Data recovery method and device, equipment, storage medium and program product

Abstract

The invention provides a data recovery method and device, equipment, a storage medium and a program product, and relates to the technical field of network security. In some embodiments of the disclosure, original feature variables are extracted from intrusion detection sample data; determining a correlation coefficient between the target characteristic variable and other characteristic variables; wherein the target feature variable is any one feature variable in the original feature variables, and the other feature variables are feature variables except the target feature variable in the original feature variables; when it is detected that the target feature variable contains a null value, determining a target data repair mode corresponding to the target feature variable according to the correlation coefficient so as to determine the necessity of data repair; compared with a prediction method adopting a model, the method has the advantages that the consumption of computing resources is reduced, the processing efficiency of an intrusion detection system is improved, and the network security performance is improved.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a data repair method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the rapid development of 5G, cloud computing, and the Internet of Things (IoT) technologies, the era of ubiquitous connectivity has fully arrived. Hundreds of millions of smart devices are connected to the network, continuously generating massive, high-dimensional, and heterogeneous data streams. Network topologies and interactive behaviors are becoming increasingly complex, significantly expanding the surface and potential paths for network attacks. Against this backdrop, network security faces unprecedented challenges. Traditional passive defense technologies, such as firewalls, authentication, and data encryption, while capable of preventing unauthorized access to some extent, have static and delayed defense mechanisms. Once bypassed by attackers, the system faces the risk of complete exposure. To address this issue, Intrusion Detection Systems (IDS) have emerged as a proactive defense mechanism. IDS analyzes potential malicious activities and abnormal patterns by monitoring network traffic, system logs, and user behavior in real time. They can issue timely alerts and take response measures before an attack occurs or spreads, and have become a key component of modern network security protection systems.

[0003] Currently, various data completion methods have been proposed by academia and industry to address the common problem of missing data in intrusion detection systems. The most common method for processing intrusion detection data is zero-padding, which directly fills in missing data with zeros. Alternatively, statistical methods can be used, such as using the mean, mode, or median to fill in the missing data. These methods are simple to implement, have low computational overhead, and are suitable for scenarios with a low proportion of missing data and a relatively stable data distribution. In addition, model-based prediction methods are gaining attention, utilizing the powerful nonlinear fitting and inference capabilities of machine learning algorithms to intelligently predict missing values. Typical methods include K-Nearest Neighbors (KNN), Decision Trees, Random Forests, Naive Bayes, and deep neural networks. These models are trained on complete data to learn the inherent relationships between variables, and then use missing fields as target variables for prediction and completion, which can improve the accuracy of completion to a certain extent.

[0004] The zero-padding and statistical methods described above result in low network security performance; the prediction methods described above consume high computational resources, leading to low processing efficiency of the intrusion detection system. Summary of the Invention

[0005] This disclosure provides a data recovery method, apparatus, device, storage medium, and program product to at least address the problems of low network security performance, high computational resource consumption, and low processing efficiency of existing intrusion detection systems.

[0006] The technical solution disclosed herein is as follows:

[0007] This disclosure provides a data repair method, including:

[0008] Extract raw feature variables from intrusion detection sample data;

[0009] Determine the correlation coefficient between the target feature variable and other feature variables; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are the feature variables other than the target feature variable in the original feature variables;

[0010] If the target feature variable is found to contain null values, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient.

[0011] The target feature variable is repaired using the target data repair method to obtain the repaired feature variable.

[0012] Optionally, determining the correlation coefficient between the target feature variable and other feature variables includes:

[0013] Calculate the first mean of the target feature variable and calculate the second mean of any one of the other feature variables;

[0014] Using the Pearson correlation coefficient, the correlation coefficient between the target feature variable and the other feature variables is calculated based on the first mean and the second mean.

[0015] Optionally, determining the correlation coefficient between the target feature variable and other feature variables includes:

[0016] The correlation coefficient between the target feature variable and the other feature variables is calculated using any one of the partial least squares method, contribution method, and mutual information method.

[0017] Optionally, when the target feature variable is detected to contain null values, determining the target data repair method corresponding to the target feature variable based on the correlation coefficient includes:

[0018] If the target feature variable is found to contain null values, determine the relationship between the correlation coefficient and the repair threshold.

[0019] If the correlation coefficient is greater than or equal to the repair threshold, then the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable;

[0020] If the correlation coefficient is less than the repair threshold, then the target data repair method corresponding to the target feature variable is determined to be the zeroing method.

[0021] Optionally, if the correlation coefficient is greater than or equal to the repair threshold, then the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable, including:

[0022] If the correlation coefficient is greater than or equal to the repair threshold, the degree of numerical missingness of the target feature variable is calculated based on the number of null values ​​and the total number of values ​​in the target feature variable.

[0023] If the degree of numerical missingness is greater than the missing threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0024] If the degree of numerical missingness is less than or equal to the missing threshold, then the target data repair method corresponding to the target feature variable is determined according to the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold; wherein, the first threshold is less than the second threshold, the second threshold is less than the third threshold, the third threshold is less than the fourth threshold, and the fourth threshold is less than the fifth threshold.

[0025] Optionally, if the degree of numerical missingness is less than or equal to the missing threshold, then the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold, including:

[0026] If the correlation coefficient is greater than the fifth threshold and less than the first threshold, then the target data repair method corresponding to the target feature variable is determined to be the construction function method.

