Multi-dimensional data anomaly detection method and device, medium and program product

Abstract

The invention discloses a multidimensional data anomaly detection method and device, a medium and a program product. The method can be applied to the technical field of big data, and comprises the following steps: obtaining a static feature vector and a dynamic behavior feature matrix according to input multi-dimensional data; according to the static feature vector and the dynamic behavior feature matrix, obtaining a first score and a second score output by the dual discriminator, and obtaining a dynamic weight of the dual discriminator under the target time step; wherein the dual discriminator comprises a static feature discriminator and a time sequence behavior discriminator; and obtaining an anomaly detection result of the multi-dimensional data according to the first score, the second score and the dynamic weight. By adopting the above technical scheme, anomaly detection can be carried out from two dimensions of static characteristics and dynamic behavior characteristics, the accuracy of anomaly detection is improved through a multi-dimension cooperative detection mode, the defect of limited single-dimension discrimination capability is overcome, and the recognition precision and robustness of a complex mode are improved.

Description

Technical Field

[0001] The present invention relates to the field of big data technology, and in particular to a method, device, medium and program product for detecting anomalies in multidimensional data. Background Art

[0002] Anomaly detection in multidimensional data refers to the process of identifying samples, events, or patterns that deviate significantly from normal patterns in multidimensional data.

[0003] In the prior art, a single discriminator is generally used to detect anomalies in multidimensional data, and the discriminator is trained with a large amount of real sample data.

[0004] However, using a single discriminator for anomaly detection has limited ability to collaboratively discriminate static features and temporal features, and has low accuracy in recognizing complex patterns that combine static and temporal anomalies. Moreover, it is impossible to train a discriminator with high recognition accuracy for multidimensional data with only small samples. Summary of the Invention

[0005] The present invention provides a method, device, medium and program product for anomaly detection in multidimensional data, which can perform anomaly detection from two dimensions: static features and dynamic behavior features. The accuracy of anomaly detection is improved through multi-dimensional collaborative detection, overcoming the shortcomings of limited single-dimensional discrimination ability and improving the recognition accuracy and robustness of complex patterns.

[0006] According to one aspect of the present invention, a method for detecting anomalies in multidimensional data is provided, comprising:

[0007] Obtain static feature vectors and dynamic behavior feature matrices based on the input multidimensional data;

[0008] Obtaining a first score and a second score output by a dual discriminator according to the static feature vector and the dynamic behavior feature matrix, and obtaining a dynamic weight of the dual discriminator at a target time step; wherein the dual discriminator includes a static feature discriminator and a temporal behavior discriminator;

[0009] An anomaly detection result of the multidimensional data is obtained according to the first score, the second score, and the dynamic weight.

[0010] Optionally, based on the input multidimensional data, obtain static feature vectors and dynamic behavior feature matrices, including:

[0011] Extract static features and dynamic behavior features from the input multidimensional data, and perform data cleaning and feature normalization;

[0012] The dynamic behavior features are sorted according to the time step, and the static features and dynamic behavior features are combined according to the pre-specified feature structure to generate a static feature vector and a dynamic behavior feature matrix.

[0013] The advantage of this setting is that by performing data cleaning and feature normalization on multidimensional data, data quality can be improved, the data can have a unified scale and format, and the subsequent analysis can be avoided from being affected by different feature dimensions. The conversion from multidimensional data to static feature vectors and dynamic behavior feature matrices can provide standardized data input for subsequent data analysis.

[0014] Optionally, get the dynamic weights of the dual discriminator at the target time step, including:

[0015] According to the static feature vector and dynamic behavior feature matrix in the target time window, the static feature mutation coefficient and the dynamic feature mutation coefficient are calculated respectively;

[0016] According to the static feature mutation coefficient and the dynamic feature mutation coefficient, the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step are obtained.

[0017] The advantage of this setting is that it can achieve dynamic weight distribution based on the mutation coefficient, flexibly adjust the weights of the two discriminators according to the real-time fluctuations of the features, and improve the accuracy and adaptability of anomaly detection.

[0018] Optionally, before obtaining the static feature vector and the dynamic behavior feature matrix based on the input multi-dimensional data, the following steps are further included:

[0019] Generate a training sample set based on real sample data and the generator;

[0020] Calculating a first loss function of the dual discriminator according to the training sample set, and updating the model parameters of the dual discriminator according to the first loss function;

[0021] Based on the training sample set and the dual discriminator after parameter update, calculate the total loss of the generator, and update the generator parameters based on the total loss of the generator;

[0022] After each update of the generator parameters, the updated generator is used to update the training sample set, and the updated training sample set is used to repeatedly update the parameters of the dual discriminator and generator until the iteration condition is met.

