Self-adaptive anomaly detection method, device, equipment, medium and program product

Abstract

The invention discloses a self-adaptive anomaly detection method, device and equipment, a medium and a program product, and belongs to the field of data processing. The method comprises the steps that a sub-scene label matched with abnormal query information is searched for in an offline parameter library, a time sequence parameter corresponding to the sub-scene label is determined as a target time sequence parameter, and the offline parameter library comprises the sub-scene label and a time sequence which have a corresponding relation; the parameter sub-scene label and the time sequence parameter are obtained based on user service behavior information in a historical time period; searching historical event information matched with the abnormal query information through a historical event library; based on the target time sequence parameters and the matched historical event information, determining a threshold range of a target business index by using the reasoning ability of a large language model; and obtaining a detection result according to the target business index and the threshold range, the detection result being used for representing whether the target business index is abnormal. According to the embodiment of the invention, the accuracy of anomaly detection can be improved.

Description

Technical Field

[0001] This application belongs to the field of data processing, and in particular relates to an adaptive anomaly detection method, apparatus, equipment, medium and program product. Background Technology

[0002] Due to the widespread use of business applications, these applications target diverse user groups, and the influencing factors on business metrics differ across these groups and business scenarios. Changes in business metrics are often driven by a complex interplay of factors, making the underlying causes difficult to pinpoint. Even normal business fluctuations can lead to changes in business metrics. Using static rules and static thresholds for anomaly detection struggles to distinguish between changes in business metrics caused by normal business fluctuations and genuinely abnormal changes, resulting in low accuracy in anomaly detection. Summary of the Invention

[0003] This application provides an adaptive anomaly detection method, apparatus, device, medium, and program product that can improve the accuracy of anomaly detection.

[0004] In a first aspect, embodiments of this application provide an adaptive anomaly detection method, comprising: searching for sub-scene tags matching received anomaly query information in an offline parameter library; determining the time series parameters corresponding to the matching sub-scene tags as target time series parameters; the offline parameter library includes sub-scene tags and time series parameters with corresponding relationships, the sub-scene tags and time series parameters with corresponding relationships are obtained based on user business behavior information in a first historical time period, and the anomaly query information includes target business indicators; searching for historical event information matching the anomaly query information through a historical event library, the historical event information including influencing factors; determining the threshold range of the target business indicators based on the target time series parameters and the matching historical event information, using the reasoning ability of a large language model; and obtaining a detection result based on the target business indicators and the threshold range, the detection result being used to characterize whether the target business indicators are abnormal.

[0005] Secondly, embodiments of this application provide an adaptive anomaly detection device, comprising: a matching module, configured to search for sub-scene tags matching received anomaly query information in an offline parameter library, and determine the time series parameters corresponding to the matched sub-scene tags as target time series parameters; the offline parameter library includes sub-scene tags and time series parameters with corresponding relationships, the sub-scene tags and time series parameters with corresponding relationships are obtained based on user business behavior information in a first historical time period, and the anomaly query information includes target business indicators; a retrieval module, configured to search for historical event information matching the anomaly query information through a historical event library, the historical event information including influencing factors; a threshold range generation module, configured to determine the threshold range of the target business indicator based on the target time series parameters and the matched historical event information, using the reasoning ability of a large language model; and a detection module, configured to obtain a detection result based on the target business indicator and the threshold range, the detection result being used to characterize whether the target business indicator is abnormal.

[0006] Thirdly, embodiments of this application provide an adaptive anomaly detection device, including: a processor and a memory storing computer program instructions; the processor implements the adaptive anomaly detection method of the first aspect when executing the computer program instructions.

[0007] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer program instructions, which, when executed by a processor, implement the adaptive anomaly detection method of the first aspect.

[0008] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the adaptive anomaly detection method of the first aspect.

[0009] This application provides an adaptive anomaly detection method, apparatus, device, medium, and program product. It can search for sub-scene tags matching anomaly query information in an offline parameter library, obtain the target event sequence corresponding to the sub-scene tag, and search for historical event information matching the anomaly query information in a historical event library. The target time series parameters can provide the temporal trend of indicator data under the sub-scene corresponding to the anomaly query information. The historical event information matching the anomaly query information can provide the influence factors of historical event information similar to the anomaly query information. Through the reasoning capability of a large language model, the target time series parameters and the historical event information matching the anomaly query information can be combined to obtain a threshold range corresponding to the target business indicator in the anomaly query information. Using this threshold range, a detection result characterizing whether the target business indicator is abnormal is obtained. The obtained threshold range is dynamically generated based on the target time series parameters and the historical event information matching the anomaly query information, possessing accurate perception and adaptability to business events and time fluctuations corresponding to the anomaly query information. This allows for the differentiation between business indicator changes caused by normal business fluctuations and truly abnormal business indicator changes, improving the accuracy of anomaly detection. Attached Figure Description

[0010] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart of an adaptive anomaly detection method provided in an embodiment of this application; Figure 2 A schematic diagram illustrating an example of the adaptive anomaly detection process provided in an embodiment of this application; Figure 3 This is a schematic diagram of the structure of an adaptive anomaly detection device provided in an embodiment of this application; Figure 4 This is a schematic diagram of the structure of an adaptive anomaly detection device provided in an embodiment of this application. Detailed Implementation

[0012] The features and exemplary embodiments of various aspects of this application will be described in detail below. To make the purpose, technical solution, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are only intended to explain this application and not to limit it. For those skilled in the art, this application can be implemented without some of the details in these specific details. The following description of the embodiments is merely to provide a better understanding of this application by illustrating examples of this application. It should be noted that the acquisition, storage, use, and processing of information and data in the embodiments of this application are all authorized by users or relevant organizations and comply with the relevant provisions of national laws and regulations. In the embodiments of this application, certain software, components, models, and other existing solutions in the industry may be mentioned. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solution of this application, but it does not mean that the applicant has or necessarily used such a solution.

