Abnormality detection method, abnormality detection device, and computer program product

Abstract

The invention relates to an anomaly detection method, an anomaly detection device and a computer program product. The anomaly detection method comprises the steps of performing denoising processing on noise data through a denoising model to generate denoised data; performing correction processing on the denoised data based on data to be detected, so that the corrected data is closer to the data to be detected than the denoised data; inputting the corrected data into the de-noising model, and iterating de-noising processing and correction processing for multiple times to obtain final corrected data; and detecting whether the to-be-detected data is abnormal or not based on the final correction data and the to-be-detected data. According to the anomaly detection method disclosed by the invention, the artificial intelligence model is used for automatically detecting the anomaly existing in various to-be-detected data, so that the anomaly can be detected in time, the demand of field investigation of engineers is reduced, and the anomaly detection efficiency and accuracy are improved.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence detection, and in particular to an anomaly detection method, an anomaly detection device, and a computer program product. Background Technology

[0002] With the rapid development of internet and communication technologies, the amount of information is growing exponentially, and the complexity of communication networks and base stations is also increasing. Consequently, the number and scale of metrics that need to be monitored have surged. Failure to identify and respond to potential errors in a timely manner may lead to serious risks such as service interruptions. Therefore, implementing timely anomaly detection mechanisms has become crucial to ensure the stability and reliability of the system.

[0003] Traditional anomaly monitoring relies on regular manual inspections. However, the rapid increase in information volume and network complexity brought about by advancements in communication technology has led to a high frequency of fault detection and significant challenges in fault repair. Therefore, traditional manual inspections are not only costly but also suffer from slow response times, poor security, unverifiable results, and incomplete information. Consequently, there is a growing trend towards developing automated measures to monitor the operation of wireless communication networks, enabling rapid fault detection and timely corrective action. Summary of the Invention

[0004] While some automated anomaly detection methods have emerged, their performance in practical applications has been less than satisfactory. The main problem lies in their failure to fully utilize the vast amounts of existing known data, resulting in relatively low detection accuracy. Therefore, there is an urgent need to develop more intelligent and efficient solutions to improve the accuracy and reliability of anomaly detection, thereby better meeting the needs of modern communication networks and information systems.

[0005] In view of the above problems, this disclosure provides an anomaly detection method, an anomaly detection device, and a computer program product.

[0006] According to one aspect of this disclosure, an anomaly detection method is provided, comprising:

[0007] The noisy data is denoised using a denoising model to generate denoised data.

[0008] The denoised data is corrected based on the data to be detected, so that the corrected data is closer to the data to be detected than the denoised data.

[0009] The corrected data is input into the denoising model, and the denoising and correction processes are iterated multiple times to obtain the final corrected data; and

[0010] The final corrected data and the data to be detected are used to detect whether there are any anomalies in the data to be detected.

[0011] According to one example of this disclosure, the corresponding model parameters of the denoising model are selected for denoising based on the number of iterations that the denoising process has been performed.

[0012] According to one example of this disclosure, the noise data follows the same noise distribution as the training data used to train the denoising model, and the size of the noise data is the same as the size of the data to be detected.

[0013] According to one example of this disclosure, the correction process is based on all points in the data to be detected.

[0014] According to one example of this disclosure, the correction process is based on a gradient correction method to make the corrected data closer to the data to be detected relative to the denoised data.

[0015] According to an example of this disclosure, implementing the correction process based on the gradient correction method includes:

[0016] Obtain the difference between the data to be detected and the denoised data;

[0017] The difference is multiplied by the weight and then added to the denoised data to obtain the corrected data.

[0018] According to one example of this disclosure, detecting whether the data to be detected is abnormal includes: determining that the data to be detected is abnormal when the difference between a point in the corrected data and the corresponding point in the data to be detected is greater than a threshold.

[0019] According to one example of this disclosure, the data to be detected is a time series of indicators of a communication system.

[0020] According to another aspect of this disclosure, an anomaly detection device is provided, comprising:

[0021] A denoising unit is configured to denoise the noisy data using a denoising model to generate denoised data; and

[0022] The correction unit is configured to correct the denoised data based on the data to be detected, so that the corrected data is closer to the data to be detected than the denoised data.

