Abnormal state detection method, device and equipment

Abstract

The invention discloses an abnormal state detection method, device and equipment, and relates to the technical field of abnormal detection, and the abnormal state detection method comprises the steps: initializing a default matrix according to the number of state types corresponding to a detected system and a preset window length; sliding in a historical state sequence corresponding to the detected system based on a preset window length, and updating the default matrix according to frequencies of positions corresponding to various state types to obtain a target matrix; normalizing the frequency of each state type in the target matrix at each position to obtain a corresponding distribution probability matrix; and determining a test matrix corresponding to the test sequence of the detected system, and determining a state detection result corresponding to the test matrix according to the position distribution condition and the distribution probability matrix corresponding to each state type in the test matrix. The storage complexity of the system state sequence can be reduced, and the abnormal state detection efficiency is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of anomaly detection, and particularly relates to an anomaly state detection method, device and equipment. BACKGROUND

[0002] In a scene requiring real-time anomaly monitoring on a discrete state sequence of a system, such as industrial control system state monitoring, network traffic anomaly detection, business process anomaly analysis and the like, the state sequence of the system needs to be recorded and anomaly detection is performed based on the state sequence. A commonly used technical solution for recording the state sequence is an N-gram model. The basic principle of the N-gram model is to decompose the sequence into continuous subsequences with a length of N, and then model the normal mode of the sequence by counting the occurrence frequencies of the subsequences respectively.

[0003] However, the N-gram model needs to store all possible subsequence combinations, and the storage complexity is too high, resulting in high data query complexity when performing anomaly state detection, which affects the anomaly state detection efficiency. Especially when the number of states of the sequence or the window length corresponding to the subsequence increases, the storage requirement and storage complexity of the hardware increase exponentially, which restricts the efficiency of anomaly state detection of the system. SUMMARY

[0004] The main purpose of the present application is to provide an anomaly state detection method, device and equipment, aiming to reduce the storage complexity of the system state sequence and improve the efficiency of anomaly state detection.

[0005] To achieve the above purpose, the present application provides an anomaly state detection method, which comprises the following steps: Initializing a default matrix according to the number of state types corresponding to a detected system and a preset window length, wherein the number of rows of the default matrix is equal to the number of state types, and the number of columns of the default matrix is equal to the preset window length; Sliding the historical state sequence corresponding to the detected system based on the preset window length, and updating the default matrix according to the frequencies of positions corresponding to various state types, to obtain a target matrix; Normalizing the frequencies of various state types at various positions in the target matrix to obtain a corresponding distribution probability matrix; Determining a test matrix corresponding to a test sequence of the detected system, and determining a state detection result corresponding to the test matrix according to the position distribution of various state types in the test matrix and the distribution probability matrix.

[0006] In addition, to achieve the above purpose, the present application further provides an anomaly state detection device, which comprises: The matrix initialization module is configured to initialize a default matrix according to a number of state types corresponding to the system under test and a preset window length, wherein a number of rows of the default matrix is equal to the number of state types, and a number of columns of the default matrix is equal to the preset window length. The matrix updating module is configured to slide the historical state sequence corresponding to the system under test based on the preset window length, and update the default matrix according to frequencies of positions corresponding to various state types, to obtain a target matrix. The probability determining module is configured to normalize the frequencies of various state types in various positions in the target matrix, to obtain a distribution probability matrix. The result output module is configured to determine a test matrix corresponding to a test sequence of the system under test, and determine a state detection result corresponding to the test matrix according to a position distribution of various state types in the test matrix and the distribution probability matrix.

[0007] In addition, to achieve the above object, the application further provides an abnormal state detection device, which comprises a memory, a processor, and a computer program stored in the memory and capable of running on the processor, and the computer program is configured to implement the steps of the abnormal state detection method.

[0008] The one or more technical solutions provided by the application have at least the following technical effects: The application first initializes a default matrix according to a number of state types corresponding to the system under test and a preset window length, wherein a number of rows of the default matrix is equal to the number of state types, and a number of columns of the default matrix is equal to the preset window length, then slides the historical state sequence corresponding to the system under test based on the preset window length, and updates the default matrix according to frequencies of positions corresponding to various state types, to obtain a target matrix, then normalizes the frequencies of various state types in various positions in the target matrix, to obtain a distribution probability matrix, and finally determines a test matrix corresponding to a test sequence of the system under test, and determines a state detection result corresponding to the test matrix according to a position distribution of various state types in the test matrix and the distribution probability matrix.

[0009] Compared with the N-gram model storage scheme of the traditional scheme, the technical scheme of the present application uses a fixed-size default matrix to store the frequency of each state type at each position, which reduces the traditional exponential storage requirement to linear storage requirement, effectively reducing the storage overhead and storage complexity. Moreover, the present application uses a distribution probability matrix to detect abnormal states, which is obtained by normalizing the target matrix. The storage complexity of the target matrix is relatively small, so the storage complexity of the corresponding distribution probability matrix is also lower. Therefore, when detecting abnormal states, the query complexity is also lower than that of the traditional N-gram model scheme, thereby improving the detection speed and efficiency. Moreover, the technical scheme of the present application innovatively proposes a state-position two-dimensional decoupling representation method realized by a target matrix, records the frequency of the position corresponding to each state type in the target matrix, so that the target matrix can reflect the position information of various states, and improves the explainability of the state detection result in the position abnormality. BRIEF DESCRIPTION OF DRAWINGS

[0010] The accompanying drawings, which are incorporated into and form part of the specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the application.

[0011] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the drawings needed to be used in the embodiments or prior art description will be briefly introduced as follows. Obviously, those skilled in the art can obtain other drawings according to these drawings without any creative effort.

[0012] Figure 1 Flowchart provided for abnormal state detection method embodiment one of the present application; Figure 2 Flowchart provided for abnormal state detection method embodiment one of the present application for updating the target matrix by sliding the preset window; Figure 3 Flowchart provided for abnormal state detection method embodiment one of the present application for determining the state detection result according to the comprehensive score; Figure 4 Module structure diagram of the abnormal state detection device of the embodiment of the present application; Figure 5 Device structure diagram of the hardware running environment involved in the abnormal state detection method in the embodiment of the present application.

[0013] The purpose implementation, functional characteristics and advantages of the present application will be further described with reference to the embodiments and the accompanying drawings. DETAILED DESCRIPTION

[0014] It should be understood that the specific embodiments described herein are merely for the purpose of illustration of the technical solutions of the present application and are not used to limit the present application.