[0027] If the correlation coefficient is greater than the fourth threshold and less than or equal to the fifth threshold, or if the correlation coefficient is greater than or equal to the first threshold and less than the second threshold, then the target data repair method corresponding to the target feature variable is determined to be the feature scaling method.

[0028] If the correlation coefficient is greater than the third threshold and less than or equal to the fourth threshold, or if the correlation coefficient is greater than or equal to the second threshold and less than or equal to the third threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0029] Optionally, the target data repair method is a function construction method; the target feature variable is repaired using the target data repair method to obtain the repaired feature variable, including:

[0030] Using the correlation coefficient as the slope, a linear function is constructed to approximate the true linear function in order to fill the missing values ​​in the target feature variable.

[0031] Optionally, the target data repair method is a feature scaling method; the target feature variables are repaired using the target data repair method to obtain the repaired feature variables, including:

[0032] Calculate the average value of the target feature variable;

[0033] Based on the correlation coefficient, scaling factor, and average value, the missing values ​​in the target feature variable are supplemented.

[0034] This disclosure also provides a data repair apparatus, including:

[0035] The extraction module is used to extract raw feature variables from intrusion detection sample data;

[0036] The first determining module is used to determine the correlation coefficient between the target feature variable and other feature variables; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are feature variables other than the target feature variable in the original feature variables;

[0037] The second determining module is used to determine the target data repair method corresponding to the target feature variable based on the correlation coefficient when the target feature variable is detected to contain null values.

[0038] The repair module is used to repair the target feature variable using the target data repair method to obtain the repaired feature variable.

[0039] Optionally, when determining the correlation coefficient between the target feature variable and other feature variables, the first determining module is used to:

[0040] Calculate the first mean of the target feature variable and calculate the second mean of any one of the other feature variables;

[0041] Using the Pearson correlation coefficient, the correlation coefficient between the target feature variable and the other feature variables is calculated based on the first mean and the second mean.

[0042] Optionally, when determining the correlation coefficient between the target feature variable and other feature variables, the first determining module is used to:

[0043] The correlation coefficient between the target feature variable and the other feature variables is calculated using any one of the partial least squares method, contribution method, and mutual information method.

[0044] Optionally, when the second determining module detects that the target feature variable contains null values, and determines the target data repair method corresponding to the target feature variable based on the correlation coefficient, it is used to:

[0045] If the target feature variable is found to contain null values, determine the relationship between the correlation coefficient and the repair threshold.

[0046] If the correlation coefficient is greater than or equal to the repair threshold, then the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable;

[0047] If the correlation coefficient is less than the repair threshold, then the target data repair method corresponding to the target feature variable is determined to be the zeroing method.

[0048] Optionally, when the correlation coefficient is greater than or equal to the repair threshold, the second determining module, when determining the target data repair method corresponding to the target feature variable based on the degree of numerical missingness of the target feature variable, is used to:

[0049] If the correlation coefficient is greater than or equal to the repair threshold, the degree of numerical missingness of the target feature variable is calculated based on the number of null values ​​and the total number of values ​​in the target feature variable.

[0050] If the degree of numerical missingness is greater than the missing threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0051] If the degree of numerical missingness is less than or equal to the missing threshold, then the target data repair method corresponding to the target feature variable is determined according to the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold; wherein, the first threshold is less than the second threshold, the second threshold is less than the third threshold, the third threshold is less than the fourth threshold, and the fourth threshold is less than the fifth threshold.

[0052] Optionally, when the second determining module determines the target data repair method corresponding to the target feature variable based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold, if the degree of numerical missingness is less than or equal to the missing threshold, it is used to:

[0053] If the correlation coefficient is greater than the fifth threshold and less than the first threshold, then the target data repair method corresponding to the target feature variable is determined to be the construction function method.

[0054] If the correlation coefficient is greater than the fourth threshold and less than or equal to the fifth threshold, or if the correlation coefficient is greater than or equal to the first threshold and less than the second threshold, then the target data repair method corresponding to the target feature variable is determined to be the feature scaling method.

[0055] If the correlation coefficient is greater than the third threshold and less than or equal to the fourth threshold, or if the correlation coefficient is greater than or equal to the second threshold and less than or equal to the third threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0056] Optionally, the target data repair method is a function construction method; when the repair module repairs the target feature variable using the target data repair method to obtain the repaired feature variable, it is used to:

[0057] Using the correlation coefficient as the slope, a linear function is constructed to approximate the true linear function in order to fill the missing values ​​in the target feature variable.

[0058] Optionally, the target data repair method is a feature scaling method; when the repair module repairs the target feature variable using the target data repair method to obtain the repaired feature variable, it is used to:

[0059] Calculate the average value of the target feature variable;

[0060] Based on the correlation coefficient, scaling factor, and average value, the missing values ​​in the target feature variable are supplemented.

[0061] This disclosure also provides an electronic device, including:

[0062] processor;

[0063] Memory used to store processor-executable instructions;

[0064] The processor is configured to execute instructions to implement the steps in the above method.

[0065] This disclosure also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0066] This disclosure also provides a computer program product, including a computer program / instructions, which, when executed by a processor, implement the steps of the method described above.

[0067] The technical solutions provided by the embodiments of this disclosure have at least the following beneficial effects:

[0068] In some embodiments of this disclosure, original feature variables are extracted from intrusion detection sample data; the correlation coefficient between the target feature variable and other feature variables is determined; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are feature variables other than the target feature variable; when null values ​​are detected in the target feature variable, the target data repair method corresponding to the target feature variable is determined according to the correlation coefficient, thereby determining the necessity of data repair; the target feature variable is repaired using the target data repair method to obtain the repaired feature variable. Compared with the prediction method of the model, this reduces the consumption of computing resources, improves the processing efficiency of the intrusion detection system, and improves network security performance.