[0023] The denoising unit and the correction unit are configured to iterate the denoising and correction processes multiple times on the corrected data to obtain the final corrected data.

[0024] The anomaly detection device further includes a detection unit configured to detect whether there is an anomaly in the data to be detected based on the final corrected data and the data to be detected.

[0025] According to another aspect of this disclosure, a computer program product is provided, including computer instructions, wherein the computer instructions, when executed by a processor, implement the above-described anomaly detection method.

[0026] According to the anomaly detection method disclosed herein, an artificial intelligence model is used to automatically detect anomalies in various types of data to be detected. This enables timely anomaly detection, reduces the need for on-site inspections by engineers, and improves the efficiency and accuracy of anomaly detection. Furthermore, by using all points of the detected data to correct the data after denoising by the artificial intelligence model, all known information is fully utilized, further improving the accuracy of anomaly detection. In addition, applying the anomaly detection method described herein to communication networks allows for the timely detection and appropriate handling of network anomalies, thereby improving the reliability of the communication network. Attached Figure Description

[0027] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0028] Figure 1 This is a schematic diagram showing the output data of an interpolation-based anomaly detection method;

[0029] Figure 2 This is a flowchart illustrating an anomaly detection method according to one embodiment of the present disclosure;

[0030] Figure 3 This is a schematic diagram illustrating an anomaly detection method according to an embodiment of the present disclosure;

[0031] Figure 4 The graph shows the performance of the interpolation-based anomaly detection method and embodiments of this disclosure.

[0032] Figure 5 A schematic diagram of an anomaly detection apparatus according to an embodiment of the present disclosure is shown; and

[0033] Figure 6 A schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure is shown. Detailed Implementation

[0034] The technical solutions in the embodiments of this disclosure will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this disclosure. All other embodiments obtained by those skilled in the art based on the embodiments of this disclosure without creative effort are within the scope of protection of this disclosure.

[0035] This application uses flowcharts to illustrate the steps of a method according to embodiments of this application. It should be understood that the preceding or following steps are not necessarily performed in exact order. Instead, the steps can be processed in reverse order or simultaneously. Furthermore, other operations can be added to these processes, or one or more steps can be removed from them.

[0036] Figure 1 This is a schematic diagram showing the output data of an interpolation-based anomaly detection method.

[0037] Interpolation-based anomaly detection methods first select a subset of observation points from the data to be detected. Noisy data is then input into a denoising model. This model uses the observed points as a hard constraint on the output data, while not restricting other points, resulting in denoised data. After multiple denoising iterations by the model, the final output data is obtained. However, due to the limited number of selected observation points, the output is only constrained by these points, leading to multiple possibilities for the output, for example... Figure 1 The first and second outputs are analyzed. The first output represents the expected normal data. Comparing the first output with the data to be detected reveals a significant overall difference, indicating an anomaly in the data. Further analysis suggests an anomaly exists in the middle segment of the data, while the beginning and end segments are normal, which is correct. Therefore, the anomaly detection derived from the first output is accurate. In contrast, the second output is clearly not the expected normal data. Although comparing the second output with the data to be detected reveals a significant difference, indicating an anomaly, further segmentation would incorrectly conclude that the beginning and end segments of the data also contain anomalies. This is because interpolation-based anomaly detection methods select too few observation points, failing to fully utilize all known information to generate denoised data.

[0038] Figure 2 A flowchart of an anomaly detection method according to one embodiment of the present disclosure is shown.

[0039] Reference Figure 2 The flowchart of the anomaly detection method 200 according to embodiments of the present disclosure will be described in detail below. For example... Figure 2 As shown, the anomaly detection method 200 of this disclosure includes the following steps S202 to S208.

[0040] In step S202, the noisy data is denoised using a denoising model to generate denoised data.

[0041] In embodiments of this disclosure, the denoising model is an artificial intelligence model used to generate expected normal data by denoising noisy data. In some embodiments, the denoising model can be a generative model. In some embodiments, the denoising model can be a diffusion model. In this document, a diffusion model is used as an example to illustrate the denoising model; however, those skilled in the art will understand that other applicable generative models can be used for denoising.