[0015] In order to better understand the technical solutions of the present application, the following will be described in detail in combination with the drawings of the specification and specific embodiments.

[0016] It should be noted that the execution subject of the present embodiment can be a computing service device with data processing, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc., or an electronic device, an abnormal state detection device, etc. capable of realizing the above functions. The present embodiment and the following embodiments will be described below taking the abnormal state detection device as an example.

[0017] Based on this, the present embodiment provides an abnormal state detection method, which refers to Figure 1 , Figure 1 The flowchart of the first embodiment of the abnormal state detection method of the present application is shown in the figure.

[0018] In the present embodiment, the abnormal state detection method comprises steps S10-S40: Step S10, according to the number of state types corresponding to the detected system and the preset window length, a default matrix is initialized, wherein the number of rows of the default matrix is equal to the number of state types, and the number of columns of the default matrix is equal to the preset window length; Wherein, the detected system can be an industrial system, or a general information system. The state output by the measured system is used to represent the state information. The number of state types refers to the number of all possible state categories, and the preset window length refers to the length of the subsequence needed to be collected when detecting the abnormality of the detected system. In actual situation, the preset window length will be determined according to the characteristics of the data, for example, according to the number of time dimension data, for example, a system will produce 100 data in one minute, and the engineer pays more attention to the abnormality in one minute, so the preset window length is set to 100; some high-frequency trading systems have 1000 data in one second, and the preset window length is set to 1000.

[0019] For example, the measured system is a bank transaction system, which has a field to mark the transaction state, 0 means success, 1 means failure, and 2 means other. As the system transaction occurs, the corresponding state sequence is generated, for example [0, 1, 0, 1, 0, 2, 0, 1, 1, 0]. For example, the measured system is an industrial system, and the corresponding state sequence is [0, 1, 0, 1, 0, 1, 0, 2, 1, 2], wherein 0=success, 1=failure, and 2=ongoing. The number of state types is n=3. If the test sequence of the industrial system for abnormal state detection is [2, 1, 0], the preset window length is m=3.

[0020] It should be noted that the default matrix initialized in step S10 is of a fixed size, which is n*m, so as to avoid the K^N storage complexity caused by the N-gram model, where K refers to the size of the state space and N refers to the length of the test sequence.

[0021] Exemplarily, the default matrix can be represented as: C = [0 0 0] / / the count of state 0 at each position; [0 0 0] / / the count of state 1 at each position; [0 0 0] / / the count of state 2 at each position.

[0022] In step S20, the historical state sequence corresponding to the detected system is slid based on a preset window length, and the default matrix is updated according to the frequency of the positions corresponding to various state types, to obtain a target matrix. In order to accurately identify the abnormal state of the detected system, it is necessary to determine the position distribution of each state type in the state sequence of the measured system in the normal state, wherein the historical state sequence is the state information of the detected system in the past period of time. In the embodiment of the application, the subsequence in each window is obtained by sliding the preset window length, and the positions (equivalent to sorting) of various state types in the window are recorded, and then recorded in the default matrix, so that the default matrix is updated to the target matrix recording the frequency of each position (such as position 0, position 1, position 2) of each state type (such as state 0, state 1, state 2).

[0023] In step S30, the frequency of each state type in each position in the target matrix is normalized to obtain a corresponding distribution probability matrix. In order to more intuitively reflect the distribution of various state types in various positions in the target matrix, the target matrix recording the frequency information is further normalized to obtain a distribution probability matrix reflecting the distribution probability of each state type in each position. Exemplarily, the target matrix is as follows: C = [6 6 5] / / indicates that the frequency of state 0 at positions 1, 2 and 3 is 6, 5 and 4 respectively; [6 1 6] / / indicates that the frequency of state 1 at positions 1, 2 and 3 is 6, 1 and 6 respectively; [1 1 2] / / indicates that the frequency of state 2 at positions 1, 2 and 3 is 1, 1 and 2 respectively.

[0024] After normalization, the distribution probability matrix obtained is as follows: P = [0.75 0.75 0.625] / / represents the probability distribution of state 0 at each position; [0.75 0.125 0.75] / / represents that state 1 has high probability at positions 0 and 2 and low probability at position 1; [0.125 0.125 0.25] / / represents that state 2 has the highest probability at position 2.

[0025] It should be noted that the method of embodying state sequence information through a distribution probability matrix in the embodiments of the present application significantly eliminates data sparsity compared to the traditional N-gram model scheme, and avoids the detection result being unreliable due to data sparsity. For example, most of the 3-grams in N-gram have a frequency of 0 or 1, and the sparsity is as high as 94%, and in the embodiments of the present application, it can be ensured that there is a corresponding probability value for each position, and 100% dense representation is achieved. Among them, the sparsity of 94% means that among all theoretically possible N-gram combinations, 94% of the combinations have never appeared in the training data (i.e. the frequency is 0).

[0026] That is, the core difference between the technical scheme of the present application and the traditional scheme is that N-gram belongs to enumeration sequence combination (exponential space K^N), and most combinations are not seen, and there are a large number of gaps with a frequency of 0. The scheme of the embodiments of the present application uses PSMAN (Position-Sensitive Matrix Anomaly Network), which decomposes the historical state sequence into state x position (linear space N x M), and each matrix position has statistical data, and there is no gap.

[0027] Step S40, determining a test matrix corresponding to the test sequence of the detected system, and determining a state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix.

[0028] Among them, the test matrix corresponding to the test sequence of the detected system refers to the state sequence corresponding to the recent preset window of the detected system, for example, the sequence of the last three states is [2, 1, 0], and the test matrix corresponding to the test sequence records the frequency of each state type at each position. Exemplarily, the test matrix T can be represented as: T = [0 0 1] / / represents state 0 at position 2; [0 1 0] / / represents state 1 at position 1; [1 0 0] / / represents state 2 at position 0.

[0029] In step S40, when determining the state detection result corresponding to the test matrix, the similarity between the position distribution of each state type in the test matrix and the distribution probability matrix is analyzed. It can be understood that the distribution probability matrix reflects the distribution of each abnormal type at each position in the normal system, and the test matrix reflects the position distribution of each state type in the current test sequence. The closer the respective distribution of the two, the greater the possibility that the state represented by the test sequence is normal. The farther the respective distribution of the two, the greater the possibility that the state represented by the test sequence is abnormal.