[0023] The advantage of this setting is that through multiple rounds of cross-training between the generator and the dual discriminator, the generator can be continuously updated according to the identification results of the dual discriminator. The generator learns the inherent consistency of static features and temporal features, and generates synthetic data that is more in line with the distribution of real data. It effectively solves the problems of small scale, category imbalance or insufficient diversity of the original data set, significantly improves the generalization ability of the identification model, and then updates the dual discriminator for multiple rounds based on a large number of high-quality training samples to improve the dual discriminator's ability to identify static features and temporal features. The training adopts alternating adversarial methods, which can effectively accelerate the convergence of the model.

[0024] Optionally, generate a training sample set based on real sample data and the generator, including:

[0025] Based on real sample data, generate static feature vectors and dynamic behavior feature matrices of real sample data;

[0026] Generate random noise and input it into the generator to obtain the static feature vector and dynamic behavior feature matrix synthesized by the generator;

[0027] The static feature vector and dynamic behavior feature matrix of the real sample data, and the static feature vector and dynamic behavior feature matrix synthesized by the generator are combined to form a training sample set, and the feature type is marked by a label.

[0028] The advantage of this setting is that the generator generates a large number of supplementary samples by simulating the real data distribution, which can effectively solve the problems of small size and insufficient diversity of the original data set and significantly improve the generalization ability of the downstream model.

[0029] Optionally, calculating a first loss function of the dual discriminator according to the training sample set, and updating model parameters of the dual discriminator according to the first loss function, includes:

[0030] Input the training sample set into the dual discriminator, and calculate the first loss function of the static feature discriminator and the temporal behavior discriminator respectively according to the score output by the dual discriminator for each training sample;

[0031] Back propagation is performed according to the first loss function of the static feature discriminator to update the model parameters of the static feature discriminator, and back propagation is performed according to the first loss function of the temporal behavior discriminator to update the model parameters of the temporal behavior discriminator.

[0032] The advantage of this setting is that by calculating the first loss function through a fixed generator and using the first loss function for directional propagation to optimize the dual discriminator parameters, the dual discriminator can effectively optimize its ability to distinguish between normal and abnormal data in terms of static features and temporal features, so that the dual discriminator can efficiently extract key features and improve the accuracy and efficiency of anomaly detection.

[0033] Optionally, based on the training sample set and the dual discriminator after parameter update, calculate the total loss of the generator, and update the generator parameters based on the total loss of the generator, including:

[0034] Input the training sample set into the dual discriminator after parameter update, calculate the second loss function of the dual discriminator according to the score output by the dual discriminator for each training sample, and calculate the total loss of the generator according to the second loss function of the dual discriminator;

[0035] Backpropagation is performed based on the total loss of the generator to update the parameters of the generator.

[0036] The advantage of this setting is that by calculating the total loss of the generator based on the loss function of the dual discriminator and then backpropagating to update the generator parameters, the generator's optimization goal can be to generate data that can deceive both the static feature discriminator and the temporal behavior discriminator, so that the trained generator can generate highly confident synthetic data for the next round of dual discriminator training.

[0037] According to another aspect of the present invention, an electronic device is provided, comprising:

[0038] at least one processor; and

[0039] a memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the multi-dimensional data anomaly detection method according to any embodiment of the present invention.

[0041] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the multidimensional data anomaly detection method according to any embodiment of the present invention when executed.

[0042] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the computer program implements the multidimensional data anomaly detection method according to any embodiment of the present invention.

[0043] The technical solution of the embodiment of the present invention obtains a static feature vector and a dynamic behavior feature matrix based on the input multi-dimensional data, obtains a first score and a second score output by a dual discriminator based on the static feature vector and the dynamic behavior feature matrix, and obtains the dynamic weight of the dual discriminator at a target time step, and obtains anomaly detection results of the multi-dimensional data based on the first score, the second score and the dynamic weight. This method can perform anomaly detection from two dimensions, namely static features and dynamic behavior features, improve the accuracy of anomaly detection through multi-dimensional collaborative detection, overcome the disadvantage of limited single-dimensional discrimination ability, and improve the recognition accuracy and robustness of complex patterns.

[0044] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0046] Figure 1 This is a flowchart of a method for detecting anomalies in multidimensional data provided according to the first embodiment of the present invention;

[0047] Figure 2 This is a flowchart of another method for detecting anomalies in multidimensional data provided by the second embodiment of the present invention;

[0048] Figure 3 2 is a schematic diagram of the structure of a device for detecting anomalies in multidimensional data according to a third embodiment of the present invention;

[0049] Figure 4 The figure is a schematic diagram of the structure of an electronic device for implementing the method for detecting anomalies in multi-dimensional data according to an embodiment of the present invention. DETAILED DESCRIPTION

[0050] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0051] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0052] Example 1

[0053] Figure 1 This is a flowchart of a method for detecting anomalies in multidimensional data provided by the first embodiment of the present invention. This embodiment can be applied to simultaneously identify static features and dynamic behavior features of multidimensional data to detect data anomalies. The method can be executed by a device for detecting anomalies in multidimensional data. The device can be implemented in the form of hardware and / or software and can generally be configured in a computer or processor with data processing capabilities. Figure 1 As shown, the method includes:

[0054] S110 , obtaining a static feature vector and a dynamic behavior feature matrix according to the input multi-dimensional data.

