodiment, Figure 5 The figure shows a schematic diagram of the target model testing process.

[0120] In one embodiment, Figure 6-Figure 8 As shown, it corresponds to Figure 2-Figure 4 Schematic diagram of the training process of the network model used for multiple anomaly detection tasks, where: Figure 6 Schematic diagram of the process of extracting features for pre-training of multiple anomaly detection tasks, Figure 7 Schematic diagram of the process of pre-training sphere centers for multiple anomaly detection tasks. Figure 8 Schematic diagram of the training process of the network model for multiple anomaly detection tasks.

[0121] The above-mentioned model training method obtains the processing results of mapping normal data samples and abnormal data samples to a high-dimensional spherical space respectively through the network model to be trained; based on the hypersphere corresponding to the normal data samples in the high-dimensional spherical space and the processing results, the loss of the network model is determined by a single-class deep support vector data description algorithm, so as to train the network model with the loss to obtain a target model, and the target model is used for anomaly detection. Due to the introduction of abnormal data samples, the network model not only learns the characteristics of normal data samples, but also learns the differences between normal data and abnormal data, thereby strengthening the differences between normal data and abnormal data, helping the network model to better distinguish normal data from abnormal data, improving the robustness and versatility of the trained network model, and extracting the key features of normal data samples, thereby finding a suitable boundary between normal data and abnormal data, so that the trained target model can balance the false alarm rate and missed detection rate of anomaly detection, thereby improving the accuracy of anomaly detection.

[0122] See also Figure 9 , provides an anomaly detection method, which is applied to a computer device. The computer device may be a terminal device or a server. The method includes:

[0123] S201, inputting the data to be detected into the target model for anomaly detection processing to obtain a detection result, wherein the target model is trained based on a model training method.

[0124] The data to be detected refers to data that needs to be detected for abnormalities, such as equipment operating parameters, sensor data, equipment image data, etc.

[0125] Specifically, the data to be detected is input into the target model, and the output of the target model is the detection result. Since the target model in this embodiment is trained based on the model training method, it is ensured that the target model can balance the false alarm rate and missed detection rate of anomaly detection, thereby improving the accuracy of the detection result.

[0126] The above-mentioned anomaly detection method obtains a detection result by inputting the data to be detected into the target model for anomaly detection processing, wherein the target model is trained based on the model training method, ensuring that the target model can balance the false alarm rate and missed detection rate of anomaly detection, thereby improving the accuracy of the detection result.

[0127] It should be understood that, although the steps in the flowcharts of the above embodiments are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the flowcharts of the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily performed at the same time, but can be performed at different times. The execution order of these steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of steps or stages in other steps.

[0128] Based on the same inventive concept, the present application also provides an abnormal data detection device for implementing the model training method involved in the above-mentioned embodiment in which a computer device is the execution subject. The implementation solution provided by this device is similar to the implementation solution described in the above-mentioned method. Therefore, the specific limitations in one or more abnormal data detection device embodiments provided below can be referred to the limitations of the model training method involved in the embodiment in which a computer device is the execution subject above, and will not be repeated here.

[0129] Each module in each of the above devices may be implemented in whole or in part through software, hardware, or a combination thereof. Each of the above modules may be embedded in or independent of the processor in the control device in hardware form, or may be stored in a memory in a computer device in software form, so that the processor can call and execute the corresponding operations of each of the above modules.

[0130] In some embodiments, a computer device is provided, whose internal structure diagram can be as follows: Figure 10As shown. The computer device includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. The processor, the memory and the input / output interface are connected via a system bus, and the communication interface, the display unit and the input device are connected to the system bus via the input / output interface. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a model training method is implemented.

[0131] Optionally, the computer device further includes a display unit. The display unit of the computer device is used to produce a visually visible image and may be a display screen, a projection device, or a virtual reality imaging device. The display screen may be a liquid crystal display or an electronic ink display screen. The input device of the computer device may be a touch layer covering the display screen, a keypad, a trackball, or a touchpad provided on the computer device housing, or an external keyboard, touchpad, or mouse.

[0132] Those skilled in the art will understand that Figure 10 The structure shown in the figure is only a block diagram of a part of the structure related to the scheme of the present application, and does not constitute a limitation on the control device to which the scheme of the present application is applied. The specific control device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0133] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, database or other media used in the embodiments provided in this application may include at least one of non-volatile and volatile memory. Non-volatile memory may include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory may include random access memory (RAM) or external cache memory, etc. For purposes of illustration and not limitation, RAM may be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The processors involved in the various embodiments provided herein may be general-purpose processors, central processing units (CPUs), graphics processors (GPUs), digital signal processors (DSPs), programmable logic devices (PLDs), data processing logic devices based on quantum computing, and the like, without limitation thereto.