[0030] In the specific implementation process, the similarity between the position distribution of each state type in the test matrix and the distribution probability matrix can be analyzed by various indicators, such as overall cosine similarity, distribution probability difference of each state type, average distribution probability, etc. The corresponding threshold can also be set according to the actual situation. In the case where the similarity is greater than a certain threshold, the state detection result can be determined as normal, otherwise as abnormal. This is not limited here.

[0031] The embodiment of the present application provides a sliding window matrix accumulation compression mechanism, solves the problem of exponential growth of storage complexity (complexity O(K^N)) of the N-gram method, changes the traditional enumeration of all possible N-gram combinations to accumulation counting record frequency in a fixed two-dimensional matrix. Specifically, instead of enumerating K^N possible combinations, a fixed N x M matrix is used for storage; through sliding window traversal and matrix position accumulation, the exponential storage requirement is reduced to linear; from the theoretical storage requirement of 4^5=1024 units to 4x5=20 units, the storage overhead is reduced by 51 times, and the storage complexity is greatly reduced.

[0032] It should be noted that in the case where the window length is 3 and the number of state types is 3, the embodiment of the present application can use 3x3=9 storage units to complete the information storage of the state sequence, while the N-gram method needs to allocate storage space for 3^3=27 possible 3-grams. In terms of theoretical storage requirements, the present application O(n x m)=9 vs N-gram O(K^N)=27, saving 67% of storage space. Experiments show that in the case where the number of state types is 4 and the window length is 5, the abnormal state detection method of the present application can complete the storage through 20 units, while the N-gram scheme needs 1024 units, saving 95% of storage space. Through actual engineering verification, the storage efficiency of the abnormal state detection method of the present application is improved by 51 times under the same hardware configuration, and the problem of exponential growth of storage complexity is completely solved.

[0033] Furthermore, in one feasible embodiment, such as Figure 2 As shown, the step of sliding the target matrix based on a preset window length within the historical state sequence of the detected system, and updating the default matrix according to the frequency of each state type's position within the preset window, may include: Step S21: Starting from the first state in the historical state sequence, select a preset number of positions from the historical state sequence, where the preset number is equal to the preset window length. Step S22: Obtain the state type corresponding to each position, record the state type corresponding to each position into the default matrix, and obtain the accumulation matrix; Step S23: Shift the starting position one position to the right, select a preset number of positions from the historical state sequence, obtain the state type corresponding to each position, update the state type corresponding to each position to the accumulation matrix, and obtain the updated accumulation matrix. The accumulation matrix includes the frequency corresponding to each state position pair. A state position pair refers to a combination of a state type and a position. Before completing the traversal of the historical state sequence, return to step S23: shift the starting position one position to the right. After completing the traversal of the historical state sequence, execute step S24 to determine the current accumulated matrix as the target matrix.

[0034] During the traversal of the historical state sequence, the first state is taken as the starting position, and the first m states are selected as the first window. Then, the state type of each position in the subsequence corresponding to the first window is counted. Taking the historical state sequence [0, 1, 0, 1, 0, 1, 0, 2, 1, 2] as an example, the starting position is "0", the first window is [0,1,0], where state 0 is at positions 0 and 2 (i.e., the frequency of 0 at position 0 is 1, and the frequency of 0 at position 2 is 1), and state 1 is at position 1 (i.e., the frequency of 1 at position 1 is 1). After recording them in the default matrix, the resulting cumulative matrix can be represented as: C = [1 0 1] [0 1 0] [0 0 0] After the data in the first window is recorded, the starting position is shifted one position to the right (from "0" to "1"). Window 2 is [1,0,1], where state 1 is at positions 0 and 2, and state 0 is at position 1. The frequency of each state type in window 2 at each position (equivalent to a state position pair) is recorded in the accumulation matrix. This process is repeated. The information represented by each window is as follows: Window 3: [0,1,0], state 0 is at positions 0 and 2, state 1 is at position 1; Window 4: [1,0,1], state 1 at position 0 and 2, state 0 at position 1; Window 5: [0,1,0], state 0 at position 0 and 2, state 1 at position 1; Window 6: [1,0,2], state 1 at position 0, state 0 at position 1, state 2 at position 2; Window 7: [0,2,1], state 0 at position 0, state 2 at position 1, state 1 at position 2; Window 8: [2,1,2], state 2 at position 0 and 2, state 1 at position 1; After processing the first 5 windows, the accumulated matrix is: C = [5 5 5] / / state 0 appears at each position 5 times; [5 0 5] / / state 1 mainly appears at position 0 and 2; [0 0 0] / / state 2 does not appear.

[0035] After processing window 6, the accumulated matrix is: C = [5 6 5] / / state 0 appears at position 1 one more time; [6 0 5] / / state 1 appears at position 0 one more time; [0 0 1] / / state 2 appears at position 2 for the first time.

[0036] After processing window 7, the accumulated matrix is: C = [6 6 5] / / state 0 appears at position 0 one more time; [6 0 6] / / state 1 appears at position 2 one more time; [0 1 1] / / state 2 appears at position 1 for the first time.

[0037] After processing window 8, the accumulated matrix is: C = [6 6 5] / / state 0 count remains unchanged; [6 1 6] / / state 1 appears at position 1 one more time; [1 1 2] / / state 2 appears at position 0 and 2 each one more time.

[0038] After processing window 8, all states in the historical state sequence have been traversed, and the accumulated matrix can be determined as the target matrix.

[0039] Compared with the traditional N-gram scheme, the above-mentioned manner of recording the information of the historical state sequence through accumulation matrix counts [0, 1, 0] and [1, 0, 1] as different patterns, but loses the position rule of "state 0 often at the beginning / end", while the embodiment of the application records the position rule information.