[0069] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0070] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0071] Figure 1 A flowchart illustrating a data repair method provided for an exemplary embodiment of this disclosure;

[0072] Figure 2 A schematic diagram illustrating the correlation of a feature variable provided in an embodiment of this disclosure;

[0073] Figure 3 A schematic diagram illustrating a feature filtering result provided for an exemplary embodiment of this disclosure;

[0074] Figure 4 A schematic diagram of the structure of a data repair apparatus provided for an exemplary embodiment of this disclosure;

[0075] Figure 5 A schematic diagram of the structure of an electronic device provided for an exemplary embodiment of this disclosure. Detailed Implementation

[0076] To enable those skilled in the art to better understand the technical solutions of this disclosure, the technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings.

[0077] It should be noted that the terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this disclosure. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this disclosure.

[0078] It should be noted that the user information involved in this disclosure includes, but is not limited to, user device information and user personal information; the collection, storage, use, processing, transmission, provision and disclosure of user information in this disclosure all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0079] Currently, while zero-padding and statistical methods can efficiently handle missing values, they may disrupt the natural distribution of data, thereby compromising the comprehensiveness of hidden knowledge within the data, reducing the inference accuracy and generalization ability of intrusion detection analysis modules, and even leading to decision-making errors and serious cybersecurity failures. Model prediction methods, although significantly improving the accuracy of data repair, may suffer from significant computational resource consumption and non-negligible latency issues in complex scenarios involving large-scale missing intrusion detection data, thus weakening the effectiveness and response speed of IDS as a primary component of a proactive defense system. Furthermore, with increasingly complex and varied network attack methods, the adaptive capabilities of model-based methods are facing severe challenges, and their reliability is being questioned.

[0080] To address the aforementioned technical problems, in some embodiments of this disclosure, original feature variables are extracted from intrusion detection sample data; the correlation coefficient between the target feature variable and other feature variables is determined; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are feature variables other than the target feature variable; when null values ​​are detected in the target feature variable, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient, thereby determining the necessity of data repair; the target feature variable is repaired using the target data repair method to obtain the repaired feature variable. Compared with the prediction method of the model, this reduces the consumption of computing resources, improves the processing efficiency of the intrusion detection system, and improves network security performance.

[0081] The technical solutions provided by the embodiments of this disclosure are described in detail below with reference to the accompanying drawings.

[0082] Figure 1 This is a flowchart illustrating a data repair method provided as an exemplary embodiment of this disclosure. Figure 1 As shown, the method includes:

[0083] S101: Extract raw feature variables from intrusion detection sample data;

[0084] S102: Determine the correlation coefficient between the target feature variable and other feature variables; whereby the target feature variable is any one of the original feature variables, and the other feature variables are the feature variables other than the target feature variable in the original feature variables.

[0085] S103: If the target feature variable is found to contain null values, determine the target data repair method corresponding to the target feature variable based on the correlation coefficient;

[0086] S104: Use the target data repair method to repair the target feature variables and obtain the repaired feature variables.

[0087] In this embodiment, the entity executing the above method can be a terminal device or a server.

[0088] The terminal device includes, but is not limited to, mobile stations (MS), mobile terminals, mobile phones, handsets, and portable equipment. This terminal device can communicate with one or more core networks via a radio access network (RAN). For example, the terminal device can be a mobile phone (or "cellular" phone), a computer with wireless communication capabilities, a computer with wireless transceiver capabilities, a virtual reality (VR) terminal device, an AR terminal device, a wireless terminal in industrial control, a wireless terminal in self-driving, a wireless terminal in remote medical care, a wireless terminal in a smart grid, a wireless terminal in transportation safety, a wireless terminal in a smart city, a wireless terminal in a smart home, etc. The operating systems installed on the terminal device include, but are not limited to, iOS, Android, Windows, Linux, and Mac OS. In different networks, terminals may be called by different names, such as: user equipment, mobile station, user unit, station, cellular phone, personal digital assistant, wireless modem, wireless communication device, handheld device, laptop, cordless phone, wireless local loop station, television, etc. For ease of description, this embodiment will simply refer to it as terminal device.

[0089] In this embodiment, the implementation form of the server is not limited. For example, the server can be a conventional server, a cloud server, a cloud host, a virtual center, or other server devices. The server mainly consists of a processor, hard disk, memory, system bus, and other common computer architecture types.

[0090] In this embodiment, original feature variables are extracted from intrusion detection sample data; the correlation coefficient between the target feature variable and other feature variables is determined; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are the feature variables other than the target feature variable; when null values ​​are detected in the target feature variable, the target data repair method corresponding to the target feature variable is determined according to the correlation coefficient, thereby determining the necessity of data repair; the target feature variable is repaired using the target data repair method to obtain the repaired feature variable. Compared with the prediction method of the model, this reduces the consumption of computing resources, improves the processing efficiency of the intrusion detection system, and improves network security performance.

[0091] In some embodiments of this disclosure, in actual intrusion detection application scenarios, the collected intrusion detection sample data extracts original feature variables from the intrusion detection sample data. The collected intrusion detection sample data has the characteristics of being large in scale, having highly diversified and easily quantifiable feature variables, diverse intrusion type labels, and no temporal order between samples.