[0134] Correspondingly, an embodiment of the present application further provides a computer device, which may be a terminal device or a server.

[0135] like Figure 10 As shown, Figure 10 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. The computer device 1000 includes a processor 1001 having one or more processing cores, a memory 1002 having one or more computer-readable storage media, and a computer program stored in the memory 1002 and executable on the processor. The processor 1001 is electrically connected to the memory 1002. Those skilled in the art will appreciate that the computer device structure shown in the figure does not constitute a limitation of the computer device, and may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0136] The processor 1001 is the control center of the computer device 1000. It connects the various parts of the entire computer device 1000 using various interfaces and lines. By running or loading software programs and / or units stored in the memory 1002 and calling data stored in the memory 1002, it executes various functions of the computer device 1000 and processes data, thereby monitoring the computer device 1000 as a whole. The processor 1001 can be a central processing unit (CPU), a graphics processing unit (GPU), a network processor (NP), etc., and can implement or execute the various methods, steps, and logic blocks disclosed in the embodiments of this application.

[0137] In the embodiment of the present application, the processor 1001 in the computer device 1000 loads instructions corresponding to one or more application processes into the memory 1002 according to the following steps. The processor 1001 then executes the application stored in the memory 1002 to implement various functions, such as using an elevation detection model to detect a target road surface based on a multi-view road surface view and obtaining the elevation value of the target road surface. The specific implementation of each of the above operations can be found in the previous embodiment and will not be repeated here.

[0138] Alternatively, as Figure 10 As shown, the computer device 1000 further includes: a touch screen 1003, a radio frequency circuit 1004, an audio circuit 1005, an input unit 1006, and a power supply 1007. Among them, the processor 1001 is electrically connected to the touch screen 1003, the radio frequency circuit 1004, the audio circuit 1005, the input unit 1006, and the power supply 1007 respectively. It can be understood by those skilled in the art that Figure 10 The computer device structure shown in the figure does not constitute a limitation to the computer device, and may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently.

[0139] The touch display screen 1003 can be used for displaying a graphical user interface and receiving the operation instructions generated by the user acting on the graphical user interface. The touch display screen 1003 can include a display panel and a touch panel. Among them, the display panel can be used for displaying the information input by the user or the information provided to the user and various graphical user interfaces of the computer device, and these graphical user interfaces can be composed of graphics, text, icons, videos and any combination thereof. Optionally, the display panel can be configured in the form of a liquid crystal display (LCD), an organic light emitting diode (OLED), etc. The touch panel can be used for collecting the touch operation of the user thereon or near it (such as the user uses any suitable object or accessory such as a finger, a stylus on the touch panel or near the touch panel), and generates corresponding operation instructions, and the operation instructions execute corresponding programs. Optionally, the touch panel can include two parts: a touch detection device and a touch computer device. Among them, the touch detection device detects the user's touch direction, detects the signal caused by the touch operation, and transmits the signal to the touch computer device; the touch computer device receives the touch information from the touch detection device, converts it into touch point coordinates, and then sends it to the processor 1001, and can receive commands sent by the processor 1001 and execute them. The touch panel can cover the display panel. When the touch panel detects a touch operation on or near it, it is transmitted to the processor 1001 to determine the type of touch event, and then the processor 1001 provides a corresponding visual output on the display panel according to the type of touch event. In an embodiment of the present application, the touch panel and the display panel can be integrated into the touch display screen 1003 to realize input and output functions. However, in some embodiments, the touch panel and the touch panel can be used as two independent components to realize input and output functions. That is, the touch display screen 1003 can also be used as part of the input unit 1006 to realize the input function.

[0140] The RF circuit 1004 may be used to transmit and receive RF signals, thereby establishing wireless communication with a network device or other computer device through wireless communication, and transmitting and receiving signals between the network device or other computer device.

[0141] Audio circuit 1005 can be used to provide an audio interface between the user and the computer device through a speaker and microphone. Audio circuit 1005 can convert received audio data into electrical signals and transmit them to the speaker, which then converts them into sound signals for output. The microphone, on the other hand, converts collected sound signals into electrical signals, which are then received by audio circuit 1005 and converted into audio data. The audio data is then output to processor 1001 for processing, and then transmitted via RF circuit 1004 to, for example, another computer device. Alternatively, the audio data can be output to memory 1002 for further processing. Audio circuit 1005 may also include an earphone jack to allow communication between external headphones and the computer device.