[0040] In another possible embodiment, the above-mentioned scheme of the embodiment of the application also supports flexible state sequence expansion. For example, a new state sequence [2, 0, 1, 2, 0] can be directly accumulated on the basis of the existing matrix, and the corresponding new windows are [2, 0, 1], [0, 1, 2] and [1, 2, 0]. The target matrix after fusion can be expressed as: C = [7 7 6] / / count after accumulating the new sequence; [7 2 7] [2 2 3] Compared with the N-gram which needs to re-count the 3-gram frequencies of all sequences, the complexity is high. The embodiment of the application supports incremental learning, and can directly accumulate new data on the existing target matrix, without the need to re-count all historical state sequences, so that the data addition efficiency is high, and the matrix size is unchanged, and the exponential growth of storage demand is avoided. The incremental learning time complexity of the embodiment of the application can be expressed as O(Txm), while the incremental learning time complexity of the N-gram method is expressed as O(total_dataxN). As can be seen, the incremental learning time complexity of the embodiment of the application can remain constant, while the incremental learning time complexity of the N-gram method increases with the data volume. Through incremental learning, online learning and real-time model updating can be supported, and the dynamic industrial environment can be adapted.

[0041] In a possible embodiment, the step of recording the frequencies of each state type corresponding to each position into the default matrix to obtain the accumulation matrix can include the following steps. Step S231, for each state type, determining the matrix row corresponding to the state type in the default matrix, wherein each state type uniquely corresponds to a matrix row in the default matrix; Step S232, recording the frequencies of each position corresponding to the state type in the matrix row corresponding to the state type in the default matrix.

[0042] Each state type (for example, normal=0, abnormal=1, and in progress=2) uniquely corresponds to a matrix row in the default matrix. For example, 0 corresponds to the first row of the matrix, 1 corresponds to the second row of the matrix, and 2 corresponds to the third row of the matrix. In the case of a preset window length m=3, each row of the matrix includes three columns. Position 0 corresponds to the first column of the matrix, position 1 corresponds to the second column of the matrix, and position 2 corresponds to the third column of the matrix.

[0043] Exemplarily, for the first window [0, 1, 0], two state types 0 and 1 are included, wherein 0 corresponds to the first row of the matrix, 1 corresponds to the second row of the matrix, 0 is located at position 0 and position 2, corresponding to the first column and the third column of the first row of the matrix, and “1” is located at position 1, corresponding to the second of the second row of the matrix, that is, the corresponding accumulated matrix is: C = [1 0 1] [0 1 0] [0 0 0] Similarly, after the preset window is slid, when the accumulated matrix is updated according to the state types included in the second window and the corresponding positions, the frequencies of the positions corresponding to the state types are accumulated in the positions of the matrix row corresponding to the state types in the matrix row of the accumulated matrix.

[0044] Exemplarily, for the second window [1, 0, 1], two state types “0” and “1” are included, wherein state 1 is located at position 0 and position 2, corresponding to position 0 and position 2 of the second row of the matrix, and state 0 is located at position 1, corresponding to position 1 of the first row of the matrix.

[0045] The updated accumulated matrix is: C = [1 0 1] [1 1 1] [0 0 0] In a possible embodiment, the step of determining the state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix can include: Step S401, calculating the cosine similarity between the test matrix and the distribution probability matrix; Step S402, if the cosine similarity is less than a preset similarity threshold, determining that the state detection result is abnormal; Step S403, if the cosine similarity is greater than or equal to the preset similarity threshold, determining that the state detection result is normal.

[0046] The test matrix reflects the position of each state type in the current state sequence of the detected system, and the distribution probability matrix reflects the position distribution of each state type of the detected system in the normal state. In the embodiment of the application, the cosine similarity is used as a parameter to measure the similarity between the test matrix and the distribution probability matrix. The greater the cosine similarity, the closer the position of each state type in the test matrix to the position distribution of the state type of the detected system in the normal state. By comparing the preset similarity threshold with the calculated cosine similarity, it is quickly determined whether the state detection result is normal.

[0047] Exemplarily, the test matrix is: T = [0 0 1] / / State 0 is at position 2; [0 1 0] / / State 1 is at position 1; [1 0 0] / / State 2 is at position 0.

[0048] The probability distribution matrix is: P = [0.75 0.75 0.625] [0.75 0.125 0.75] [0.125 0.125 0.25] The process of calculating cosine similarity is as follows: First, flatten the two matrices and write them in vector form: The vector corresponding to the probability distribution matrix is ​​vec_P = [0.75, 0.75, 0.625, 0.75, 0.125, 0.75, 0.125, 0.125, 0.25]. The vector corresponding to the test matrix is ​​vec_T = [0, 0, 1, 0, 1, 0, 1, 0, 0].

[0049] Then multiply the two vectors to get the dot product: dot_product = 0.75×0 + 0.75×0 + 0.625×1 + 0.75×0 + 0.125×1 +0.75×0 + 0.125×1 + 0.125×0 + 0.25×0 = 0.875; Calculate the norm_P of the probability distribution matrix: norm_P = =1.677; Calculate the norm_T of the test matrix: norm_T = = = 1.732; Finally, the cosine similarity was calculated as: similarity = dot_product / (norm_P × norm_T) = 0.875 / (1.677 × 1.732) = 0.301.

[0050] The preset similarity threshold can be set to 0.4. Taking the cosine similarity mentioned above as an example, 0.301 is less than 0.4, so the state detection result is abnormal.

[0051] In the determination of the state detection result by the cosine similarity, taking a 3x3 test matrix as an example, the overall calculation process of the embodiment of the application only involves: matrix construction, complexity O(m)=O(3), vector calculation, complexity O(nxm)=O(9), similarity calculation, complexity O(nxm)=O(9). In summary, the total complexity O(m), while the N-gram needs a query complexity of O(K^N). In actual tests, the embodiment of the application improves the speed of abnormal state detection of the system by 2-3 times. Due to the low storage overhead and low complexity characteristics of the abnormal state detection scheme of the embodiment of the application, it can better meet the requirements of industrial real-time monitoring.

[0052] In another possible embodiment, the step of determining the state detection result corresponding to the test matrix according to the position distribution corresponding to each state type in the test matrix and the distribution probability matrix can include: Step S411, querying the probability value of each state position pair in the distribution probability matrix according to the position corresponding to each state type in the test matrix. Step S412, if there is a probability value lower than the preset probability threshold in the probability value corresponding to each state position pair, determining the state detection result as abnormal.

[0053] Because the distribution probability matrix includes the probability value corresponding to each state type at each position, and the test matrix includes each position corresponding to a state type, after determining the multiple state position pairs corresponding to the test matrix, the probability value corresponding to the state position pair can be queried in the distribution probability matrix. Among them, the state position pair refers to the combination of each state and position, such as "state 0 position 0", "state 0 position 1", "state 1 position 2", etc. In a 3x3 distribution probability matrix, there are 9 different state position pairs.