[0013] Due to the widespread use of business applications, these applications target diverse user groups, and the influencing factors on business metrics differ across these groups and business scenarios. Changes in business metrics are often driven by a complex interplay of factors, making the underlying causes difficult to pinpoint. Even normal business fluctuations can lead to changes in business metrics. Using static rules and static thresholds for anomaly detection struggles to distinguish between changes in business metrics caused by normal business fluctuations and genuinely abnormal changes, resulting in low accuracy in anomaly detection.

[0014] This application provides an adaptive anomaly detection method, apparatus, device, medium, and program product. It can pre-determine the correspondence between sub-scenes and time series parameters using user business behavior information in historical event segments. Based on the time series parameters corresponding to the sub-scene tags that match the anomaly query information and the historical event information that matches the anomaly query information, it utilizes the reasoning ability of a large language model to obtain a threshold range that accurately perceives and adaptively accommodates business events and time fluctuations. By using this threshold range, it can determine whether the target business indicator sought by the anomaly query information is abnormal, thereby improving the accuracy of anomaly detection.

[0015] The adaptive anomaly detection method, apparatus, equipment, medium, and program products provided in this application will be described below.

[0016] This application provides an adaptive anomaly detection method, which can be applied to scenarios involving anomaly detection of business metrics. This adaptive anomaly detection method can be executed by an adaptive anomaly detection device, equipment, etc., and is not limited thereto. Figure 1 A flowchart of an adaptive anomaly detection method provided in an embodiment of this application is shown below. Figure 1Therefore, the adaptive anomaly detection method may include steps S101 to S104.

[0017] In step S101, the sub-scene label that matches the received abnormal query information is searched in the offline parameter library, and the time series parameter corresponding to the matching sub-scene label is determined as the target time series parameter.

[0018] The offline parameter library includes corresponding sub-scene tags and time-series parameters. These tags and parameters are derived from user business behavior information within a first historical time period. This first historical time period can be updated over time; for example, it may include the period up to the day before the current time. User business behavior information includes information representing the behavior of multiple users in handling business transactions. This information may include, but is not limited to, one or more of the following: business scenario, transaction location, transaction amount, transaction timestamp, transaction event text, and business scenario description. Sub-scene tags are automatically generated through unsupervised partitioning based on user business behavior information within historical time periods. Time-series parameters are obtained through time-series structure analysis based on business metrics under the sub-scene tags. These parameters characterize the trend of metrics over a long period and their periodic variation characteristics.

[0019] Anomaly query information includes target business metrics, used to check whether the target business metrics are abnormal. Anomaly query information may also include time information or other information, which is not limited here. Anomaly query information can be information entered by the querying party, specifically including but not limited to one or more of text information, voice information, and image information. If the anomaly query information includes voice information, image information, etc., the voice information and image information can be converted into text information for subsequent processing.

[0020] Key information can be extracted from abnormal query information. The sub-scene tags in the offline parameter library that match this key information are the sub-scene tags that match the abnormal query information. The time series parameters in the offline parameter library that correspond to the matching sub-scene tags are determined as the target time series parameters.

[0021] In step S102, the historical event database is used to search for historical event information that matches the abnormal query information.

[0022] The historical event database stores information on multiple historical events. This information can be used to identify accurate historical events within a given time period through adaptive anomaly detection methods. Historical event information includes impact factors. These impact factors influence the threshold range used for anomaly detection and can be adjusted and corrected during the threshold range determination process. For example, impact factors may include periodic impact factors and event adjustment factors. The periodic impact factor is used to adjust and correct the impact of periodicity, while the event adjustment factor is used to characterize the impact of sudden events (e.g., trading activities). Historical event information also includes event information, which may include key information extracted from historical anomaly queries and / or vectors derived from that key information, etc., and is not limited thereto. Each historical event record may include corresponding event information and impact factors.

[0023] Historical event information that matches abnormal query information refers to historical event information in the historical event database that meets the matching criteria for similarity with the abnormal query information. The similarity between the abnormal query information and each historical event in the historical event database can be calculated, and historical event information whose similarity meets the matching criteria is considered as the historical event information that matches the abnormal query information. The number of historical event information that matches the abnormal query information is not limited here; it can be one historical event or two or more historical event information. For example, the top three historical event information with the highest similarity to the abnormal query information in the historical event database can be selected as the historical event information that matches the abnormal query information. As another example, historical event information in the historical event database whose similarity to the abnormal query information exceeds a similarity threshold can be selected as the historical event information that matches the abnormal query information.

[0024] In step S103, based on the target time series parameters and the matched historical event information, the threshold range of the target business indicator is determined by utilizing the reasoning ability of the large language model.