[0042] In this paper, the diffusion model has a forward process and a reverse process, both of which are parameterized Markov chains. In the forward process, random noise with a certain distribution (e.g., Gaussian distribution) is gradually added to the original data through the Markov chain in the diffusion steps. As more random noise is added, the data eventually becomes pure noise data conforming to this distribution. For example, if the random noise added to the training data of the denoising model follows an N(0,1) Gaussian distribution each time, then the final generated pure noise data will also follow an N(0,1) Gaussian distribution. Then, the diffusion model is trained using the original data, the progressively added noise data, and the final pure noise data as training data to learn and optimize the reverse diffusion process. Finally, the trained diffusion model can use the reverse diffusion process to restore the pure noise data to a certain type of original data.

[0043] In embodiments of this disclosure, the denoising model can use the reverse diffusion process of a diffusion model to progressively denoise the data, ultimately generating noise-free data. In some embodiments of this disclosure, the noise data input to the denoising model follows the same noise distribution as the noise in the training data of the denoising model. In some embodiments, the noise data may conform to a Gaussian distribution, such as N(0,1), N(0,2), N(1,2), or other Gaussian distributions.

[0044] In step S204, the denoised data is corrected based on the data to be detected, so that the corrected data is closer to the data to be detected than the denoised data.

[0045] In embodiments of this disclosure, the data to be detected is data that needs to be monitored for anomalies in various application scenarios, including but not limited to signal waves (such as communication signal waves, audio, etc.), images, and text. In some embodiments, the data to be detected may be data with a time dimension. In some embodiments, the data to be detected may be a time series. In communication network applications, the data to be detected may be communication metrics that need to be monitored, such as received signal strength, signal-to-noise ratio, throughput, packet loss rate, etc. In some embodiments of this disclosure, the noise data input to the denoising model has the same size as the data to be detected, so that the denoised data and the data to be detected have a similar size.

[0046] In step S206, it is determined whether the preset number of iterations T has been reached, for example, 100 times. If the number of iterations already completed has not exceeded T... Figure 2 If "yes" is selected in the code, return to step S202; otherwise ( Figure 2 If the condition is "No" in the original text, proceed to step S206. The preset number of iterations T is a positive integer greater than 0.

[0047] In embodiments of this disclosure, the correction process may employ a gradient correction method to make the corrected data closer to the data to be detected than the denoised data.

[0048] In some embodiments of this disclosure, the correction process implemented by gradient correction includes: obtaining the difference between the data to be detected and the denoised data; and multiplying the difference by a weight and then adding the denoised data to obtain the corrected data. In other words, the correction process can be implemented using the following formula (1):

[0049] X′ t =X t +α(ZX t (1)

[0050] Where Z represents the data to be detected, X t Let α represent the denoised data in the t-th iteration, α represent the weight used to limit the step size of the corrected data from moving closer to the data to be detected, and t represent the current iteration number, where t is greater than 0 and less than a preset iteration depth T. In some embodiments, the weight α can be set to less than or equal to 0.3. In some embodiments, the weight α can be set to less than or equal to 0.2. In other embodiments, the weight α can be set to a value of 0.1 or smaller. The purpose of setting a smaller weight is to prevent the corrected data from moving too quickly towards the data to be detected, thus introducing potential outliers. Those skilled in the art should understand that, in addition to the gradient correction method described above for correcting the denoised data, other correction methods that slightly move the corrected data closer to the data to be detected can also be used in other embodiments.

[0051] In step S208, anomalies in the data to be detected are detected based on the final corrected data and the data to be detected. In some embodiments, anomalies can be detected by comparing the final corrected data and the data to be detected. For example, in some embodiments, anomalies are determined to exist in the data to be detected when the difference between a point in the final corrected data and the corresponding point in the data to be detected is greater than a threshold. In some embodiments, anomalies are determined to exist in the data to be detected when the difference between a point in the final corrected data and the corresponding point in the data to be detected is less than or equal to a threshold.

[0052] In some embodiments, the model parameters of the denoising model are different for each iteration. For example, the corresponding model parameters of the denoising model are selected based on the number of iterations already performed. This is because the training phase uses progressively noisy data, so each step aims to achieve a different denoising effect. In such embodiments, the preset number of iterations T is the total number of steps in the back-diffusion process. In some embodiments, the number of iterations can be selected based on the number of all points in the data to be detected; the larger the number of all points in the data to be detected, the more iterations are required.