[0054] Exemplarily, when the distribution probability matrix is represented in the form of a table, it can be represented as the following table:

[0055] Therefore, the positions corresponding to each state type in the test matrix and the corresponding probabilities are as follows: state 2 at position 0, P[2][0]=0.125; state 1 at position 1, P[1][1]=0.125; state 0 at position 2, P[0][2]=0.625.

[0056] In the embodiments of the present application, the state detection result can be determined to be abnormal or normal by comparing each probability value with a preset probability threshold. For example, if there is a probability value lower than the threshold L (e.g., 0.15) in the probability value corresponding to each state position, it indicates that a rare "position-state" pair appears in the test sequence, and the state detection result can be determined to be abnormal. On the other hand, if there is no probability value lower than the threshold L in the probability value corresponding to each state position, i.e., all probability values are greater than or equal to L, the state detection result can be determined to be normal.

[0057] In the embodiments of the present application, the specific position of the abnormality can be accurately analyzed by obtaining the probability corresponding to each state position. This is more refined and deep than the traditional N-gram method, realizes the first position sensing capability in the field of sequence anomaly detection, and can answer which state exists in which position.

[0058] Taking the above test matrix as an example, when the [2, 1, 0] anomaly is detected, the embodiments of the present application can also provide detailed position-level anomaly analysis: The system startup phase (position 0) appears in the middle state, and the abnormal probability is 87.5% (obtained by 1-0.125); The system intermediate phase (position 1) appears in the failure state, and the abnormal probability is 87.5% (obtained by 1-0.125); The system end phase (position 2) appears in the success state, and the normal probability is 62.5%.

[0059] The above fine-grained anomaly explanation provides direct and operable information for industrial system fault diagnosis, and the N-gram method cannot provide the above position-level analysis.

[0060] In another possible embodiment, the step of determining the state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix can include: Step S421, querying the probability value of each state position pair in the distribution probability matrix according to the position corresponding to each state type in the test matrix; Step S422, determining a plurality of probability levels corresponding to the test matrix based on the probability value corresponding to each state position pair and a preset probability grading rule, wherein the probability level is one of a low level, a medium level and a high level; The embodiments of the present application provide a strategy for grading the distribution probability, converting the quantitative index into a graded index, and facilitating the determination of the corresponding anomaly detection rule.

[0061] The method of querying the probability value in step S421 can refer to the process of determining the probability value in step S411, and will not be described here. Further, the probability level is defined as three levels in the embodiment of the application: low level (for example, P<0.2), medium level (for example, 0.2≤P≤0.5), and high level (for example, P>0.5).

[0062] Referring to the mapping relationship between the probability value and the probability level, a plurality of probability levels corresponding to the test matrix (the number is equal to the preset window length) can be determined.

[0063] Taking the test sequence of the test matrix as [2, 1, 0] for example, the mapping between the probability value and the probability level is as follows: The probability value corresponding to the test sequence [2, 1, 0] is: State 2 at position 0: P[2][0]=0.125, corresponding to the low level; State 1 at position 1: P[1][1]=0.125, corresponding to the low level; State 0 at position 2: P[0][2]=0.625, corresponding to the medium level.

[0064] In step S423, if all the probability levels are low or medium, or only include low and medium, it is determined that the state detection result is abnormal. Alternatively, in step S424, if the number of state position pairs with low probability level is greater than or equal to the preset number threshold, it is determined that the state detection result is abnormal.

[0065] After determining the plurality of probability levels corresponding to the test matrix, the application provides two optional methods for determining whether the state detection result is abnormal.

[0066] In the case where all the probability levels corresponding to the test matrix are low or medium, or only include low and medium (including all low levels, all medium levels, and both low levels and medium levels), the state detection result can be directly determined to be abnormal. Taking the above test sequence as an example, the corresponding probability levels are low level, low level, and medium level, all of which are less than or equal to the medium level, so it is determined that the state detection result is abnormal.

[0067] Alternatively, in the case where the number of state position pairs with low probability level is greater than or equal to the preset number threshold (for example, 2), the state detection result can be directly determined to be abnormal. Taking the above test sequence as an example, the corresponding probability levels include two low levels, so it is determined that the state detection result is abnormal.

[0068] In another feasible embodiment, as Figure 3As shown, the step of determining the state detection result corresponding to the test matrix according to the position distribution and the distribution probability matrix corresponding to each state type in the test matrix can include: Step S431, calculate the cosine similarity between the test matrix and the distribution probability matrix; Step S432, according to the position corresponding to each state type in the test matrix, query the probability value of each state position pair in the distribution probability matrix; Step S433, based on the probability value corresponding to each state position pair, determine the minimum probability value in each probability value and the average probability value of each probability value; Step S434, calculate the ratio between the number of state position pairs with probability values lower than the first probability threshold and the total number of state position pairs in the test sequence, and obtain the low probability ratio; Step S435, weighted sum of the cosine similarity, the minimum probability value, the average probability value and the low probability ratio, to obtain the comprehensive score; Step S436, if the comprehensive score is less than the preset score threshold, determine that the state detection result is abnormal.

[0069] It should be noted that steps S431, S433 and S434 calculate the test matrix in different dimensions, which can be performed synchronously, wherein the common pre-step of steps S433 and S434 is S432, only after obtaining the probability value of each state type at each position, steps S433 and S434 can be executed. After obtaining the cosine similarity, the minimum probability value, the average probability value and the low probability ratio, multi-dimensional fusion (i.e. weighted sum) is performed to obtain the comprehensive score. Finally, compare the size of the comprehensive score and the preset score threshold (such as 0.4), if the comprehensive score is less than the preset score threshold, determine that the state detection result is abnormal.

[0070] Specifically, the process of step S431 to calculate the cosine similarity is consistent with the aforementioned step S401, and the process of step S432 to query the probability value of each state type corresponding to the position is consistent with the aforementioned step S411, which will not be repeated here.

[0071] In step S433, the minimum probability value can be represented as min_prob = min(P[statei][positionj] for each state-position pair in the test sequence), which is equivalent to the minimum probability value among all probability values corresponding to all state-position pairs in the test sequence. Taking the test sequence [2, 1, 0] as an example, P[2][0] = 0.125, P[1][1] = 0.125, and P[0][2] = 0.625, the minimum probability value is 0.125. The average probability value of the probability values is the average value calculated from the probability values corresponding to all state-position pairs in the test sequence, which can be represented as avg_prob = mean(P[statei][positionj] for each state-position pair in the test sequence). For example, when the probability values are 0.125, 0.125, and 0.625, respectively, the average probability value is (0.125 + 0.125 + 0.625) / 3 = 0.292.