[0025] The target time series parameters provide the temporal trend of indicator data in the sub-scenario corresponding to the abnormal query information. Historical event information matching the abnormal query information provides the influence factors of similar historical events. The large language model can combine the temporal trend of indicator data in the sub-scenario corresponding to the abnormal query information and the influence factors of similar historical events to infer the required influence factors for the abnormal query information. Therefore, based on the target time series parameters and the influence factors inferred by the large language model, the threshold range for the target business can be determined.

[0026] In step S104, the detection results are obtained based on the target business indicators and threshold range.

[0027] The detection results are used to characterize whether the target business indicator is abnormal. The threshold range can be either a normal threshold range or an abnormal threshold range, and can be set according to the scenario, requirements, and operational habits, etc., and is not limited here. If the threshold range is a normal threshold range, the detection result indicates that the target business indicator is normal if it is within the normal threshold range, and abnormal if it is outside the normal threshold range. If the threshold range is an abnormal threshold range, the detection result indicates that the target business indicator is abnormal if it is within the abnormal threshold range, and normal if it is outside the abnormal threshold range.

[0028] In this embodiment, sub-scene tags matching abnormal query information can be searched in an offline parameter library to obtain the target event sequence corresponding to the sub-scene tag, and historical event information matching the abnormal query information can be searched in a historical event library. The target time series parameters can provide the temporal trend of indicator data under the sub-scene corresponding to the abnormal query information. The historical event information matching the abnormal query information can provide the influence factors of historical event information similar to the abnormal query information. Through the reasoning capability of the large language model, the target time series parameters and the historical event information matching the abnormal query information can be combined to obtain the threshold range corresponding to the target business indicator in the abnormal query information. Using this threshold range, a detection result characterizing whether the target business indicator is abnormal can be obtained. The obtained threshold range is dynamically generated based on the target time series parameters and the historical event information matching the abnormal query information, possessing accurate perception and adaptability to business events and time fluctuations corresponding to the abnormal query information. This allows for the differentiation between business indicator changes caused by normal business fluctuations and genuine abnormal business indicator changes, improving the accuracy of anomaly detection.

[0029] In some embodiments, clustering algorithms can be used to automatically discover sub-scenarios in advance based on user business behavior information, and establish a correspondence between sub-scenarios and time series parameters under sub-scenarios to generate an offline parameter library. Specifically, user business behavior information in a first historical time period can be vectorized to obtain business behavior vectors; clustering can be performed based on business behavior vectors to obtain at least one cluster; sub-scenarios labels for each cluster can be obtained according to user business behavior information corresponding to business behavior vectors in each cluster; for each cluster, time-series structure analysis can be performed on the business indicators corresponding to the cluster in a second historical time period to obtain the time series parameters of the cluster; a correspondence between the sub-scenarios labels of the cluster and the time series parameters of the cluster can be established and stored in the offline parameter library.

[0030] Business behavior vectors can represent user business behavior information. User behavior information can be converted into business behavior vectors through encoded vector processing and semantic vector processing. In some examples, structured and unstructured information can be extracted from user business behavior information; the structured information is encoded and normalized to obtain encoded vectors; the unstructured information is converted into semantic vectors using the encoder of a large language model; and the encoded vectors and semantic vectors are concatenated to obtain the business behavior vectors.

[0031] User business behavior information can include both structured and unstructured information. Structured information may include user identifiers, business scenarios, business processing regions, business amounts, and business timestamps (implemented as fields). Unstructured information may include, but is not limited to, business event text and business scenario descriptions. Structured information can be labeled using LabelEncode or other encoding algorithms to obtain encoded information. This encoded information is then normalized to obtain an encoded vector. The encoded vector is a multi-dimensional vector, and its dimensions can be set according to the scenario, requirements, and experience; for example, it can be a 64-dimensional vector. Unstructured information is described in natural language. The encoder of a large language model can convert unstructured information into semantic vectors. The dimensions of the semantic vectors can be set according to the scenario, requirements, and experience; for example, it can be a 768-dimensional vector. The encoder of the large language model is also pre-tuned to better handle unstructured information in user business behavior information. The business behavior vector obtained by concatenating the encoded vector and the semantic vector can represent the user's behavior in a sub-scenario. For example, the business behavior vector can represent information such as user identifier, business scenario, business processing region, business amount, business timestamp, and business event. For example, a user business behavior information can be { "user_id": "U123", "scene": "consumption", "province": "Guangdong Province", "amount": 128, "timestamp": "2025-11-02 08:30", "marketing_copy": "Spend 100 and get 20 off, hurry up and grab it!"}. The values ​​of the structured information fields "scene", "province", "amount", and "timestamp" can be encoded and normalized to obtain a 64-dimensional vector. For the unstructured information text "consumption" and "spend 100 and get 20 off", a 768-dimensional semantic vector can be generated by an encoder such as MiniCPM-2B. Concatenating the 64-dimensional vector with the 768-dimensional semantic vector yields an 832-dimensional business behavior vector.