[0055] Optionally, multidimensional data refers to a data set that contains features from multiple dimensions, and each data sample is described by multiple attributes. For example, in product production data, a sample may contain multiple attributes such as product model, production time, temperature, and pressure; static features refer to features that do not change with time or environmental changes during the data collection process, and usually reflect the inherent properties or stable state of the object. Taking industrial product data as an example, static features can be product model, size, weight, manufacturer, number of parts, product material and other features, which are only used for illustrative purposes here; dynamic behavior features refer to features that change with time or environmental changes, and usually reflect the behavior pattern, state evolution or interaction process of the object. Taking industrial product data as an example, dynamic behavior features can be real-time temperature, speed, pressure, current, start-stop frequency, load change, fault warning signal and other features, which are only used for illustrative purposes here.

[0056] Wherein, obtaining a static feature vector and a dynamic behavior feature matrix based on the input multi-dimensional data may include:

[0057] Extract static features and dynamic behavior features from the input multidimensional data, and perform data cleaning and feature normalization;

[0058] The dynamic behavior features are sorted according to the time step, and the static features and dynamic behavior features are combined according to the pre-specified feature structure to generate a static feature vector and a dynamic behavior feature matrix.

[0059] Optionally, a static feature vector may refer to a one-dimensional array formed by arranging the extracted static features in a certain order, which is used to represent the static properties of an object. A dynamic behavior feature matrix may refer to a two-dimensional array with time steps as rows and dynamic behavior features as columns, which records the behavior data of the object that changes over time.

[0060] Optionally, in the input multidimensional data, classification extraction can be performed based on the nature of the features. Static features that do not change with time, such as product model, material, design parameters, etc., can be directly extracted; dynamic behavioral features with time series characteristics, such as real-time temperature, pressure, and speed data of equipment during the production process, can be extracted one by one in chronological order.

[0061] Optionally, it may be pre-specified that the first identifier in the multidimensional data belongs to a static feature and the second identifier belongs to a dynamic feature. After the multidimensional data is acquired, the static feature and the dynamic behavior feature are divided according to the identifiers.

[0062] Optionally, data cleaning may include missing value processing and duplicate sample deletion; feature normalization processing may include normalization processing and data encoding.

[0063] Optionally, missing value processing may include: if it is a static feature, it can be filled with the mean, median or mode; if it is a dynamic feature, it can be filled using time series interpolation.

[0064] Optionally, deleting duplicate samples may include: using a hash algorithm to calculate a hash value for each feature, and detecting whether there are completely identical features based on the hash value, and deleting the duplicate features when it is determined that there are at least two completely identical features.

[0065] Optionally, in dynamic behavior features, the time step can refer to the basic unit used to divide the time interval, and each time step corresponds to a set of dynamic feature data; the feature structure can refer to the organization method and storage format of pre-defined static features and dynamic behavior features to ensure the consistency and standardization of the data.

[0066] Optionally, to speed up model convergence, you can perform Min-Max scaling on the features and map the feature data to the [0, 1] interval for normalization. When the feature value is a text class label, perform one-hot encoding on the text class label to convert the text class label into an encoding type. When the feature value is an ordered categorical variable, use ordinal encoding to encode the ordered categorical variable.

[0067] Optionally, the processed static features and dynamic behavior features are combined separately according to a pre-specified feature structure. For static features, all static features are arranged in a fixed order to generate a one-dimensional static feature vector. For example, if the static features include product model, material, and specification, a vector in the form of [model code, material code, specification value] can be generated; for dynamic behavior features, the time steps are used as rows and the dynamic features are used as columns. The sorted dynamic feature data are filled into the matrix to generate a dynamic behavior feature matrix. Assuming that the time step is T and the number of dynamic features is N, the matrix dimension is T×N, each row represents all dynamic feature data under a time step, and each column represents the value of a certain dynamic feature at different time steps.

[0068] The advantage of this setting is that by performing data cleaning and feature normalization on multidimensional data, data quality can be improved, the data can have a unified scale and format, and the subsequent analysis can be avoided from being affected by different feature dimensions. The conversion from multidimensional data to static feature vectors and dynamic behavior feature matrices can provide standardized data input for subsequent data analysis.

[0069] S120 , obtaining a first score and a second score output by the dual discriminator according to the static feature vector and the dynamic behavior feature matrix, and obtaining a dynamic weight of the dual discriminator at a target time step.

[0070] The dual discriminator includes a static feature discriminator and a temporal behavior discriminator.