[0072] In step S434, the low probability ratio can be represented as min_prob = min(P[statei][positionj] for each state-position pair in the test sequence). The low probability ratio reflects the proportion of the number of state-position pairs with high abnormality in the total number of state-position pairs. The higher the low probability ratio, the higher the abnormality.

[0073] In the weighted summation of the cosine similarity, the minimum probability value, the average probability value, and the low probability ratio, each dimension indicator can be assigned a weight (for example, 0.25). Then, the comprehensive score reflecting the above dimension indicators is calculated. The comprehensive score is compared with the preset score threshold. If the comprehensive score is less than the preset score threshold, the state detection result is determined to be abnormal. If the comprehensive score is greater than or equal to the preset score threshold, the state detection result is determined to be normal.

[0074] In another possible embodiment, the step of determining the state detection result corresponding to the test matrix according to the position distribution corresponding to each state type in the test matrix and the distribution probability matrix can include: In step S441, the cosine similarity between the test matrix and the distribution probability matrix is calculated, and the size relationship between the cosine similarity and the preset similarity threshold is compared to determine the first evaluation result. The first evaluation result is normal or abnormal. In step S442, the probability value of each state-position pair is queried in the distribution probability matrix according to the position corresponding to each state type in the test matrix. In step S443, the size relationship between the minimum probability value in the probability values and the second probability threshold is compared to determine the second evaluation result. The second evaluation result is normal or abnormal. Step S444, determining an average probability value of the probability values, comparing the size relationship between the average probability value and a third probability threshold value, determining a third evaluation result, the third evaluation result being normal or abnormal; Step S445, calculating a ratio between the number of state position pairs lower than the first probability threshold value in the probability values and the total number of state position pairs of the test sequence, obtaining a low probability proportion; Step S446, comparing the size relationship between the low probability proportion and a preset proportion threshold value, determining a fourth evaluation result; Step S447, if the number of evaluation results being abnormal in the first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result is greater than or equal to an abnormal number threshold value, determining that the state detection result is abnormal.

[0075] Compared with the foregoing steps S431 to S436, the dimensions to be calculated (including the cosine similarity, the minimum probability value, the average probability value and the low probability proportion) are the same, that is, the process of calculating the cosine degree in step S441 is consistent with the foregoing step S401, the process of querying the probability value of each state position pair in step S442 is consistent with the foregoing step S411, the process of calculating the average probability value in step S444 is consistent with the foregoing step S433, and the process of calculating the low probability proportion in step S445 is consistent with the foregoing step S434.

[0076] The difference between the foregoing steps S431 to S436 is that the embodiment of the application separately evaluates the indicators of each dimension to obtain the qualitative evaluation results of each dimension, and then comprehensively judges whether the state detection result is abnormal according to the qualitative evaluation results of the dimensions.

[0077] For example, the size relationship between the cosine similarity similarity and a preset similarity threshold value (threshold1=0.4) is compared, if similarity<threshold1, it is determined that the first evaluation result is abnormal; if similarity ≥threshold1, it is determined that the first evaluation result is normal.

[0078] The size relationship between the minimum probability value min_prob and a second probability threshold value (threshold2=0.15) is compared, if min_prob<threshold2, it is determined that the second evaluation result is abnormal; if min_prob≥threshold2, it is determined that the second evaluation result is normal.

[0079] If the average probability value avg prob is compared with a third probability threshold (threshold = 0.3), and avg prob < threshold 3, the third evaluation result is determined as abnormal; if avg prob ≥ threshold 3, the third evaluation result is determined as normal.

[0080] If the low probability ratio low prob ratio is compared with a preset ratio threshold (threshold 4 = 0.5), and low prob ratio > threshold 4, the fourth evaluation result is determined as abnormal.

[0081] In addition, the abnormal number threshold can be determined according to the strictness requirement of the abnormal state detection, for example, in the strict mode, as long as there is one abnormal evaluation result in the first evaluation result to the fourth evaluation result, the state detection result is determined as abnormal, and in the relaxed mode, the abnormal number threshold can be set to 2 or more, which is not limited here.

[0082] It should be noted that the steps S401 to S403, steps S411 to S412, steps S421 to S424, and steps S431 to S436 respectively provide one or more conditions for determining that the state detection result is abnormal, and in actual implementation, the above-mentioned conditions for determining that the state detection result is abnormal can be applied individually or in any combination form (for example, steps S401 to S403 and steps S411 to S412 are applied simultaneously to express the conditions for determining that the state detection result is abnormal), and when combined, as long as one of the conditions for determining that the state detection result is abnormal is met, the final state detection result is determined as abnormal. When multiple conditions for determining that the state detection result is abnormal are applied, only when all the conditions for determining that the state detection result is abnormal are not met, the final state detection result is determined as normal.

[0083] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the abnormal state detection method of the present application. Based on this technical concept, more forms of simple transformation are within the protection scope of the present application.

[0084] The present application also provides an abnormal state detection device, please refer to Figure 4 The abnormal state detection device comprises: A matrix initialization module 10 is configured to initialize a default matrix according to the number of state types corresponding to the detected system and a preset window length, wherein the number of rows of the default matrix is equal to the number of state types, and the number of columns of the default matrix is equal to the preset window length. The matrix updating module 20 is configured to slide the historical state sequence corresponding to the detected system based on the preset window length, and update the default matrix according to the frequency of each position corresponding to each state type, to obtain a target matrix. The probability determining module 30 is configured to normalize the frequency of each position corresponding to each state type in the target matrix, to obtain a distribution probability matrix. The result output module 40 is configured to determine a test matrix corresponding to a test sequence of the detected system, and determine a state detection result corresponding to the test matrix according to the distribution of each position corresponding to each state type in the test matrix and the distribution probability matrix.