[0032] Converting user business behavior information into business behavior vectors allows for the separation of events with different business intensities. For example, the semantic understanding capabilities of the encoder in a large language model can capture the differences in event scale and user perception intensity between events like "large-scale Double Eleven events" and "daily small discounts," making the generated business behavior vectors more consistent with actual business scenarios. Business behavior vectors corresponding to events with different business intensities can naturally be separated in the vector space. Semantic vectors can differentiate different values ​​of the same dimension, thus solving the problem of difficulty in distinguishing differences in indicators and providing a highly discriminative semantic foundation for sub-scenario labeling.

[0033] Each user business behavior information can be converted into a business behavior vector. The business behavior vector can be first reduced in dimensionality, which facilitates subsequent processing and allows for manipulation of its semantic information. For example, the Uniform Manifold Approximation and Projection (UMAP) algorithm can be used to reduce an 832-dimensional business behavior vector to a 16-dimensional one. Multiple dimensionality-reduced business behavior vectors are then clustered. The Hierarchical Density-Based Spatial Clustering of Applications with Noise (HDBSCAN) algorithm can be used. The minimum number of samples per cluster in HDBSCAN can be set according to the scenario, requirements, and experience; it is not limited here. For example, the minimum number of samples per cluster in HDBSCAN is min_cluster_size = 5000. Each cluster includes multiple business behavior vectors. In some examples, for any cluster, key information is extracted from the user business behavior information corresponding to each business behavior vector in that cluster. Based on the mode of the key information, a natural language description is generated as a sub-scene label for that cluster. For example, the business processing region, business scenario, and business event can be extracted from the user business behavior information corresponding to the cluster. The business event includes at least part of the information in the business event file. In the user business behavior information corresponding to cluster A1, the mode of the business processing region is "Guangdong Province", the mode of the business scenario is "Consumption", and the mode of the business event is "100 minus 20", which corresponds to the sub-scene label "Guangdong Province - Consumption - 100 minus 20"; In the user business behavior information corresponding to cluster A2, the mode of the business processing region is "Guangdong Province", the mode of the business scenario is "Consumption", and the mode of the business event is defaulted and can be recorded as "Not participating in the activity", which corresponds to the sub-scene label "Guangdong Province - Consumption - Not participating in the activity".

[0034] Automatically discovering sub-scenarios from user business behavior information that reflects user behavior allows for the comprehensive consideration of various information within user business behavior information. This avoids the problem of isolated indicators that only consider one type of information and also avoids the problem of single and undifferentiated business scenarios in anomaly detection. This makes anomaly detection more targeted, more closely aligned with actual scenarios, and more accurate.

[0035] A list of users whose business behavior information corresponds to the clusters of sub-scene tags can be obtained. The business metrics for the second historical time period can include the business metrics of users in the list of users whose business behavior information corresponds to the clusters of sub-scene tags within the second historical time period. For example, if the business metric is the number of Daily Active Users (DAU), and the user list corresponding to the sub-scene tag "Guangdong Province - Consumption - 20 RMB off for every 100 RMB spent" in cluster A1 includes user identifiers of 320,000 users, then the business metric for the second historical time period includes the number of daily active users corresponding to these 320,000 users; if the business metric is the number of transactions, and the user list corresponding to the sub-scene tag "Guangdong Province - Consumption - 20 RMB off for every 100 RMB spent" in cluster A1 includes user identifiers of 320,000 users, then the business metric for the second historical time period includes the number of transactions corresponding to these 320,000 users. The duration of the second historical time period can be the same as or different from the duration of the first historical time period; this is not limited here. The second historical time period may include one or more preset periods, which can be time-series fluctuation periods, such as a week, a month, a quarter, a year, etc., and are not limited here. In some examples, time-series structure analysis can be directly performed on the business indicators corresponding to the clusters in the second historical time period. In other examples, a smoothing window can be used first to smooth the business indicators corresponding to the clusters in the second historical time period, and then time-series structure analysis can be performed on the smoothed business indicators.

[0036] In some examples, time series parameters include indicator trend values ​​and indicator period values. Based on the business indicators corresponding to the cluster in the second historical time period, seasonal and trend decomposition using Loess (STL) can be performed to obtain trend terms, seasonal terms, and residual terms; extrapolation is performed based on the trend terms to obtain indicator trend values; the trend terms are grouped according to the unit duration in the preset period, and the standard deviation of the trend values ​​in the group with a specified unit duration in the preset period is determined as the indicator period value. The trend terms can represent the long-term, slow trend of the business indicators corresponding to the cluster. The seasonal terms can represent the recurring fluctuation model within a fixed period, such as the daily fluctuation pattern, weekly fluctuation pattern, monthly fluctuation pattern, quarterly fluctuation pattern, annual fluctuation pattern, etc. The residual terms represent the random fluctuations or abnormal signals remaining after removing the trend terms and seasonal terms. For example, the STL processing of the business indicators corresponding to the cluster in the second historical time period can be shown in the following formula (1): (1) in, This is a sequence of business metrics corresponding to clusters in the second historical time period; This is a trend item; For seasonal items; This is the residual term.

[0037] Extrapolation calculations can be performed based on trend items to calculate indicator trend values. The indicator trend value represents the trend of indicator changes at the time point corresponding to the current abnormal query information. The content of the preset period can be found in the relevant descriptions in the above embodiments, and will not be repeated here. The unit duration is the unit duration within the preset period, which can be set according to the scenario, requirements, etc., and can be any unit duration within the preset period. For example, if the preset period is one week, the unit duration can be one day, and the specified unit duration can be Saturday of the week. Trend items are grouped according to the unit duration of the preset period to discover periodic changes in the unit duration within the preset period. The standard deviation set of trend values ​​in the group with a specified unit duration within the preset period, and the indicator period value, can represent the periodic fluctuation of that specified unit duration.