[0071] Optionally, the static feature discriminator is used to analyze the static properties of the data. It consists of a convolutional layer, an activation layer, and a fully connected layer. The module outputs a scalar probability value of 0-1, indicating the degree of abnormality of the input static feature vector. The closer the output value is to 1, the higher the possibility of abnormality. The temporal behavior discriminator is used to analyze the dynamic properties of the data and can identify long-term and short-term anomalies. It consists of a bidirectional LSTM layer, an attention mechanism layer, a convolutional layer, an activation layer, a global maximum pooling layer, and a fully connected layer. The module outputs a scalar probability value of 0-1, indicating the degree of abnormality of the input behavior sequence. When the output value is close to 1, it indicates that there is a significant abnormality in the behavior sequence.

[0072] Optionally, obtaining the first score and the second score output by the dual discriminator based on the static feature vector and the dynamic behavior feature matrix can include: inputting the static feature vector into the static feature discriminator to obtain the first score output by the static feature discriminator, and inputting the dynamic behavior feature matrix into the temporal behavior discriminator to obtain the second score output by the temporal behavior discriminator.

[0073] Obtaining the dynamic weights of the dual discriminators at the target time step may include:

[0074] According to the static feature vector and dynamic behavior feature matrix in the target time window, the static feature mutation coefficient and the dynamic feature mutation coefficient are calculated respectively;

[0075] According to the static feature mutation coefficient and the dynamic feature mutation coefficient, the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step are obtained.

[0076] Optionally, the target time step can refer to the specific time point where anomaly detection is currently required, such as the time point corresponding to the data collected at a certain moment on the production line; the target time window can be a historical time range selected with the target time step as the center, which is used to compare and analyze changes in features, such as the equipment operation data in the past 10 minutes.

[0077] Optionally, the mutation coefficient can be an indicator that quantifies the degree to which a feature changes dramatically within a target time window. A larger coefficient indicates that the feature deviates more significantly from its normal state. The dynamic weight can refer to the weight value assigned to the two discriminators based on the feature mutation situation, which is used to weightedly fuse their output results to more accurately determine whether the data is abnormal.

[0078] Optionally, according to the static feature vector and the dynamic behavior feature matrix in the target time window, respectively calculating the static feature mutation coefficient and the dynamic feature mutation coefficient may include:

[0079] According to the static feature vector in the target time window, the mean and standard deviation of the static feature vector are calculated, and the static feature deviation is calculated according to the static feature vector at the target time step and the mean and standard deviation of the static feature vector in the target time window;

[0080] According to the dynamic behavior feature matrix in the target time window, the mean and standard deviation of each column of the dynamic feature matrix are calculated respectively to obtain the mean matrix and standard deviation matrix in the target time window. The dynamic feature deviation matrix is ​​calculated based on the dynamic behavior feature matrix at the target time step, the mean matrix and standard deviation matrix in the target time window;

[0081] The static feature mutation coefficient is calculated based on the static feature deviation, and the dynamic feature mutation coefficient is calculated based on the dynamic feature deviation matrix.

[0082] Optionally, static characteristic deviation d SD (t) can be calculated using the following formula:

[0083]

[0084] Among them, SD t is the static eigenvector at the target time step, μ SD is the mean of the static feature vector in the target time window, σ SD is the standard deviation of the static feature vector within the target time window.

[0085] Optionally, dynamic feature deviation matrix d TD (t) can be calculated using the following formula:

[0086]

[0087] Among them, TD t is the dynamic behavior characteristic matrix at the target time step, μ TD is the mean matrix in the target time window, σ TD is the standard deviation matrix within the target time window.

[0088] Optionally, the static feature deviation can be squared and the result is used as the static feature mutation coefficient. Similarly, all elements of the dynamic feature deviation matrix can be summed and then squared, and the result is used as the dynamic feature mutation coefficient.

[0089] Optionally, by summing all elements of the matrix, the fluctuation of multidimensional features can be converted into a scalar value, reflecting the degree of mutation of the overall feature. In dynamic time series features, the larger the summation result, the more significant the overall deviation of the current time series data from the historical pattern. Squaring the summation result can amplify the impact of large deviations, making the mutation feature more sensitive to the influence of the weight. If a dimension mutates significantly, squaring it will significantly increase the overall mutation coefficient.

[0090] Optionally, obtaining the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step based on the static feature mutation coefficient and the dynamic feature mutation coefficient may include:

[0091] According to the formula W SD (t) = V SD (t) / (V SD (t)+V TD (t)); W TD (t)=1-W SD(t); the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step t can be calculated respectively; where W SD (t) and W SD (t) are the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step t, V SD (t) is the static characteristic mutation coefficient, V TD (t) is the dynamic characteristic mutation coefficient.

[0092] The advantage of this setting is that it can achieve dynamic weight distribution based on the mutation coefficient, flexibly adjust the weights of the two discriminators according to the real-time fluctuations of the features, and improve the accuracy and adaptability of anomaly detection.