[0085] In an embodiment, the matrix updating module 20 is further configured to: select a preset number of positions from the historical state sequence, with the first state of the historical state sequence as a starting position, wherein the preset number is equal to the value of the preset window length. obtain the state type corresponding to each position, and record the state type corresponding to each position in the default matrix to obtain an accumulated matrix. move the starting position by one position, select a preset number of positions from the historical state sequence, obtain the state type corresponding to each position, and update the state type corresponding to each position in the accumulated matrix to obtain an updated accumulated matrix, wherein the accumulated matrix includes the frequency of each state position pair, and the state position pair refers to the combination of one state type and one position. return to execute the step of moving the starting position by one position, and after traversing the historical state sequence, determine the current accumulated matrix as the target matrix.

[0086] In an embodiment, the matrix updating module 20 is further configured to: for each state type, determine the matrix row corresponding to the state type in the default matrix, wherein each state type uniquely corresponds to a matrix row in the default matrix. record the frequency of each position corresponding to the state type in the matrix row corresponding to the state type in the default matrix.

[0087] In an embodiment, the result output module 40 is further configured to: calculate the cosine similarity between the test matrix and the distribution probability matrix. if the cosine similarity is less than a preset similarity threshold, determine that the state detection result is abnormal. If the cosine similarity is greater than or equal to a preset similarity threshold, it is determined that the state detection result is normal.

[0088] In an embodiment, the result output module 40 is further configured to: According to positions corresponding to various state types in the test matrix, query probability values of each state position pair in the distribution probability matrix; If there is a probability value lower than a preset probability threshold among probability values corresponding to each state position pair, it is determined that the state detection result is abnormal.

[0089] In an embodiment, the result output module 40 is further configured to: According to positions corresponding to various state types in the test matrix, query probability values of each state position pair in the distribution probability matrix; Based on probability values corresponding to each state position pair and a preset probability grading rule, determine a plurality of probability levels corresponding to the test matrix, wherein the probability level is one of a low level, a medium level and a high level; If all probability levels are low levels or medium levels, or only include low levels and medium levels, it is determined that the state detection result is abnormal; Or, if the number of state position pairs with low levels is greater than or equal to a preset number threshold, it is determined that the state detection result is abnormal.

[0090] In an embodiment, the result output module 40 is further configured to: Calculate a cosine similarity between the test matrix and the distribution probability matrix; According to positions corresponding to various state types in the test matrix, query probability values of each state position pair in the distribution probability matrix; Based on probability values corresponding to various state position pairs, determine a lowest probability value among the probability values and an average probability value of the probability values; Calculate a ratio between the number of state position pairs with probability values lower than a first probability threshold and the total number of state position pairs of the test sequence, to obtain a low probability proportion; Weighted sum the cosine similarity, the lowest probability value, the average probability value and the low probability proportion to obtain a comprehensive score; If the comprehensive score is less than a preset score threshold, it is determined that the state detection result is abnormal.

[0091] In an embodiment, the result output module 40 is further configured to: calculate a cosine similarity between the test matrix and the distribution probability matrix, compare a size relationship between the cosine similarity and a preset similarity threshold, determine a first evaluation result, and the first evaluation result is normal or abnormal; According to the positions corresponding to various state types in the test matrix, query the probability values of each state position pair in the distribution probability matrix; Compare a size relationship between the lowest probability value in the probability values and a second probability threshold, determine a second evaluation result, and the second evaluation result is normal or abnormal; Determine an average probability value of the probability values, compare a size relationship between the average probability value and a third probability threshold, determine a third evaluation result, and the third evaluation result is normal or abnormal; Calculate a ratio between the number of state position pairs lower than the first probability threshold in the probability values and the total number of state position pairs of the test sequence, and obtain a low probability proportion; Compare a size relationship between the low probability proportion and a preset proportion threshold, and determine a fourth evaluation result; If the number of evaluation results being abnormal in the first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result is greater than or equal to an abnormal number threshold, determine that the state detection result is abnormal.

[0092] The abnormal state detection device provided in the present application adopts the abnormal state detection method in the above embodiments, and can reduce the storage complexity of the system state sequence and improve the efficiency of abnormal state detection. Compared with the prior art, the beneficial effects of the abnormal state detection device provided in the present application are the same as those of the abnormal state detection method provided in the above embodiments, and other technical features in the abnormal state detection device are the same as those disclosed in the above embodiments, which will not be repeated here.

[0093] The present application provides an abnormal state detection device, which comprises at least one processor and a memory in communication connection with the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the abnormal state detection method in the above embodiment one.

[0094] The following refers to Figure 5The diagram illustrates a structural schematic suitable for implementing an anomaly detection device in the embodiments of this application. The anomaly detection device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, tablets, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital televisions and desktop computers. Figure 5 The abnormal state detection device shown is merely an example and should not impose any limitations on the functionality and scope of application of the embodiments of this application.

[0095] like Figure 5 As shown, the abnormal state detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the abnormal state detection device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the anomaly detection device to communicate wirelessly or wiredly with other devices to exchange data. Although the figure shows anomaly detection devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0096] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer readable medium, the computer program containing program code for executing the method shown in the flowchart. In such embodiments, the computer program can be downloaded and installed from a network through a communication device, or installed from the storage device 1003, or installed from the ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiments disclosed in the present application are executed.

[0097] The abnormal state detection device provided in the present application adopts the abnormal state detection method in the above-mentioned embodiments, which can reduce the storage complexity of the system state sequence and improve the efficiency of abnormal state detection. Compared with the prior art, the beneficial effects of the abnormal state detection device provided in the present application are the same as those of the abnormal state detection method provided in the above-mentioned embodiments, and other technical features in the abnormal state detection device are the same as those disclosed in the above-mentioned embodiments, which will not be repeated here.

[0098] It should be understood that parts of the present application can be realized by hardware, software, firmware or a combination thereof. In the description of the above-mentioned embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0099] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical range disclosed in the present application, which should be covered in the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

[0100] The above is merely part of the embodiments of the present application, and does not limit the protection scope of the present application, and any equivalent structural transformation made by using the contents of the present application specification and drawings, or direct / indirect application in other related technical fields are included in the protection scope of the present application. All actions of obtaining signals, information or data in the present application are performed under the premise of complying with the corresponding data protection regulations and policies of the country where the data is located, and with the authorization given by the corresponding device owner.