[0142] The input unit 1006 may be configured to receive input digital, character information, or user feature information (such as fingerprint, iris, or facial information), and generate keyboard, mouse, joystick, optical, or trackball signal input related to user settings and function control.

[0143] Power supply 1007 is used to supply power to various components of computer device 1000. Optionally, power supply 1007 can be logically connected to processor 1001 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. Power supply 1007 can also include one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and other arbitrary components.

[0144] although Figure 10 Not shown in the figure, the computer device 1000 may also include a camera, a sensor, a wireless fidelity module, a Bluetooth module, etc., which will not be described in detail here.

[0145] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0146] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0147] To this end, an embodiment of the present application provides a computer-readable storage medium, in which a plurality of computer programs are stored, and the computer program can be loaded by a processor to execute any one of the model training methods provided in the embodiment of the present application. The computer program can execute the following steps of the model training method: through the network model to be trained, obtain the processing results of mapping normal data samples and abnormal data samples to high-dimensional spherical space respectively; based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing results, determine the loss of the network model, so as to train the network model through the loss to obtain the target model. The specific implementation of each of the above operations can be found in the previous embodiments, which will not be repeated here.

[0148] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0149] Since the computer program stored in the computer-readable storage medium can execute any model training method provided in the embodiments of the present application, the beneficial effects that can be achieved by any model training method provided in the embodiments of the present application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0150] According to one aspect of the present application, a computer program product or computer program is also provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in various optional implementations of the above embodiments.

[0151] In the above-described embodiments of the abnormal data detection device, computer-readable storage medium, computer device, and computer program product, the descriptions of each embodiment have different emphases. For portions not described in detail in a particular embodiment, reference can be made to the relevant descriptions of other embodiments. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes and beneficial effects of the above-described abnormal data detection device, computer-readable storage medium, computer program product, computer device, and their corresponding units can be referred to in the description of the model training method in the above embodiments, and the details will not be repeated here.

[0152] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0153] The above are only preferred embodiments of the present application and do not constitute any form of limitation to the present application. Although the descriptions of each embodiment in the embodiments of the present application have different focuses, for parts that are not described in detail in a certain embodiment, please refer to the relevant embodiments of other embodiments. However, any simple modifications, equivalent changes and modifications made to the above embodiments based on the technical essence of the present application without departing from the content of the technical solution of the present application are still within the scope of the technical solution of the present application.

Claims

1. A model training method, characterized in that: The method comprises: Obtain processing results of mapping normal data samples and abnormal data samples into high-dimensional spherical space respectively through the network model to be trained; Based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing result, the loss of the network model is determined, so as to train the network model through the loss to obtain a target model, and the target model is used for anomaly detection.

2. The method according to claim 1, characterized in that The processing result includes the processing result corresponding to the normal data sample and the processing result corresponding to the abnormal data sample; The determining the loss of the network model based on the hypersphere corresponding to the normal data sample in the high-dimensional spherical space and the processing result includes: Calculating a first loss based on the processing result corresponding to the normal data sample and the center of the hypersphere, and calculating a second loss based on the processing result corresponding to the abnormal data sample and the center of the hypersphere; A loss of the network model is determined based on the first loss and the second loss.

3. The method according to claim 2, characterized in that The first loss is used to indicate the distance between the normal data sample and the center of the sphere.

4. The method according to claim 3, characterized in that The closer the distance between the normal data sample and the center of the sphere is, the smaller the first loss is.

5. The method according to claim 2, characterized in that The calculating the first loss based on the processing result corresponding to the normal data sample and the center of the hypersphere includes: determining a first distance parameter of the normal data sample based on a processing result corresponding to the normal data sample and a distance between the centers of the hypersphere; A first loss is obtained based on the first distance parameter.

6. The method according to claim 5, characterized in that Obtaining a first loss based on the first distance parameter includes: An average calculation is performed based on the cumulative sum of squares of the first distance parameters of multiple normal data samples to obtain a first loss.

7. The method according to claim 2, characterized in that The second loss term is used to indicate the distance between the abnormal data sample and the center of the sphere.

8. The method according to claim 2, characterized in that The closer the distance between the abnormal data sample and the center of the sphere is, the greater the second loss is.

9. The method according to claim 2, characterized in that Calculating a second loss based on a processing result corresponding to the abnormal data sample and the center of the hypersphere includes: determining a second distance parameter of the abnormal data sample based on a processing result corresponding to the abnormal data sample and a distance between the centers of the hypersphere; Calculating the inverse of the square of the second distance parameter to obtain a third distance parameter of the abnormal data sample; Based on the third distance parameter, a second loss is obtained.