[0093] S130 : Obtain anomaly detection results of the multidimensional data according to the first score, the second score, and the dynamic weight.

[0094] Optionally, the first score and the second score can be weighted and fused through dynamic weights to obtain a final anomaly score, which is used to determine whether the input multidimensional data is abnormal. It can integrate the detection information of the dual discriminators and overcome the shortcomings of the limited discrimination ability of a single dimension.

[0095] Optionally, the anomaly score can be calculated according to the following formula:

[0096] fs=W SD (t)*SD output +W TD (t)*TD output ;

[0097] Among them, fs is the calculation result of abnormal score, W SD (t) and W SD (t) are the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step t, SD output is the first score output by the static feature discriminator, TD output is the second score output by the temporal behavior discriminator.

[0098] Optionally, a scoring threshold may be preset, and when the abnormality score is higher than the threshold, it is determined to be abnormal; otherwise, it is determined to be non-abnormal.

[0099] The technical solution of the embodiment of the present invention obtains a static feature vector and a dynamic behavior feature matrix based on the input multi-dimensional data, obtains a first score and a second score output by a dual discriminator based on the static feature vector and the dynamic behavior feature matrix, and obtains the dynamic weight of the dual discriminator at a target time step, and obtains anomaly detection results of the multi-dimensional data based on the first score, the second score and the dynamic weight. This method can perform anomaly detection from two dimensions, namely static features and dynamic behavior features, improve the accuracy of anomaly detection through multi-dimensional collaborative detection, overcome the disadvantage of limited single-dimensional discrimination ability, and improve the recognition accuracy and robustness of complex patterns.

[0100] Example 2

[0101] Figure 2 This is a flowchart of a method for detecting anomalies in multidimensional data provided by the second embodiment of the present invention. This embodiment specifically describes the training process of the dual discriminator based on the above embodiment. Figure 2 As shown, the method includes:

[0102] S210: Generate a training sample set based on real sample data and the generator.

[0103] Optionally, the present invention can optimize and train the dual discriminator when only a small sample of multidimensional data is available, and the generator and the discriminator have initial parameters, but the initial parameters are not optimal parameters.

[0104] Among them, according to the real sample data and the generator, a training sample set is generated, including:

[0105] Based on real sample data, generate static feature vectors and dynamic behavior feature matrices of real sample data;

[0106] Generate random noise and input it into the generator to obtain the static feature vector and dynamic behavior feature matrix synthesized by the generator;

[0107] The static feature vector and dynamic behavior feature matrix of the real sample data, and the static feature vector and dynamic behavior feature matrix synthesized by the generator are combined to form a training sample set, and the feature type is marked by a label.

[0108] Optionally, the real sample data may refer to the original data from the real scene. After feature splitting, data cleaning, feature normalization, feature sorting and combination processing, the static feature vector and dynamic behavior feature matrix of the real sample data may be generated. The specific processing method is the same as step S110 and will not be repeated here.

[0109] Optionally, the random noise can be a random vector that conforms to the normal distribution, which serves as the input of the generator to drive the generation of diverse synthetic data. The generated random noise is input into the generator model. The generator can learn the distribution pattern of real data through its internal neural network structure and convert the noise into synthetic data similar to the real data.

[0110] Optionally, in the training sample set, each feature can be marked by a label to indicate whether it belongs to real sample data or generator synthesized data.

[0111] The advantage of this setting is that the generator generates a large number of supplementary samples by simulating the real data distribution, which can effectively solve the problems of small size and insufficient diversity of the original data set and significantly improve the generalization ability of the downstream model.

[0112] S220 : Calculate a first loss function of the dual discriminator according to the training sample set, and update the model parameters of the dual discriminator according to the first loss function.

[0113] The method of calculating a first loss function of the dual discriminator according to the training sample set and updating the model parameters of the dual discriminator according to the first loss function includes:

[0114] Input the training sample set into the dual discriminator, and calculate the first loss function of the static feature discriminator and the temporal behavior discriminator respectively according to the score output by the dual discriminator for each training sample;

[0115] Back propagation is performed according to the first loss function of the static feature discriminator to update the model parameters of the static feature discriminator, and back propagation is performed according to the first loss function of the temporal behavior discriminator to update the model parameters of the temporal behavior discriminator.

[0116] Optionally, during each round of parameter update, the generator is first fixed and the discriminator is trained. After the discriminator parameters are updated, the discriminator is fixed and the generator is trained again. This allows the generator and the discriminator to form a dynamic game relationship. By continuously improving the quality of generated data, the discriminator is forced to continuously optimize its discrimination ability, forming a co-evolution mechanism.

[0117] Optionally, the first loss function may refer to the loss function of the dual discriminator calculated in the process of fixing the generator and training the discriminator.