[0053] In other embodiments, the denoising model may have a single set of model parameters, meaning that the model parameters remain fixed throughout the denoising process in each iteration. In other words, only one set of model parameters is trained for different iterations during the training phase. In such embodiments, a non-preset number of iterations can be used; for example, the number of iterations can be determined based on the corrected data. For instance, when the randomness of the corrected data is reduced to a certain level (e.g., the frequency distribution is sufficiently far from a specific probability distribution, such as a uniform distribution or a Gaussian distribution), the noise contained in the corrected data can be considered sufficiently low, and such corrected data should be considered data that was originally without anomalies. In some embodiments, the weights can be selected based on the desired number of iterations, i.e., the magnitude or step size by which the data approaches the target data in each iteration; the fewer the desired number of iterations, the larger the weights can be set. However, as mentioned above, the weights cannot be set too large. By setting smaller weights, the corrected data will not approach the target data too quickly, thus introducing potential outliers.

[0054] In some embodiments, as described above, the data to be detected can be time series data. Those skilled in the art will understand that when the data to be detected is time series data, the denoised data, the corrected data, and the final corrected data are also time series data.

[0055] Figure 3 A schematic diagram of an anomaly detection method according to an embodiment of the present disclosure is shown. Reference is now made to... Figure 3 The anomaly detection method of the embodiments of this disclosure is further explained.

[0056] As shown in Figure 3, the noise data X T Input into the denoising model g θ Denoising model g θ (Where θ is the parameter of the denoising model) Based on the received noise data X T Generate the first data X after denoising T-1 Then, based on the data to be detected Z, the first data X after denoising is processed. T-1 Perform correction processing to make the corrected first data X' T-1 Compared to the first data X after denoising T-1 The data is closer to the data to be detected, thus making the corrected first data X' T-1 Slightly move closer to the data to be detected, Z. Then, adjust the first data X' after correction. T-1 Input into the denoising model g θ Denoising model g θ Based on the received corrected first data X' T-1 Generate the second data X after denoising T-2 Then, based on the data to be detected Z, the denoised second data X is processed. T-2 Perform correction processing to make the corrected second data X' T-2 Compared to the denoised second data X T-2 The second data X' is closer to the data to be detected, thus making the corrected data X' more accurate. T-2 The data is then slightly moved closer to the target data Z. This process is repeated T times (T is a positive integer greater than 0, representing the number of iterations) to denoise and correct the data, resulting in the final corrected data X'0. The final corrected data X'0 is then compared with the target data Z to detect whether there are any anomalies in the target data Z. Figure 3 The denoising model and correction process shown can be similar to Figure 2 The denoising model and correction process described in the document.

[0057] exist Figure 3 In this implementation, all points of the data to be detected are used in the correction process to make the corrected data closer to the data to be detected, making full use of known information. Furthermore, in Figure 3 In the implementation method described above, the corrected i-th data X' can also be limited by the magnitude of the weight α. T-i The speed at which the data Z approaches the target data is determined by the selection of the magnitude of α, ensuring that the corrected data does not approach the target data too quickly and introduce potential outliers. Here, i represents the current iteration number in the T iterations.

[0058] In embodiments of this disclosure, the process of detecting whether an anomaly exists can be performed on a point-by-point basis. For example, the difference between a point in the final corrected data X'0 and the corresponding point in the data to be detected Z can be used to determine whether an anomaly exists. Alternatively, the process of detecting whether an anomaly exists can be performed on a line segment composed of multiple points. If the difference between any point in the line segment and the corresponding point in the data to be detected Z exceeds a threshold, the line segment is considered to have an anomaly.

[0059] In the embodiments of this disclosure, after an anomaly is detected in the data to be detected by the anomaly detection method, a machine learning model can be used to identify various types of anomalies, that is, to perform root cause analysis based on expert knowledge, and then determine which of the following types the anomaly is: a key quality indicator (KQI) anomaly, a key performance indicator (KPI) anomaly, a hardware anomaly, a software anomaly, an interference anomaly, a blocking anomaly, and any other suitable type of anomaly.