[0092] In some embodiments of this disclosure, the correlation coefficient between the target feature variable and other feature variables is determined. One possible approach is to calculate the first mean of the target feature variable and the second mean of any other feature variable; then, using the Pearson correlation coefficient, the correlation coefficient between the target feature variable and other feature variables is calculated based on the first and second means. The Pearson product-moment correlation coefficient (Pearson correlation coefficient for short) is simple to calculate and suitable for correlation analysis of massive datasets. Therefore, the linear correlation R(r1,r2,r3,...,rn) between the input variables is calculated using the Pearson correlation coefficient; the calculation formula is as follows:

[0093]

[0094] Among them, V i The i-th feature variable, V j Let V represent the j-th feature variable. i ′ and V j ′ represent V respectively i and V j The mean.

[0095] In other embodiments of this disclosure, the correlation coefficient between the target feature variable and other feature variables is determined. One possible approach is to calculate the correlation coefficient between the target feature variable and other feature variables using any one of the partial least squares (PLS), contribution method, and mutual information method. It should be noted that in intrusion detection scenarios, not all feature data significantly influences label type inference. Therefore, methods such as partial least squares (PLS), contribution, and mutual information can be used to determine the correlation q(q1,q2,q3,...,q...) between input and output variables. n ), where n is the number of sample features used.

[0096] It should be noted that this disclosure determines the necessity of data repair based on the correlation coefficient. When the eigenvalues ​​of the target feature variable are not important to the model output, the zeroing method is used for data repair; when the eigenvalues ​​of the target feature variable are important to the model output, other data repair methods are used for repair.

[0097] In some embodiments of this disclosure, when a target feature variable is detected to contain null values, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient. One possible approach is to determine the relationship between the correlation coefficient and the repair threshold when a target feature variable is detected to contain null values; if the correlation coefficient is greater than or equal to the repair threshold, the target data repair method corresponding to the target feature variable is determined based on the degree of numerical missingness of the target feature variable; if the correlation coefficient is less than the repair threshold, the target data repair method corresponding to the target feature variable is determined to be the zeroing method. Specifically, when a null value is detected in the i-th feature variable, the correlation coefficient q is first determined. i Comparison with the repair threshold σ1:

[0098]

[0099] After assessing the necessity of data imputation, numerous non-critical feature variables with negligible impact on model predictions can be removed. This means that in most cases, missing feature values ​​do not constitute a substantial impact, thus eliminating the need for complex imputation operations. For these missing values, zeroing can be directly used for imputation, simplifying the data processing flow and effectively saving computational resources, while ensuring that the performance of the intrusion detection model is not significantly affected. It should be noted that this disclosure does not impose a limit on the imputation threshold, which can be adjusted according to actual circumstances.

[0100] In the above embodiments, when the correlation coefficient is greater than or equal to the repair threshold, the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable. One possible approach is to calculate the degree of numerical missingness of the target feature variable based on the number of null values ​​and the total number of values ​​in the target feature variable when the correlation coefficient is greater than or equal to the repair threshold; if the degree of numerical missingness is greater than the missing threshold, the target data repair method corresponding to the target feature variable is determined to be a statistical method; if the degree of numerical missingness is less than or equal to the missing threshold, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient, a first threshold, a second threshold, a third threshold, a fourth threshold, and a fifth threshold; wherein the first threshold is less than the second threshold, the second threshold is less than the third threshold, the third threshold is less than the fourth threshold, and the fourth threshold is less than the fifth threshold. It should be noted that this disclosure does not limit the first, second, third, fourth, and fifth thresholds, and adjustments can be made according to actual circumstances. For example, the first threshold is -0.8, the second threshold is -0.3, the third threshold is 0, the fourth threshold is 0.3, and the fifth threshold is 0.8. This disclosure specifies differentiated strategies based on the relationship between the degree of missing values ​​and the missing threshold, assesses the feasibility of data repair, and performs efficient and accurate data repair based on the relationship between the degree of missing values ​​and the missing threshold.

[0101] For example, the degree of numerical missingness of a target feature variable can be calculated based on the number of null values ​​and the total number of values. The calculation formula is as follows:

[0102]

[0103] When θ is greater than the missing threshold σ², it indicates a severe degree of missing data. Repairing this data will increase latency and consume more computing power. In this case, statistical methods are used to repair the sample. When θ is less than or equal to the missing threshold σ², it indicates that the sample has minor missing data, and a detailed repair operation can be performed. For details on the detailed repair operation, please refer to the following examples.

[0104] In the above embodiments, when the degree of numerical missingness is less than or equal to the missing threshold, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold. One possible approach is to determine the target data repair method as a function construction method when the correlation coefficient is greater than the fifth threshold and less than the first threshold; to determine the target data repair method as a feature scaling method when the correlation coefficient is greater than the fourth threshold and less than or equal to the fifth threshold, or greater than or equal to the first threshold and less than the second threshold; and to determine the target data repair method as a statistical method when the correlation coefficient is greater than the third threshold and less than or equal to the fourth threshold, or greater than or equal to the second threshold and less than or equal to the third threshold.