[0118] Optionally, during each round of training, after obtaining the training sample set, each static feature vector in the training sample set of the current round is input into the static feature discriminator, and the dynamic behavior feature matrix is ​​input into the temporal behavior discriminator. At this time, the identification results output by the dual discriminator for the training sample set of the current round can be obtained, and then the first loss function is calculated based on the identification results.

[0119] Optional, loss function L for static feature discriminator SD It can be calculated according to the following formula:

[0120]

[0121] Among them, D SD (x real ) can refer to the probability value of the first static feature vector being the real data, the first static feature vector is the static feature vector whose label is the real data in the training sample set, D SD (G(z trans )) may refer to the probability value of the second static feature vector being the real data, the second static feature vector being the static feature vector whose label is the synthetic data in the training sample set, and N being the total number of static feature vectors in the training sample set.

[0122] Furthermore, the loss function L of the temporal behavior discriminator is TD It can be calculated according to the following formula:

[0123]

[0124] Among them, D SD (x real ) can refer to the probability value of the first dynamic behavior feature matrix being the real data, the first dynamic behavior feature matrix being the dynamic behavior feature matrix of the real data in the training sample set, D SD (G(z trans )) may refer to the probability value of the second dynamic behavior feature matrix being real data, the second dynamic behavior feature matrix being the dynamic behavior feature matrix labeled as synthetic data in the training sample set, and N being the total number of dynamic behavior feature matrices in the training sample set.

[0125] The advantage of this setting is that by calculating the first loss function through a fixed generator and using the first loss function for directional propagation to optimize the dual discriminator parameters, the dual discriminator can effectively optimize its ability to distinguish between normal and abnormal data in terms of static features and temporal features, so that the dual discriminator can efficiently extract key features and improve the accuracy and efficiency of anomaly detection.

[0126] S230. Calculate the total loss of the generator based on the training sample set and the dual discriminator after parameter update, and update the generator parameters based on the total loss of the generator.

[0127] Among them, according to the training sample set and the dual discriminator after parameter update, the total loss of the generator is calculated, and the generator parameters are updated according to the total loss of the generator, including:

[0128] Input the training sample set into the dual discriminator after parameter update, calculate the second loss function of the dual discriminator according to the score output by the dual discriminator for each training sample, and calculate the total loss of the generator according to the second loss function of the dual discriminator;

[0129] Backpropagation is performed based on the total loss of the generator to update the parameters of the generator.

[0130] Optionally, after updating the dual discriminator parameters, the training sample set generated in this round can be input into the dual discriminator again, and the second loss function is calculated according to the discrimination result of the dual discriminator, and the total loss of the generator is calculated using the second loss function.

[0131] Optionally, the total generator loss can be calculated according to the following formula: L G =α·L SD (G)+β·L TD (G), where L SD (G) and L TD (G) are the second loss functions of the dual discriminator, and α and β are the parameters of the loss function.

[0132] The advantage of this setting is that by calculating the total loss of the generator based on the loss function of the dual discriminator and then backpropagating to update the generator parameters, the generator's optimization goal can be to generate data that can deceive both the static feature discriminator and the temporal behavior discriminator, so that the trained generator can generate highly confident synthetic data for the next round of dual discriminator training.

[0133] S240 , after each update of the generator parameters, the updated generator is used to update the training sample set, and the updated training sample set is used to repeatedly update the parameters of the dual discriminator and the generator until the iteration condition is met.

[0134] Optionally, the iteration condition may be a preset iteration round or a preset dual discriminator evaluation index. When the evaluation accuracy of the dual discriminator reaches the evaluation index, the iteration condition is determined to be satisfied. This is not limited here.

[0135] S250: Obtain a static feature vector and a dynamic behavior feature matrix based on the input multi-dimensional data.

[0136] S260 , obtaining a first score and a second score output by the dual discriminator according to the static feature vector and the dynamic behavior feature matrix, and obtaining a dynamic weight of the dual discriminator at a target time step.

[0137] S270: Obtain anomaly detection results of the multidimensional data according to the first score, the second score, and the dynamic weight.

[0138] The technical solution of the embodiments of the present invention, through multiple rounds of cross-training between the generator and the dual discriminator, enables the generator to be continuously updated based on the identification results of the dual discriminator. The generator learns the inherent consistency of static features and temporal features, generating synthetic data that better conforms to the distribution of real data. This effectively addresses the problems of small size, class imbalance, or insufficient diversity of the original dataset, significantly improving the generalization ability of the identification model. Furthermore, the dual discriminator is updated multiple times based on a large number of high-quality training samples, improving its ability to distinguish static and temporal features. The training uses alternating adversarial methods, which can effectively accelerate the convergence of the model. By obtaining a static feature vector and a dynamic behavior feature matrix based on the input multi-dimensional data, obtaining a first score and a second score output by the dual discriminator based on the static feature vector and the dynamic behavior feature matrix, and obtaining the dynamic weight of the dual discriminator at the target time step, and obtaining the anomaly detection result of the multi-dimensional data based on the first score, the second score, and the dynamic weight, anomaly detection can be performed from both static and dynamic behavior features. The accuracy of anomaly detection is improved through multi-dimensional collaborative detection, overcoming the limited discrimination ability of a single dimension and improving the recognition accuracy and robustness of complex patterns.