[0038] For example, the business metric corresponding to the cluster in the second historical time period is DAU, as shown in Table 1 below: Table 1 Then, the sequence [280000, 295000, 260000, 268000, 272000, 275000, 290000] corresponding to the cluster in the second historical time period can be processed by STL to obtain the trend term [282k, 284k, 286k, 288k, 290k, 292k, 294k], where k represents thousands. Based on the DAU from October 30 to November 1, the DAU on November 2 can be predicted according to the following formula (2): (2) in, The DAU (Daily Active Users) value for November 2nd is the indicator trend value. For DAU on November 1st; The DAU is for October 30th. November 2nd is a Saturday, so the standard deviation of the trend values ​​in the grouping of Saturdays within a specified unit of time in the preset period can be calculated as the indicator period value.

[0039] In some embodiments, the historical event database includes event vectors derived from historical events, with each event vector associated with historical event information. Based on abnormal query information, event description information corresponding to the abnormal query information can be obtained; the event description information can be converted into query vectors; the similarity between the query vectors and event vectors in the historical event database can be calculated; and the historical event information associated with event vectors whose similarity meets the matching criteria can be determined as the matched historical event information. In some examples, sub-scene tags matching the abnormal query information can be determined as event description information. In other examples, key information can be extracted from the abnormal query information, and the key information can be combined with the sub-scene tags matching the abnormal query information to obtain event description information. For example, if the sub-scene tag matching the abnormal query information is "Guangdong Province - Consumption - 20 RMB off for every 100 RMB spent," and the abnormal query information includes the event time "Saturday," then "20 RMB off for every 100 RMB spent in Guangdong Province on Saturday" can be used as the event description information. The event description information is converted into query vectors, and the similarity between the query vectors and each event vector in the historical event database is calculated. The matching criteria are used to determine conditions where the similarity is sufficient as reference information for abnormal query information, and can be determined based on the scenario, needs, experience, etc., and are not limited here. For example, matching criteria may include the top N event vectors with the highest similarity to the query vector, or matching criteria may include event vectors among the top N event vectors with the highest similarity to the query vector whose similarity is greater than or equal to a similarity threshold.

[0040] In some examples, matching historical event information may not exist in the historical event database. A global default event information can be pre-set; if no matching historical event information is found in the database, this global default event information can be used as the matching historical event information. Alternatively, if no matching historical event information is found in the database, a fuzzy search can be performed in the database to retrieve historical event information similar to the abnormal query information. The median of the influence factors of these historical event information similar to the abnormal query information can be used as the influence factor in the matching historical event information. Alternatively, zero-shot inference can be performed using a large language model; that is, event information obtained by inferring from business knowledge using a large language model can be used as the matching historical event information.

[0041] In some embodiments, prompt words can be constructed based on target time series parameters and matching historical event information. The prompt words are used to indicate the impact factors corresponding to the abnormal query information output by the large language model. The prompt words are input into the large language model to obtain the impact factors corresponding to the abnormal query information output by the large language model. The target threshold of the target business indicator is obtained according to the target time series parameters and the impact factors corresponding to the abnormal query information. The threshold range of the target business indicator is determined according to the target threshold and the target business indicator.

[0042] The prompts may include, but are not limited to, role settings, task objectives, input information, and output requirements. In this embodiment, the role setting in the prompts may be a business analysis expert, the task objective may be to output the influencing factor corresponding to the abnormal query information, the input information may include target time series parameters and matching historical event information, and the output requirements may include the input format, etc. For example, the trend value of the indicator in the target time series. =296000, indicator period value =6000, the matching condition is the event vector with a similarity greater than or equal to 0.85 among the top 3 event vectors with the highest similarity to the query vector. The historical event information of the matching is shown in Table 2 below: Table 2 Correspondingly, the constructed prompt words can be as follows: "You are a business analytics expert. The following is information for the sub-scenario tag

Guangdong Province - Consumption

[0043] Please output the two numbers directly (separated by a comma): 1. Impact Factor 1; 2. Impact Factor 2. After the large language model outputs the impact factors corresponding to abnormal query information, a "hallucination judgment" can be performed on the impact factors to avoid using impact factors that are "hallucinated" by the large language model. Valid judgment conditions for impact factors can be set, and these conditions can be used to perform the "hallucination judgment" on the impact factors output by the large language model. For example, valid judgment conditions may include: the impact factor is numerical; the impact factor is within a preset threshold range. The preset threshold range can be set according to the scenario, needs, experience, etc., and is not limited here. For example, the impact factors include periodic impact factors and event-adjusted factors. The preset threshold range for periodic impact factors could be [0.5, 3.0], and the preset threshold range for event-adjusted factors could be [-20000, 50000]. If the impact factors output by the large language model meet the valid judgment conditions, it is determined that the impact factors output by the large language model are not "hallucinated" and are valid data that can be used; if the impact factors output by the large language model do not meet the "hallucination judgment conditions," it is determined that the impact factors output by the large language model are "hallucinated" and are invalid data that cannot be used.