[0105] For example, if a missing feature value exists and its correlation coefficient r satisfies other feature variables, then... ij >0.8 or r ij A correlation coefficient <-0.8 indicates a high linear correlation between the two variables, suggesting that the target data repair method for the target feature variable is a function construction method. For missing feature values, if a feature variable with a correlation coefficient of 0.3 exists and satisfies the condition that the correlation coefficient is 0.3, then the data repair method is appropriate. <r ij ≤0.8 or -0.8≤r ij If the value is less than -0.3, then the target data repair method for the target feature variable is determined to be the feature scaling method. For missing feature values, if there are feature variables with correlation coefficients of 0 or higher, then the correlation coefficient must be 0. <r ij ≤0.3 or -0.3≤r ij If the value is ≤0, it indicates that there is no linear correlation between the missing feature variable and the existing feature variable. The missing value can be supplemented using statistical methods. Therefore, the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0106] In some embodiments of this disclosure, the target data repair method is a function construction method; the target feature variables are repaired using this method to obtain the repaired feature variables. One possible approach is to use the correlation coefficient as the slope to construct a linear function that approximates the true linear function to fill in the missing values ​​in the target feature variables. Using the correlation coefficient as the slope, a linear function is constructed to approximate the true linear function:

[0107] V i =r ij V j +b ij ,b ij =V′ i -r ij V′j .

[0108] In some embodiments of this disclosure, the target data repair method is a feature scaling method; the target feature variables are repaired using the target data repair method to obtain the repaired feature variables. One possible approach is to calculate the average value of the target feature variables; and then, based on the correlation coefficient, scaling factor, and average value, fill in the missing values ​​in the target feature variables. The filling of missing values ​​is as follows:

[0109] V i =βr ij V j +V′ i

[0110] Among them, V′ i Let V be the average value of the i-th feature variable, and β be the scaling factor, mainly used to scale V. j The value of .

[0111] This disclosure evaluates the feasibility of patching intrusion detection samples, optimizing data quality and improving patching efficiency. Furthermore, it fully utilizes the correlations between different feature variables, taking into full account the statistical characteristics and regularities of the data, and incorporating logical relationships between data. This maximizes the preservation of the inherent connections and consistency between data, enabling efficient and accurate patching of missing data. This significantly enhances the accuracy and reliability of the intrusion detection system, providing a more robust guarantee for network security protection. In addition, the correlation calculation between features does not require frequent real-time calculations; it can be performed offline at a fixed frequency, saving computing power and reducing patching latency. This makes it more suitable for scenarios requiring real-time patching of massive network traffic data gaps in intrusion detection.

[0112] The following demonstrates the feasibility of using the linear correlation coefficient as the slope to construct a linear function that approximates the true linear function:

[0113] Figure 2 This is a schematic diagram illustrating the correlation of a feature variable provided in an embodiment of this disclosure. For example... Figure 2 As shown, for example, A represents the number of connections with the same target host as the current connection in the past two seconds, and B represents the number of connections with the same service as the current connection in the past two seconds. The values ​​of A are [80, 85, 90, 75, 95], and the values ​​of B are [70, 75, 85, 60, 90]. After calculation using the Pearson correlation coefficient, the Pearson correlation coefficient between A and B is 1.06, indicating a strong positive correlation between the two variables.

[0114] According to the MATLAB fitting results, the coefficients are in the range of [1.182, 1.818], with an average value of 1.5, and b is -51.5. Using the formula given in the text, the coefficients are calculated to be 1.06, and b is 14.1. If the value of "70" in b is missing, it can be supplemented using its linear relationship.

[0115] 1.5 * 80 - 51.5 = 68.5

[0116] 1.06 * 80 - 14.1 = 70.7.

[0117] The value of b is calculated based on the data in a, as shown in Table 1 below.

[0118] b 70 75 85 60 90 True Fit 68.5 76 83.5 61 91 Correlation Fit 70.7 76 84.6 62.4 92.64

[0119] Table 1

[0120] Therefore, based on the data presented in the table above, it can be definitively concluded that by introducing a linear function model with correlation coefficients, the actual correlation function between the two can be effectively approximated.

[0121] The present disclosure will be described below with reference to specific embodiments.

[0122] Figure 3 This is a schematic diagram illustrating a feature filtering result provided for an exemplary embodiment of this disclosure. For example... Figure 3 As shown, based on the intrusion detection database, PLS was used to filter feature variables related to intrusion detection types. Forty-one feature variables were input, including nine TCP packet connection attributes, thirteen expert knowledge attributes, and nineteen time window calculation attributes. Feature filtering was performed on 3000 samples in the database, ensuring that both normal and four intrusion types were included. The experiment was conducted independently 30 times, and the average of the 30 results was taken as the final result. The regression coefficients of each feature variable are shown in Table 2 below.

[0123]

[0124] Table 2

[0125] When the cross-validation index is greater than 0.0975, the number of principal components extracted is 5. According to... Figure 3 As shown in Table 2, only 5 of the 41 features are related to the label variables: 2-Protocol_type, 3-Service, 12-Logged_in, 23-Count, and 24-Srv_count. Therefore, apart from these 5 feature variables being related to the label values, the missing features have no significant impact on the determination of the attack type and can be repaired by setting them to zero.

[0126] Then, the linear correlation between the five variables 2-Protocol_type, 3-Service, 12-Logged_in, 23-Count, and 24-Srv_count is calculated, as shown in Table 3 below.

[0127]

[0128] Table 3

[0129] Based on Table 3, a strong positive / negative linear correlation was found among these five variables. Therefore, by calculating the correlation coefficients among the feature variables, data repair operations were performed to address the correlations under different conditions.