[0060] Figure 4 The graph shows the performance of the interpolation-based anomaly detection method and embodiments of this disclosure. Figure 4 The diagram shows two metrics: F1 score and recall. The F1 score is the harmonic mean of precision and recall, providing a balance between model precision and recall. Recall focuses on whether the diffusion model can detect all outliers, while precision focuses on how many of the outliers detected by the diffusion model are correct.

[0061] refer to Figure 4 It is known that the F1 score of anomaly detection methods based on interpolation exhibits significant fluctuations, with a highly significant difference between the maximum and minimum values. However, the anomaly detection method according to the embodiments of this disclosure maintains an average F1 score near the maximum value of interpolation-based methods without significant fluctuations.

[0062] Next, refer to Figure 4 It is known that the recall rate of anomaly detection methods based on interpolation exhibits significant fluctuations, with a highly significant difference between the maximum and minimum values. However, the anomaly detection method according to the embodiments of this disclosure maintains a recall rate near the maximum value of interpolation-based methods without significant fluctuations.

[0063] The embodiments of this disclosure use all known information (all points) of the data to be detected in each step of the correction process, thus avoiding the problem of poor stability caused by selecting a small number of observation points in interpolation-based methods, and effectively improving stability while ensuring performance.

[0064] The embodiments of this disclosure limit the approach speed through a weight α, thus preventing the model from approaching outliers in the data to be detected too quickly. Furthermore, in the embodiments of this disclosure, the diffusion model is trained using normal data, so outliers in the data to be detected are eliminated during multiple iterations.

[0065] Below, refer to Figure 5 An anomaly detection apparatus 600 according to an embodiment of the present disclosure is described. Figure 5 This is a schematic diagram of an anomaly detection device according to an embodiment of the present disclosure. The function of the anomaly detection device in this embodiment is similar to that described above. Figure 2 The methods described are identical in detail, so for simplicity, detailed descriptions of the same content are omitted here.

[0066] An anomaly detection apparatus according to an embodiment of the present disclosure includes a processor 502 and a memory 501 storing computer-readable instructions. When the computer-readable instructions are executed by the processor, an anomaly detection method is performed, including: denoising noisy data using a denoising model to generate denoised data; correcting the denoised data based on data to be detected, such that the corrected data is closer to the data to be detected than the denoised data; inputting the corrected data into the denoising model, iterating the denoising and correction processes multiple times to obtain final corrected data; and detecting whether anomalies exist in the data to be detected based on the final corrected data and the data to be detected.

[0067] For the technical effects of the anomaly detection device 500 based on the denoising model in different embodiments, please refer to the technical effects of the anomaly detection method based on the denoising model provided in the embodiments of this disclosure, which will not be repeated here.

[0068] The anomaly detection device 500 based on the denoising model can be used in a variety of suitable electronic devices.

[0069] Figure 6 This is a schematic diagram of a computer-readable storage medium 600 according to an embodiment of the present disclosure.

[0070] like Figure 6As shown, this disclosure also includes a computer-readable storage medium 600 storing computer-readable instructions 601 thereon. When the computer-readable instructions are executed by a computer, the computer executes an anomaly detection method based on a denoising model, including: denoising noisy data using a denoising model to generate denoised data; correcting the denoised data based on the data to be detected, making the corrected data closer to the data to be detected than the denoised data; inputting the corrected data into the denoising model, iterating the denoising and correction processes multiple times to obtain final corrected data; and detecting whether there is an anomaly in the data to be detected based on the final corrected data and the data to be detected.

[0071] The various methods / implementations described in this specification can be used individually or in combination, and can be switched during execution. Furthermore, the processing steps, sequences, flowcharts, etc., of the various methods / implementations described in this specification can be rearranged as long as there are no contradictions. For example, regarding the methods described in this specification, various step units are given in an exemplary order, but the method is not limited to the specific order given.

[0072] The use of the word "based on" in this specification, unless explicitly stated elsewhere, does not imply "based on only". In other words, the use of "based on" refers to both "based on only" and "based on at least".