[0044] The large language model outputs the influencing factors corresponding to the abnormal query information based on the prompt words. The influencing factors can be used to correct the target time series parameters to obtain the target threshold. In some examples, the target time series parameters include the indicator trend value and the indicator period value, and the influencing factors include the period influence factor and the event adjustment factor. The period influence factor can have an expansion effect on the indicator period value, which can be used to amplify or reduce the periodic changes represented by the indicator period value, and can also be called the expansion coefficient. The event adjustment factor can represent the impact of sudden events (e.g., trading activities), and raise or lower the entire target threshold. The target threshold is the sum of the indicator trend value, the product term, and the event adjustment factor. The product term is the product of the period influence factor and the indicator period value. For example, the target threshold can be obtained according to the following formula (3): (3) in, The target threshold; This represents the trend value of the indicator. This refers to the indicator's periodic value. The periodic influence factor; Adjustment factor for the event.

[0045] The threshold range is generated based on the target threshold. In some examples, the threshold range may include, but is not limited to, a range greater than or equal to the target threshold, a range less than or equal to the target threshold, or a range extended upwards and downwards from the target threshold. The specific range can be determined according to the meaning of the target business metric. For example, if the target business metric is DAU, an excessively high DAU can be considered abnormal. If the threshold range is a normal threshold range, then the threshold range can be a range less than or equal to the target threshold. Examples are not provided here.

[0046] The target threshold comprehensively considers the long-term data trends of the target business indicators, their periodic fluctuations, the impact of these fluctuations, and the impact of unexpected events (such as transaction activities). This allows for precise perception and quantification of the periodic fluctuations and unexpected events in the target business indicators. It adapts to different scenarios, preventing normal business peaks from being misjudged as anomalies, thus improving the accuracy of anomaly detection for business indicators. When the historical event database is initially established or no matching historical event information is found, methods such as zero-shot inference using a large language model, knowledge-understanding-based parameter transfer, and pre-setting global default event information can reduce manual intervention in cold start scenarios. It can also adapt to automated sub-scenario label classification mechanisms.

[0047] In some embodiments, after obtaining the detection results, the event information corresponding to the detection results can be converted into vectors and incrementally stored in the historical event database. The event information corresponding to the detection results may include the sub-scene label corresponding to the detection results, event description information, impact factors, and business metrics under the sub-scene label in the historical time period. The historical event database can be implemented as a FAISS index database, etc., and is not limited thereto.

[0048] Specifically, the system can receive feedback information from the initiator of abnormal query information; if the feedback information indicates that the detection result is correct, historical event information is generated based on the abnormal query information and its corresponding impact factors; the generated historical event information is stored in a historical event database. The feedback information can represent the initiator's stance on the correctness of the detection result. For example, a user's "like" action on the detection result can be considered feedback information indicating that the detection result is correct. Historical event information can also be converted into event vectors, stored in the historical event database, and associated with these event vectors. The global default event information in the above embodiments can be determined based on historical event information in the historical event database. After the historical event database is updated, the global default event information can also be updated accordingly to improve its applicability.

[0049] Information on events with correct detection results is rapidly collected and the historical event database is quickly updated, thereby reducing post-response issues caused by offline training. In this embodiment, a closed-loop feedback mechanism can be formed: historical event database → target threshold → feedback information → historical event database update, thus achieving long-term adaptive optimization of anomaly detection.

[0050] For ease of understanding, the adaptive anomaly detection method in the embodiments of this application will be described below with an example. Figure 2 A schematic diagram illustrating an example of the adaptive anomaly detection process provided in an embodiment of this application, as shown below. Figure 2 As shown, the adaptive anomaly detection process may include steps a1 to a9.

[0051] In step a1, user business behavior information is obtained from the original user behavior log.

[0052] In step a2, multimodal coding is performed.

[0053] Multimodal encoding refers to the content of the business behavior vector obtained in the above embodiments. Step a2 may include two parts: structured encoding and large language model encoding. Structured encoding obtains the encoded vector, and large language model encoding obtains the semantic vector. The encoded vector and the semantic vector are concatenated to obtain the business behavior vector.

[0054] In step a3, dynamic clustering and naming are performed.

[0055] Dynamic clustering and naming refer to the content of the sub-scene labels obtained for each cluster in the above embodiments. Step a3 may include three parts: vector dimensionality reduction processing, HDBSCAN clustering, and generating sub-scene labels. Generating sub-scene labels can be achieved with the assistance of a large language model, but is not limited to this.

[0056] In step a4, the dynamic threshold is adjusted.

[0057] The dynamic threshold is adjusted to the content of the target threshold generated in the above embodiments. Step a4 may include three parts: STL processing, Retrieval-Augmented Generation (RAG) historical event information retrieval, and large language model-generated impact factors. STL processing can obtain the target time series parameters. RAG historical event information retrieval is the content of the matched historical event information obtained in the above embodiments. Large language model-generated impact factors are the content of the impact factors corresponding to the abnormal query information output by the large language model in the above embodiments. The target threshold can be determined by the target time series parameters and the impact factors generated by the large language model.

[0058] In step a5, anomaly detection is performed based on the anomaly query information.

[0059] The detection results can be obtained by comparing the target business indicators and threshold ranges in the abnormal query information.