[0130] After randomly deleting feature values ​​from 8000 training set samples, the original data was mixed, resulting in a total of 500,000 data samples. These samples were then used to train fuzzy neural networks (FNNs) using the scheme and averaging method proposed in this proposal, defined as FNN-New and FNN-Ave, respectively. The decision-making performance of the FNN models trained after data imputation was then verified on the test set. To ensure fairness, model performance was measured using three metrics: accuracy, false positive rate, and false negative rate, and compared with other algorithms. The performance comparison of different models is shown in Table 4 below.

[0131]

[0132] Table 4

[0133] Table 4 shows that the average test accuracy of FNN on the original data is 97.718%, FNN-New's is 95.06%, and FNN-Ave's is 91.876%. This demonstrates that FNN-New performs better than FNN-Ave. Furthermore, FNN-New and FNN-Raw show remarkably similar performance in detecting Normal, Probing, and DoS attacks. Therefore, the experiments prove the effectiveness of the patching mechanism disclosed in this paper.

[0134] This disclosure addresses missing or abnormal intrusion detection samples by moving beyond simply filling them with the mean, median, or mode. Instead, it analyzes correlation coefficients under different conditions to specifically repair missing feature values. This repair method considers not only the statistical characteristics and regularities of the data but also incorporates the logical relationships between data points, thus maximizing the preservation of the inherent connections and consistency between data. This facilitates better learning of hidden knowledge and improves inference accuracy and generalization performance. Compared to directly using the mean, median, and mode for patching, this disclosure considers not only the statistical characteristics and regularities of the data but also incorporates the logical relationships between data points, thereby maximizing the preservation of the inherent connections and consistency between data and improving the analytical accuracy and generalization of the intrusion detection system. Furthermore, compared to the model-based approach, this disclosure uses a differentiated patching strategy based on linear relationships, reducing the need for online real-time data interaction and resource consumption in artificial intelligence.

[0135] Figure 4 This is a schematic diagram of the structure of a data repair apparatus 40 provided for an exemplary embodiment of this disclosure. Figure 4 As shown, the data repair device 40 includes: an extraction module 41, a first determination module 42, a second determination module 43, and a repair module 44.

[0136] Among them, the extraction module 41 is used to extract the original feature variables from the intrusion detection sample data;

[0137] The first determining module 42 is used to determine the correlation coefficient between the target feature variable and other feature variables; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are the feature variables other than the target feature variable in the original feature variables;

[0138] The second determining module 43 is used to determine the target data repair method corresponding to the target feature variable based on the correlation coefficient when the target feature variable is detected to contain null values.

[0139] Repair module 44 is used to repair the target feature variables using the target data repair method to obtain the repaired feature variables.

[0140] Optionally, the first determining module 42, when determining the correlation coefficient between the target feature variable and other feature variables, is used to:

[0141] Calculate the first mean of the target feature variable and the second mean of any other feature variable;

[0142] Using the Pearson correlation coefficient, the correlation coefficient between the target feature variable and other feature variables is calculated based on the first mean and the second mean.

[0143] Optionally, the first determining module 42, when determining the correlation coefficient between the target feature variable and other feature variables, is used to:

[0144] Calculate the correlation coefficient between the target feature variable and other feature variables using any one of the partial least squares method, contribution method, and mutual information method.

[0145] Optionally, when the second determining module 43 detects that the target feature variable contains null values, it determines the target data repair method corresponding to the target feature variable based on the correlation coefficient, and is used to:

[0146] When null values ​​are detected in the target feature variable, determine the relationship between the correlation coefficient and the repair threshold.

[0147] If the correlation coefficient is greater than or equal to the repair threshold, the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable.

[0148] If the correlation coefficient is less than the repair threshold, the target data repair method corresponding to the target feature variable is determined to be the zeroing method.

[0149] Optionally, when the correlation coefficient is greater than or equal to the repair threshold, the second determining module 43, when determining the target data repair method corresponding to the target feature variable based on the degree of numerical missingness of the target feature variable, is used for:

[0150] When the correlation coefficient is greater than or equal to the repair threshold, the degree of numerical missingness of the target feature variable is calculated based on the number of null values ​​and the total number of values ​​in the target feature variable.

[0151] If the degree of missing values ​​is greater than the missing threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0152] If the degree of missing values ​​is less than or equal to the missing threshold, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold; wherein, the first threshold is less than the second threshold, the second threshold is less than the third threshold, the third threshold is less than the fourth threshold, and the fourth threshold is less than the fifth threshold.

[0153] Optionally, when the second determining module 43 determines the target data repair method corresponding to the target feature variable based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold, if the degree of numerical missingness is less than or equal to the missing threshold, it is used for:

[0154] If the correlation coefficient is greater than the fifth threshold and less than the first threshold, then the target data repair method corresponding to the target feature variable is determined to be the construction function method.

[0155] If the correlation coefficient is greater than the fourth threshold and less than or equal to the fifth threshold, or if the correlation coefficient is greater than or equal to the first threshold and less than the second threshold, then the target data repair method corresponding to the target feature variable is determined to be the feature scaling method.

[0156] If the correlation coefficient is greater than the third threshold and less than or equal to the fourth threshold, or if the correlation coefficient is greater than or equal to the second threshold and less than or equal to the third threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

[0157] Optionally, the target data repair method is a function construction method; when the repair module 44 repairs the target feature variables using the target data repair method to obtain the repaired feature variables, it is used for:

[0158] Using the correlation coefficient as the slope, a linear function is constructed to approximate the true linear function in order to fill the missing values ​​in the target feature variables.