[0139] Example 3

[0140] Figure 3 This is a schematic diagram of the structure of a multi-dimensional data anomaly detection device provided by the third embodiment of the present invention. Figure 3 As shown, the apparatus includes: a feature extraction module 310 , a dual discriminator scoring module 320 and a detection result generation module 330 .

[0141] The feature extraction module 310 is used to obtain static feature vectors and dynamic behavior feature matrices based on the input multi-dimensional data.

[0142] The dual discriminator scoring module 320 is configured to obtain a first score and a second score output by the dual discriminator based on the static feature vector and the dynamic behavior feature matrix, and to obtain a dynamic weight of the dual discriminator at a target time step; wherein the dual discriminator includes a static feature discriminator and a temporal behavior discriminator.

[0143] The detection result generating module 330 is configured to obtain an anomaly detection result of the multi-dimensional data according to the first score, the second score, and the dynamic weight.

[0144] The technical solution of the embodiment of the present invention obtains a static feature vector and a dynamic behavior feature matrix based on the input multi-dimensional data, obtains a first score and a second score output by a dual discriminator based on the static feature vector and the dynamic behavior feature matrix, and obtains the dynamic weight of the dual discriminator at a target time step, and obtains anomaly detection results of the multi-dimensional data based on the first score, the second score and the dynamic weight. This method can perform anomaly detection from two dimensions, namely static features and dynamic behavior features, improve the accuracy of anomaly detection through multi-dimensional collaborative detection, overcome the disadvantage of limited single-dimensional discrimination ability, and improve the recognition accuracy and robustness of complex patterns.

[0145] Based on the above embodiments, the feature extraction module 310 can be specifically used to:

[0146] Extract static features and dynamic behavior features from the input multidimensional data, and perform data cleaning and feature normalization;

[0147] The dynamic behavior features are sorted according to the time step, and the static features and dynamic behavior features are combined according to the pre-specified feature structure to generate a static feature vector and a dynamic behavior feature matrix.

[0148] Based on the above embodiments, the dual discriminator scoring module 320 can be specifically used to:

[0149] According to the static feature vector and dynamic behavior feature matrix in the target time window, the static feature mutation coefficient and the dynamic feature mutation coefficient are calculated respectively;

[0150] According to the static feature mutation coefficient and the dynamic feature mutation coefficient, the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step are obtained.

[0151] On the basis of the above embodiments, a model training module may also be included, which may specifically include:

[0152] A training sample set generating unit, used to generate a training sample set based on real sample data and a generator;

[0153] a dual discriminator parameter updating unit, configured to calculate a first loss function of the dual discriminator according to the training sample set, and update the model parameters of the dual discriminator according to the first loss function;

[0154] A generator parameter updating unit is used to calculate the total loss of the generator based on the training sample set and the dual discriminator after parameter update, and to update the generator parameters based on the total loss of the generator;

[0155] The repeated updating unit is used to update the training sample set using the updated generator after each update of the generator parameters, and repeatedly update the parameters of the dual discriminator and the generator using the updated training sample set until the iteration condition is met.

[0156] Based on the above embodiments, the training sample set generating unit may be specifically configured to:

[0157] Based on real sample data, generate static feature vectors and dynamic behavior feature matrices of real sample data;

[0158] Generate random noise and input it into the generator to obtain the static feature vector and dynamic behavior feature matrix synthesized by the generator;

[0159] The static feature vector and dynamic behavior feature matrix of the real sample data, and the static feature vector and dynamic behavior feature matrix synthesized by the generator are combined to form a training sample set, and the feature type is marked by a label.

[0160] Based on the above embodiments, the dual discriminator parameter updating unit can be specifically used to:

[0161] Input the training sample set into the dual discriminator, and calculate the first loss function of the static feature discriminator and the temporal behavior discriminator respectively according to the score output by the dual discriminator for each training sample;

[0162] Back propagation is performed according to the first loss function of the static feature discriminator to update the model parameters of the static feature discriminator, and back propagation is performed according to the first loss function of the temporal behavior discriminator to update the model parameters of the temporal behavior discriminator.

[0163] Based on the above embodiments, the generator parameter updating unit can be specifically used to:

[0164] Input the training sample set into the dual discriminator after parameter update, calculate the second loss function of the dual discriminator according to the score output by the dual discriminator for each training sample, and calculate the total loss of the generator according to the second loss function of the dual discriminator;

[0165] Backpropagation is performed based on the total loss of the generator to update the parameters of the generator.