[0073] Any reference to units using the names "first," "second," etc., as used in this specification is not intended to fully define the number or order of these units. These names may be used in this specification as a convenient method of distinguishing two or more units. Therefore, reference to a first unit and a second unit does not imply that only two units may be used, or that the first unit must take precedence over the second unit in some form.

[0074] When the terms "comprising," "including," and variations thereof are used in this specification or claims, these terms are open-ended, just like the term "possessing." Furthermore, the term "or" as used in this specification or claims is not an XOR expression.

[0075] Those skilled in the art will understand that aspects of this application can be described and illustrated through a number of patentable types or situations, including any new and useful combination of processes, machines, products, or substances, or any new and useful improvements thereof. Accordingly, aspects of this application can be implemented entirely by hardware, entirely by software (including firmware, resident software, microcode, etc.), or by a combination of hardware and software. All of the above hardware or software may be referred to as a “data block,” “module,” “engine,” “unit,” “component,” or “system.” Furthermore, aspects of this application may be embodied as a computer product located on one or more computer-readable media, the product including computer-readable program code.

[0076] This application uses specific terms to describe embodiments of the application. Terms such as "an embodiment," "one embodiment," and / or "some embodiments" refer to a particular feature, structure, or characteristic associated with at least one embodiment of the application. Therefore, it should be emphasized and noted that references to "an embodiment," "one embodiment," or "an alternative embodiment" in different locations throughout this specification do not necessarily refer to the same embodiment. Furthermore, certain features, structures, or characteristics in one or more embodiments of the application can be appropriately combined.

[0077] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. It should also be understood that terms such as those defined in a common dictionary shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and not as having an idealized or highly formalized meaning, unless expressly defined herein.

[0078] The present disclosure has been described in detail above; however, it will be apparent to those skilled in the art that the present disclosure is not limited to the embodiments described herein. The present disclosure can be implemented in modified and altered ways without departing from the spirit and scope defined by the claims. Therefore, the description herein is for illustrative purposes only and is not intended to be restrictive.

Claims

1. An anomaly detection method, comprising: The noisy data is denoised using a denoising model to generate denoised data. The denoised data is corrected based on the data to be detected, so that the corrected data is closer to the data to be detected than the denoised data. The corrected data is input into the denoising model, and the denoising and correction processes are iterated multiple times to obtain the final corrected data. as well as The final corrected data and the data to be detected are used to detect whether there are any anomalies in the data to be detected.

2. The anomaly detection method according to claim 1, wherein, Based on the number of iterations of the denoising process, the corresponding model parameters of the denoising model are selected for denoising processing.

3. The anomaly detection method according to claim 1 or 2, wherein, The noise data follows the same noise distribution as the noise in the training data of the denoising model, and the size of the noise data is the same as the size of the data to be detected.

4. The anomaly detection method according to claim 1 or 2, wherein, The correction process is based on all points in the data to be detected.

5. The anomaly detection method according to claim 1 or 2, wherein, The correction process is based on gradient correction to make the corrected data closer to the data to be detected than the denoised data.

6. The anomaly detection method according to claim 5, wherein, The correction process based on the gradient correction method includes: Obtain the difference between the data to be detected and the denoised data; The difference is multiplied by the weight and then added to the denoised data to obtain the corrected data.

7. The anomaly detection method according to claim 1 or 2, wherein, Detecting whether the data to be detected is abnormal includes: When the difference between a point in the final corrected data and the corresponding point in the data to be detected is greater than a threshold, it is determined that the data to be detected is abnormal.

8. The anomaly detection method according to claim 1 or 2, wherein, The data to be detected is a time series of indicators of the communication system.

9. An anomaly detection device, comprising: The denoising unit is configured to denoise the noisy data using a denoising model to generate denoised data. as well as The correction unit is configured to correct the denoised data based on the data to be detected, so that the corrected data is closer to the data to be detected than the denoised data. The denoising unit and the correction unit are configured to iterate the denoising and correction processes multiple times on the corrected data to obtain the final corrected data. The anomaly detection device further includes a detection unit configured to detect whether there is an anomaly in the data to be detected based on the final corrected data and the data to be detected.

10. A computer program product comprising computer instructions, wherein, When the computer instructions are executed by the processor, they implement the anomaly detection method according to any one of claims 1 to 8.

Images