10. The method according to claim 9, characterized in that The obtaining of the second loss based on the third distance parameter includes: Based on the third distance parameter and the preset hyperparameters, a second loss is obtained.

11. The method according to claim 10, characterized in that Based on the third distance parameter and the preset hyperparameters, a second loss is obtained, including: The second loss is obtained by averaging the accumulated sum of the third distance parameters of multiple abnormal data samples and the preset hyperparameters.

12. The method according to claim 11, characterized in that The second loss is obtained by averaging the accumulated sum of the third distance parameters of the multiple abnormal data samples and the preset hyperparameters, including: The second loss is obtained by multiplying the average result of the accumulated sum of the third distance parameters based on the multiple abnormal data samples by the preset hyperparameter.

13. The method according to claim 2, characterized in that The determining the loss of the network model based on the first loss and the second loss includes: Calculating a third loss based on the model weights and regularization parameters of the network model; A loss of the network model is determined based on the first loss, the second loss, and the third loss.

14. The method according to claim 13, characterized in that Calculating a third loss based on the model weights and regularization parameters of the network model includes: A third loss is obtained according to the cumulative sum of the F-norms of the weights of each layer in the model weights and the regularization parameter.

15. The method according to claim 14, characterized in that The third loss is obtained according to the cumulative sum of the F-norms of the weights of each layer in the model weights and the regularization parameter, including: The third loss is calculated by multiplying the cumulative sum of the F-norms of the weights of each layer in the model weights by half of the regularization parameter.

16. The method according to claim 15, characterized in that The determining the loss of the network model based on the first loss, the second loss, and the third loss includes: After summing the first loss, the second loss, and the third loss, minimizing the sum is used as an optimization goal to obtain the loss of the network model.

17. The method according to any one of claims 1 to 16, characterized in that: The training of the network model by the loss to obtain a target model includes: Through the loss, the model weight of the network model is adjusted by a stochastic gradient descent algorithm to train the network model and obtain a target model.

18. The method according to any one of claims 1 to 16, characterized in that: The model weights of the network model are not all zero.

19. The method according to any one of claims 1 to 16, characterized in that: The hidden layer in the network model is provided with an offset term.

20. The method according to any one of claims 1 to 16, characterized in that: Before obtaining the processing results of mapping normal data samples and abnormal data samples to high-dimensional spherical spaces respectively through the network model to be trained, the method further includes: Based on the autoencoder network and the normal data sample, a sphere center of a hypersphere corresponding to the normal data sample in the high-dimensional spherical space is determined.

21. The method according to claim 20, characterized in that The autoencoding network includes an encoding network and a first decoding network; and determining the center of a hypersphere corresponding to the normal data sample in the high-dimensional spherical space based on the autoencoding network and the normal data sample includes: Training the encoding network based on the normal data sample to obtain a trained autoencoding network, wherein the trained autoencoding network includes the encoding network and a second decoding network; The center of the sphere is determined based on the encoding network and the second decoding network and the normal data samples.

22. The method according to claim 21, characterized in that The determining the center of the sphere based on the encoding network, the second decoding network and the normal data sample includes: Performing encoding processing on each of the normal data samples through the encoding network to obtain encoding features corresponding to the normal data samples; Decoding the plurality of encoding features through the second decoding network to obtain a plurality of decoding results; A sphere center of the hypersphere is determined based on the plurality of decoding results.

23. The method according to claim 22, characterized in that The determining the center of the hypersphere based on the multiple decoding results includes: The center of the hypersphere is obtained based on the average of the multiple decoding results.

24. The method according to claim 21, wherein The backbone network in the encoding network is determined as the backbone network of the network model.

25. The method according to claim 24, characterized in that The network model also includes at least one target decoding network connected to the backbone network, and each target decoding network corresponds to a detection task.

26. The method according to any one of claims 1 to 16, characterized in that The method further comprises: Mapping the normal data test sample to a high-dimensional spherical space through the target model to obtain a test result; A performance score for measuring the detection performance of the target model is determined based on the test result and the distance between the centers of the hypersphere.

27. An anomaly detection method, characterized in that: The method comprises: The data to be detected is input into the target model for anomaly detection processing to obtain a detection result, wherein the target model is trained based on a model training method.

28. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the model training method described in any one of claims 1 to 26 or the anomaly detection method described in claim 27.

29. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, it implements the model training method described in any one of claims 1 to 26 or the anomaly detection method described in claim 27.

30. A computer device, characterized in that: include: a memory having a computer program stored thereon; A processor, configured to execute the computer program in the memory to implement the model training method described in any one of claims 1 to 26 or the anomaly detection method described in claim 27.

Images