[0159] Optionally, the target data repair method is a feature scaling method; when the repair module 44 repairs the target feature variables using the target data repair method to obtain the repaired feature variables, it is used for:

[0160] Calculate the average value of the target characteristic variable;

[0161] Based on the correlation coefficient, scaling factor, and mean value, fill in the missing values ​​in the target feature variable.

[0162] Regarding the apparatus in the above embodiments, the specific manner in which each module performs its operation has been described in detail in the embodiments related to the method, and will not be elaborated upon here.

[0163] Figure 5 This is a schematic diagram of the structure of an electronic device provided as an exemplary embodiment of the present disclosure. For example... Figure 5 As shown, the electronic device includes a memory 51 and a processor 52. Additionally, the electronic device also includes a power supply component 53 and a communication component 54.

[0164] Memory 51 is used to store computer programs and can be configured to store various other data to support operation on the electronic device. Examples of this data include instructions for any application or method used to operate on the electronic device.

[0165] The memory 51 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0166] Communication component 54 is used for data transmission with other devices.

[0167] The processor 52 is capable of executing computer instructions stored in the memory 51 to: extract original feature variables from intrusion detection sample data; determine the correlation coefficient between the target feature variable and other feature variables; wherein the target feature variable is any one of the original feature variables, and the other feature variables are feature variables other than the target feature variable; if the target feature variable is detected to contain null values, determine the target data repair method corresponding to the target feature variable based on the correlation coefficient; and repair the target feature variable using the target data repair method to obtain the repaired feature variable.

[0168] Accordingly, embodiments of this disclosure also provide a computer-readable storage medium storing a computer program. When the computer-readable storage medium stores a computer program, and the computer program is executed by one or more processors, it causes one or more processors to perform... Figure 1 Each step in the method embodiment.

[0169] Accordingly, embodiments of this disclosure also provide a computer program product, which includes a computer program / instructions that are executed by a processor. Figure 1 Each step in the method embodiment.

[0170] The above Figure 5 The communication component is configured to facilitate wired or wireless communication between the device containing the communication component and other devices. The device containing the communication component can access wireless networks based on communication standards, such as WiFi, 2G, 3G, 4G / LTE, 5G, or combinations thereof. In one exemplary embodiment, the communication component receives broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component also includes a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA) technology, Ultra-Wideband (UWB) technology, Bluetooth (BT) technology, and other technologies.

[0171] The above Figure 5The power supply component provides power to various components within the device in which it resides. The power supply component may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which it resides.

[0172] The aforementioned electronic devices also include a display screen and audio components.

[0173] The display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen can be implemented as a touchscreen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, swipes, and gestures on the touch panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0174] An audio component may be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals may be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0175] Those skilled in the art will understand that embodiments of this disclosure can be provided as methods, systems, or computer program products. Therefore, this disclosure can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this disclosure can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0176] This disclosure is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0177] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0178] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0179] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0180] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0181] Computer-readable media include both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0182] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0183] The above are merely specific embodiments of this disclosure, enabling those skilled in the art to understand or implement this disclosure. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to these embodiments, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data repair method, characterized in that, include: Extract raw feature variables from intrusion detection sample data; Determine the correlation coefficient between the target feature variable and other feature variables; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are the feature variables other than the target feature variable in the original feature variables; If the target feature variable is found to contain null values, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient. The target feature variable is repaired using the target data repair method to obtain the repaired feature variable.

2. The method according to claim 1, characterized in that, Determining the correlation coefficient between the target feature variable and other feature variables includes: Calculate the first mean of the target feature variable and calculate the second mean of any one of the other feature variables; Using the Pearson correlation coefficient, the correlation coefficient between the target feature variable and the other feature variables is calculated based on the first mean and the second mean.

3. The method according to claim 1, characterized in that, Determining the correlation coefficient between the target feature variable and other feature variables includes: The correlation coefficient between the target feature variable and the other feature variables is calculated using any one of the partial least squares method, contribution method, and mutual information method.

4. The method according to claim 1, characterized in that, The step of determining the target data repair method corresponding to the target feature variable based on the correlation coefficient when the target feature variable is detected to contain null values ​​includes: If the target feature variable is found to contain null values, determine the relationship between the correlation coefficient and the repair threshold. If the correlation coefficient is greater than or equal to the repair threshold, then the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable; If the correlation coefficient is less than the repair threshold, then the target data repair method corresponding to the target feature variable is determined to be the zeroing method.

5. The method according to claim 4, characterized in that, If the correlation coefficient is greater than or equal to the repair threshold, then based on the degree of numerical loss of the target feature variable, the target data repair method corresponding to the target feature variable is determined, including: If the correlation coefficient is greater than or equal to the repair threshold, the degree of numerical missingness of the target feature variable is calculated based on the number of null values ​​and the total number of values ​​in the target feature variable. If the degree of numerical missingness is greater than the missing threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method. If the degree of numerical missingness is less than or equal to the missing threshold, then the target data repair method corresponding to the target feature variable is determined according to the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold; wherein, the first threshold is less than the second threshold, the second threshold is less than the third threshold, the third threshold is less than the fourth threshold, and the fourth threshold is less than the fifth threshold.