[0060] In step a6, the feedback information indicates whether the detection result is correct. If correct, proceed to step a7; if incorrect, proceed to step a8.

[0061] In step a7, the RAG library is updated. The RAG library is the historical event library in the above embodiments. Updating the RAG library will also bring feedback updates to step a4.

[0062] In step a8, error information is recorded.

[0063] In step a9, the large language model is fine-tuned using error information. The fine-tuned large language model will also provide feedback updates for step a4.

[0064] The specific details of steps a1 to a9 above can be found in the relevant descriptions in the above embodiments, and will not be repeated here.

[0065] This application also provides an adaptive anomaly detection device. Figure 3 This is a schematic diagram of the structure of an adaptive anomaly detection device provided in an embodiment of this application, as shown below. Figure 3 As shown, the adaptive anomaly detection device 200 may include a matching module 201, a retrieval module 202, a threshold range generation module 203, and a detection module 204.

[0066] The matching module 201 can be used to search for sub-scene tags that match the received abnormal query information in the offline parameter library, and determine the time series parameters corresponding to the matched sub-scene tags as target time series parameters. The offline parameter library includes sub-scene tags and time series parameters with corresponding relationships. The sub-scene tags and time series parameters with corresponding relationships are obtained based on user business behavior information in the first historical time period. The abnormal query information includes target business indicators.

[0067] The retrieval module 202 can be used to search for historical event information that matches the abnormal query information through the historical event database. The historical event information includes impact factors.

[0068] The threshold range generation module 203 can be used to determine the threshold range of the target business indicator based on the target time series parameters and the matched historical event information, and by utilizing the reasoning ability of the large language model.

[0069] The detection module 204 can be used to obtain detection results based on the target business indicators and threshold ranges. The detection results are used to characterize whether the target business indicators are abnormal.

[0070] In some embodiments, the adaptive anomaly detection device 200 may further include an offline data generation module. The offline data generation module can be used to: vectorize user business behavior information in a first historical time period to obtain business behavior vectors; cluster based on the business behavior vectors to obtain at least one cluster; obtain sub-scene labels for each cluster according to the user business behavior information corresponding to the business behavior vectors in each cluster; for each cluster, perform time-series structure analysis on the business indicators corresponding to the cluster in a second historical time period to obtain the cluster's time-series parameters; establish the correspondence between the cluster's sub-scene labels and the cluster's time-series parameters, and store them in an offline parameter library.

[0071] In some examples, the offline data generation module can be used to: extract structured and unstructured information from user business behavior information; encode and normalize the structured information to obtain an encoded vector; use the encoder of a large language model to convert the unstructured information into a semantic vector; and concatenate the encoded vector and the semantic vector to obtain a business behavior vector.

[0072] In some examples, the offline data generation module can be used to: extract key information from the user business behavior information corresponding to each business behavior vector in any cluster; and generate natural language descriptions as sub-scene labels for any cluster based on the mode of the key information.

[0073] In some examples, time series parameters include indicator trend values ​​and indicator period values. The offline data generation module can be used to: perform seasonal and trend decomposition using locally weighted regression based on the business indicators corresponding to clusters in the second historical time period to obtain trend terms, seasonal terms, and residual terms; perform extrapolation calculations based on the trend terms to obtain indicator trend values; group the trend terms according to the unit duration in a preset period, and determine the standard deviation of the trend values ​​in the groups with a specified unit duration in the preset period as the indicator period value.

[0074] In some embodiments, the threshold range generation module 203 can be used to: construct prompt words based on target time series parameters and matched historical event information, the prompt words being used to indicate the impact factors corresponding to the abnormal query information output by the large language model; input the prompt words into the large language model to obtain the impact factors corresponding to the abnormal query information output by the large language model; obtain the target threshold of the target business indicator based on the target time series parameters and the impact factors corresponding to the abnormal query information; and determine the threshold range of the target business indicator based on the target threshold and the target business indicator.

[0075] In some examples, the target time series parameters include the indicator trend value and the indicator period value, and the influencing factors include the period influence factor and the event adjustment factor; the target threshold is the sum of the indicator trend value, the product term, and the event adjustment factor, and the product term is the product of the period influence factor and the indicator period value.

[0076] In some embodiments, the historical event database includes event vectors derived from historical events, and the event vectors are associated with historical event information. The retrieval module 202 can be used to: obtain event description information corresponding to abnormal query information based on abnormal query information; convert the event description information into query vectors; calculate the similarity between the query vectors and event vectors in the historical event database; and determine the historical event information associated with event vectors whose similarity meets the matching conditions as the matched historical event information.

[0077] In some embodiments, the adaptive anomaly detection device 200 may further include a feedback processing module. The feedback processing module can be used to: receive feedback information provided by the initiator of the anomaly query; if the feedback information indicates that the detection result is correct, generate historical event information based on the anomaly query information and the corresponding influencing factors; and store the generated historical event information in a historical event database.

[0078] It should be noted that the adaptive anomaly detection device 200 is a device corresponding to the above-described adaptive anomaly detection method. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0079] This application also provides an adaptive anomaly detection device. Figure 4 This is a schematic diagram of the structure of an adaptive anomaly detection device provided in an embodiment of this application, as shown below. Figure 4 As shown, the adaptive anomaly detection device 300 includes a memory 301, a processor 302, and a computer program stored in the memory 301 and capable of running on the processor 302.