[0166] The multidimensional data anomaly detection device provided by the embodiment of the present invention can execute the multidimensional data anomaly detection method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0167] Example 4

[0168] Figure 4A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0169] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0170] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0171] The processor 11 can be various general-purpose and / or specialized processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the anomaly detection method for multidimensional data described in an embodiment of the present invention. That is:

[0172] Obtain static feature vectors and dynamic behavior feature matrices based on the input multidimensional data;

[0173] Obtaining a first score and a second score output by a dual discriminator according to the static feature vector and the dynamic behavior feature matrix, and obtaining a dynamic weight of the dual discriminator at a target time step; wherein the dual discriminator includes a static feature discriminator and a temporal behavior discriminator;

[0174] An anomaly detection result of the multidimensional data is obtained according to the first score, the second score, and the dynamic weight.

[0175] In some embodiments, the anomaly detection method for multidimensional data can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the anomaly detection method for multidimensional data described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the anomaly detection method for multidimensional data in any other appropriate manner (e.g., by means of firmware).

[0176] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0177] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0178] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0179] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0180] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0181] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0182] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0183] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in multidimensional data, characterized in that: include: Obtain static feature vectors and dynamic behavior feature matrices based on the input multidimensional data; Obtaining a first score and a second score output by a dual discriminator according to the static feature vector and the dynamic behavior feature matrix, and obtaining a dynamic weight of the dual discriminator at a target time step; wherein the dual discriminator includes a static feature discriminator and a temporal behavior discriminator; An anomaly detection result of the multidimensional data is obtained according to the first score, the second score, and the dynamic weight.

2. The method according to claim 1, characterized in that According to the input multi-dimensional data, static feature vectors and dynamic behavior feature matrices are obtained, including: Extract static features and dynamic behavior features from the input multidimensional data, and perform data cleaning and feature normalization; The dynamic behavior features are sorted according to the time step, and the static features and dynamic behavior features are combined according to the pre-specified feature structure to generate a static feature vector and a dynamic behavior feature matrix.

3. The method according to claim 1, characterized in that Get the dynamic weights of the dual discriminator at the target time step, including: According to the static feature vector and dynamic behavior feature matrix in the target time window, the static feature mutation coefficient and the dynamic feature mutation coefficient are calculated respectively; According to the static feature mutation coefficient and the dynamic feature mutation coefficient, the dynamic weights of the static feature discriminator and the temporal behavior discriminator at the target time step are obtained.

4. The method according to claim 1, wherein Before obtaining the static feature vector and the dynamic behavior feature matrix based on the input multi-dimensional data, the following steps are also included: Generate a training sample set based on real sample data and the generator; Calculating a first loss function of the dual discriminator according to the training sample set, and updating the model parameters of the dual discriminator according to the first loss function; Based on the training sample set and the dual discriminator after parameter update, calculate the total loss of the generator, and update the generator parameters based on the total loss of the generator; After each update of the generator parameters, the updated generator is used to update the training sample set, and the updated training sample set is used to repeatedly update the parameters of the dual discriminator and generator until the iteration condition is met.

5. The method according to claim 4, characterized in that Based on the real sample data and the generator, a training sample set is generated, including: Based on real sample data, generate static feature vectors and dynamic behavior feature matrices of real sample data; Generate random noise and input it into the generator to obtain the static feature vector and dynamic behavior feature matrix synthesized by the generator; The static feature vector and dynamic behavior feature matrix of the real sample data, and the static feature vector and dynamic behavior feature matrix synthesized by the generator are combined to form a training sample set, and the feature type is marked by a label.

6. The method according to claim 4, characterized in that Calculating a first loss function of the dual discriminator according to the training sample set, and updating the model parameters of the dual discriminator according to the first loss function, including: Input the training sample set into the dual discriminator, and calculate the first loss function of the static feature discriminator and the temporal behavior discriminator respectively according to the score output by the dual discriminator for each training sample; Back propagation is performed according to the first loss function of the static feature discriminator to update the model parameters of the static feature discriminator, and back propagation is performed according to the first loss function of the temporal behavior discriminator to update the model parameters of the temporal behavior discriminator.

7. The method according to claim 4, characterized in that Based on the training sample set and the dual discriminator after parameter update, the total loss of the generator is calculated, and the generator parameters are updated according to the total loss of the generator, including: Input the training sample set into the dual discriminator after parameter update, calculate the second loss function of the dual discriminator according to the score output by the dual discriminator for each training sample, and calculate the total loss of the generator according to the second loss function of the dual discriminator; Backpropagation is performed based on the total loss of the generator to update the parameters of the generator.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can execute the multi-dimensional data anomaly detection method according to any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the multi-dimensional data anomaly detection method according to any one of claims 1 to 7 when executed.

10. A computer program product, characterized in that The computer program product comprises a computer program, which, when executed by a processor, implements the method for detecting anomalies in multi-dimensional data according to any one of claims 1 to 7.

Images