6. The method according to claim 5, characterized in that, When the degree of numerical missingness is less than or equal to the missing threshold, the target data repair method corresponding to the target feature variable is determined based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold, including: If the correlation coefficient is greater than the fifth threshold and less than the first threshold, then the target data repair method corresponding to the target feature variable is determined to be the construction function method. If the correlation coefficient is greater than the fourth threshold and less than or equal to the fifth threshold, or if the correlation coefficient is greater than or equal to the first threshold and less than the second threshold, then the target data repair method corresponding to the target feature variable is determined to be the feature scaling method. If the correlation coefficient is greater than the third threshold and less than or equal to the fourth threshold, or if the correlation coefficient is greater than or equal to the second threshold and less than or equal to the third threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

7. The method according to claim 1, characterized in that, The target data repair method is a function construction method; The target feature variable is repaired using the target data repair method described above, resulting in the repaired feature variable, including: Using the correlation coefficient as the slope, a linear function is constructed to approximate the true linear function in order to fill the missing values ​​in the target feature variable.

8. The method according to claim 1, characterized in that, The target data repair method is a feature scaling method; The target feature variable is repaired using the target data repair method described above, resulting in the repaired feature variable, including: Calculate the average value of the target feature variable; Based on the correlation coefficient, scaling factor, and average value, the missing values ​​in the target feature variable are supplemented.

9. A data repair device, characterized in that, include: The extraction module is used to extract raw feature variables from intrusion detection sample data; The first determining module is used to determine the correlation coefficient between the target feature variable and other feature variables; wherein, the target feature variable is any one of the original feature variables, and the other feature variables are feature variables other than the target feature variable in the original feature variables; The second determining module is used to determine the target data repair method corresponding to the target feature variable based on the correlation coefficient when the target feature variable is detected to contain null values. The repair module is used to repair the target feature variable using the target data repair method to obtain the repaired feature variable.

10. The apparatus according to claim 9, characterized in that, When determining the correlation coefficient between the target feature variable and other feature variables, the first determining module is used to: Calculate the first mean of the target feature variable and calculate the second mean of any one of the other feature variables; Using the Pearson correlation coefficient, the correlation coefficient between the target feature variable and the other feature variables is calculated based on the first mean and the second mean.

11. The apparatus according to claim 9, characterized in that, When determining the correlation coefficient between the target feature variable and other feature variables, the first determining module is used to: The correlation coefficient between the target feature variable and the other feature variables is calculated using any one of the partial least squares method, contribution method, and mutual information method.

12. The apparatus according to claim 9, characterized in that, When the second determining module detects that the target feature variable contains null values, and determines the target data repair method corresponding to the target feature variable based on the correlation coefficient, it is used to: If the target feature variable is found to contain null values, determine the relationship between the correlation coefficient and the repair threshold. If the correlation coefficient is greater than or equal to the repair threshold, then the target data repair method corresponding to the target feature variable is determined according to the degree of numerical missingness of the target feature variable; If the correlation coefficient is less than the repair threshold, then the target data repair method corresponding to the target feature variable is determined to be the zeroing method.

13. The apparatus according to claim 12, characterized in that, When the correlation coefficient is greater than or equal to the repair threshold, the second determining module, when determining the target data repair method corresponding to the target feature variable based on the degree of numerical missingness of the target feature variable, is used for: If the correlation coefficient is greater than or equal to the repair threshold, the degree of numerical missingness of the target feature variable is calculated based on the number of null values ​​and the total number of values ​​in the target feature variable. If the degree of numerical missingness is greater than the missing threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method. If the degree of numerical missingness is less than or equal to the missing threshold, then the target data repair method corresponding to the target feature variable is determined according to the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold; wherein, the first threshold is less than the second threshold, the second threshold is less than the third threshold, the third threshold is less than the fourth threshold, and the fourth threshold is less than the fifth threshold.

14. The apparatus according to claim 13, characterized in that, When the degree of numerical missingness is less than or equal to the missing threshold, the second determining module, when determining the target data repair method corresponding to the target feature variable based on the correlation coefficient, the first threshold, the second threshold, the third threshold, the fourth threshold, and the fifth threshold, is used for: If the correlation coefficient is greater than the fifth threshold and less than the first threshold, then the target data repair method corresponding to the target feature variable is determined to be the construction function method. If the correlation coefficient is greater than the fourth threshold and less than or equal to the fifth threshold, or if the correlation coefficient is greater than or equal to the first threshold and less than the second threshold, then the target data repair method corresponding to the target feature variable is determined to be the feature scaling method. If the correlation coefficient is greater than the third threshold and less than or equal to the fourth threshold, or if the correlation coefficient is greater than or equal to the second threshold and less than or equal to the third threshold, then the target data repair method corresponding to the target feature variable is determined to be a statistical method.

15. The apparatus according to claim 9, characterized in that, The target data repair method is a function construction method; when the repair module repairs the target feature variable using the target data repair method to obtain the repaired feature variable, it is used for: Using the correlation coefficient as the slope, a linear function is constructed to approximate the true linear function in order to fill the missing values ​​in the target feature variable.

16. The apparatus according to claim 9, characterized in that, The target data repair method is a feature scaling method; when the repair module repairs the target feature variable using the target data repair method to obtain the repaired feature variable, it is used for: Calculate the average value of the target feature variable; Based on the correlation coefficient, scaling factor, and average value, the missing values ​​in the target feature variable are supplemented.

17. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to execute instructions to implement the steps of the method as described in any one of claims 1-8.

18. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1-8.

19. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1-8.

Images