Claims

1. An abnormal state detection method characterized by comprising: The abnormal state detection method comprises: According to the number of state types corresponding to the detected system and the preset window length, a default matrix is initialized, wherein the number of rows of the default matrix is equal to the number of state types, and the number of columns of the default matrix is equal to the preset window length; The historical state sequence corresponding to the detected system is slid based on the preset window length, and the default matrix is updated according to the frequency of the positions corresponding to various state types, to obtain a target matrix; The frequencies of various state types in various positions in the target matrix are normalized to obtain a corresponding distribution probability matrix; A test matrix corresponding to a test sequence of the detected system is determined, and a state detection result corresponding to the test matrix is determined according to the position distribution of various state types in the test matrix and the distribution probability matrix.

2. The abnormal state detection method according to claim 1, wherein The step of sliding the historical state sequence corresponding to the detected system based on the preset window length and updating the default matrix according to the frequency of the positions corresponding to various state types to obtain a target matrix comprises: A first state of the historical state sequence is taken as a starting position, and a preset number of positions are selected from the historical state sequence, wherein the value of the preset number is equal to the value of the preset window length; The state types corresponding to each position are obtained, and the state types corresponding to each position are recorded in the default matrix to obtain an accumulated matrix; The starting position is moved by one position, a preset number of positions are selected from the historical state sequence, the state types corresponding to each position are obtained, and the state types corresponding to each position are updated in the accumulated matrix to obtain an updated accumulated matrix, wherein the accumulated matrix comprises the frequencies of state position pairs, and the state position pair refers to a combination of a state type and a position; After the starting position is moved by one position, the step of moving the starting position by one position is returned, and after the historical state sequence is traversed, the current accumulated matrix is determined as a target matrix.

3. The abnormal state detection method according to claim 2, wherein The step of recording the frequencies of various state types in various positions in the default matrix to obtain an accumulated matrix comprises: For each state type, a matrix row corresponding to the state type in the default matrix is determined, wherein each state type uniquely corresponds to a matrix row in the default matrix; In the matrix row corresponding to the state type in the default matrix, the frequencies of various positions corresponding to the state type are recorded in the positions corresponding to the matrix row.

4. The abnormal state detection method according to Claim 1, wherein The step of determining a state detection result corresponding to the test matrix according to the position distribution of various state types in the test matrix and the distribution probability matrix comprises: The cosine similarity between the test matrix and the distribution probability matrix is calculated; If the cosine similarity is less than a preset similarity threshold, the state detection result is determined to be abnormal; If the cosine similarity is greater than or equal to the preset similarity threshold, the state detection result is determined to be normal.

5. The abnormal state detection method according to Claim 1, wherein The step of determining the state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix comprises: According to the position corresponding to each state type in the test matrix, the probability value of each state position pair in the distribution probability matrix is queried; If there is a probability value lower than the preset probability threshold value in the probability value corresponding to each state position pair, it is determined that the state detection result is abnormal.

6. The abnormal state detection method according to Claim 1, wherein The step of determining the state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix comprises: According to the position corresponding to each state type in the test matrix, the probability value of each state position pair in the distribution probability matrix is queried; Based on the probability value corresponding to each state position pair and the preset probability classification rule, a plurality of probability levels corresponding to the test matrix are determined, wherein the probability level is one of a low level, a medium level and a high level; If all probability levels are low levels or medium levels, or only include low levels and medium levels, it is determined that the state detection result is abnormal; Or, if the number of state position pairs with a low level is greater than or equal to a preset number threshold, it is determined that the state detection result is abnormal.

7. The abnormal state detection method according to Claim 1, wherein The step of determining the state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix comprises: The cosine similarity between the test matrix and the distribution probability matrix is calculated; According to the position corresponding to each state type in the test matrix, the probability value of each state position pair in the distribution probability matrix is queried; Based on the probability value corresponding to each state position pair, the lowest probability value in each probability value and the average probability value of each probability value are determined; The ratio between the number of state position pairs with a probability value lower than a first probability threshold value and the total number of state position pairs in the test sequence is calculated to obtain a low probability proportion; The cosine similarity, the lowest probability value, the average probability value and the low probability proportion are weighted and summed to obtain a comprehensive score; If the comprehensive score is less than a preset score threshold, it is determined that the state detection result is abnormal.

8. The abnormal state detection method according to Claim 1, wherein The step of determining the state detection result corresponding to the test matrix according to the position distribution of each state type in the test matrix and the distribution probability matrix comprises: The cosine similarity between the test matrix and the distribution probability matrix is calculated, and the size relationship between the cosine similarity and a preset similarity threshold is compared to determine a first evaluation result, which is normal or abnormal; According to the position corresponding to each state type in the test matrix, the probability value of each state position pair in the distribution probability matrix is queried; The size relationship between the lowest probability value in each probability value and a second probability threshold value is compared to determine a second evaluation result, which is normal or abnormal; determining an average probability value of each of the probability values, comparing a size relationship between the average probability value and a third probability threshold value, determining a third evaluation result, the third evaluation result being normal or abnormal; calculating a ratio between a number of state position pairs lower than the first probability threshold value in each of the probability values and a total number of state position pairs of the test sequence, to obtain a low probability proportion; comparing a size relationship between the low probability proportion and a preset proportion threshold value, to determine a fourth evaluation result; if a number of evaluation results being abnormal in the first evaluation result, the second evaluation result, the third evaluation result and the fourth evaluation result is greater than or equal to an abnormal number threshold value, determining that the state detection result is abnormal.

9. An abnormal state detecting apparatus characterized by comprising: The abnormal state detection device comprises: a matrix initialization module configured to initialize a default matrix according to a number of state types corresponding to a system to be detected and a preset window length, wherein a number of rows of the default matrix is equal to the number of state types, and a number of columns of the default matrix is equal to the preset window length; a matrix updating module configured to slide a historical state sequence corresponding to the system to be detected based on the preset window length, and update the default matrix according to frequencies of positions corresponding to various state types, to obtain a target matrix; a probability determining module configured to normalize the frequencies of the positions corresponding to various state types in the target matrix, to obtain a corresponding distribution probability matrix; a result output module configured to determine a test matrix corresponding to a test sequence of the system to be detected, and determine a state detection result corresponding to the test matrix according to a position distribution corresponding to various state types in the test matrix and the distribution probability matrix.

10. An abnormal state detection device characterized by comprising: The abnormal state detection device comprises a memory, a processor and a computer program stored on the memory and executable on the processor, and the computer program is configured to implement steps of the abnormal state detection method in any one of claims 1 to 8.

Images