[0080] In some examples, the processor 302 described above may include a central processing unit (CPU), or an application-specific integrated circuit (ASIC), or one or more integrated circuits that may be configured to implement the embodiments of this application.

[0081] Memory 301 may include read-only memory (ROM), random access memory (RAM), disk storage media device, optical storage media device, flash memory device, electrical, optical, or other physical / tangible memory storage device. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the adaptive anomaly detection method according to embodiments of this application.

[0082] The processor 302 runs a computer program corresponding to the executable program code stored in the memory 301 to implement the adaptive anomaly detection method in the above embodiments.

[0083] In some examples, the adaptive anomaly detection device 300 may also include a communication interface 303 and a bus 304. For example, Figure 4 As shown, the memory 301, processor 302, and communication interface 303 are connected through bus 304 and complete communication with each other.

[0084] The communication interface 303 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application. Input devices and / or output devices can also be connected through the communication interface 303.

[0085] Bus 304 includes hardware, software, or both, that couples the components of the adaptive anomaly detection device 300 together. For example, and not limitingly, bus 304 may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), a Hyper Transport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-E) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local Bus (VLB) bus, or other suitable buses, or a combination of two or more of these. Where appropriate, bus 304 may include one or more buses. Although specific buses are described and illustrated in the embodiments of this application, this application considers any suitable bus or interconnection.

[0086] This application also provides a computer-readable storage medium storing computer program instructions. When these computer program instructions are executed by a processor, they can implement the adaptive anomaly detection method described in the above embodiments and achieve the same technical effect. To avoid repetition, further details are omitted here. The aforementioned computer-readable storage medium may include non-transitory computer-readable storage media, such as read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks, etc., and is not limited thereto.

[0087] This application also provides a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements the adaptive anomaly detection method in the above embodiments and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0088] It should be clarified that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. For the device embodiments, equipment embodiments, computer-readable storage medium embodiments, and computer program product embodiments, the relevant parts can be referred to the description section of the method embodiments. This application is not limited to the specific steps and structures described above and shown in the figures. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application. Furthermore, for the sake of brevity, detailed descriptions of known methods and techniques are omitted here.

[0089] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0090] Those skilled in the art will understand that the above embodiments are exemplary and not restrictive. Different technical features appearing in different embodiments can be combined to achieve beneficial effects. Based on a study of the drawings, specification, and claims, those skilled in the art should be able to understand and implement other variations of the disclosed embodiments. In the claims, the term "comprising" does not exclude other means or steps; the quantifier "a" does not exclude a plurality; the terms "first" and "second" are used to identify names and not to indicate any particular order. No reference numerals in the claims should be construed as limiting the scope of protection. The functionality of multiple parts appearing in the claims can be implemented by a single hardware or software module. The appearance of certain technical features in different dependent claims does not mean that these technical features cannot be combined to achieve beneficial effects.

Claims

1. An adaptive anomaly detection method, characterized in that, include: The offline parameter library searches for sub-scene tags that match the received abnormal query information, and determines the time series parameters corresponding to the matching sub-scene tags as target time series parameters. The offline parameter library includes sub-scene tags and time series parameters with corresponding relationships. The sub-scene tags and time series parameters with corresponding relationships are obtained based on user business behavior information in the first historical time period. The abnormal query information includes target business indicators. By using the historical event database, search for historical event information that matches the abnormal query information. The historical event information includes influencing factors. Based on the target time series parameters and the matched historical event information, the threshold range of the target business indicator is determined by utilizing the reasoning capability of the large language model. Based on the target business indicator and the threshold range, a detection result is obtained, which is used to characterize whether the target business indicator is abnormal.

2. The method according to claim 1, characterized in that, Also includes: The user business behavior information in the first historical time period is vectorized to obtain a business behavior vector. Clustering is performed based on the business behavior vectors to obtain at least one cluster; Based on the user business behavior information corresponding to the business behavior vector in each cluster, the sub-scene label of each cluster is obtained; For each cluster, the time-series structure analysis is performed on the business indicators corresponding to the cluster in the second historical time period to obtain the time-series parameters of the cluster. Establish the correspondence between the sub-scene labels of the cluster and the time series parameters of the cluster, and store them in the offline parameter library.

3. The method according to claim 2, characterized in that, The process of vectorizing the user business behavior information in the first historical time period to obtain a business behavior vector includes: Extract structured and unstructured information from the user's business behavior information; The structured information is encoded and normalized to obtain an encoded vector; The unstructured information is converted into semantic vectors using the encoder of a large language model; The business behavior vector is obtained by concatenating the encoded vector and the semantic vector.

4. The method according to claim 2, characterized in that, The step of obtaining the sub-scene label for each cluster based on the user business behavior information corresponding to the business behavior vector in each cluster includes: For any cluster, extract key information from the user business behavior information corresponding to each business behavior vector in the cluster; Based on the mode of the key information, a natural language description is generated as a sub-scene label for any one of the clusters.

5. The method according to claim 2, characterized in that, The time series parameters include indicator trend values ​​and indicator period values; The time-series structure analysis of the business indicators corresponding to the clusters in the second historical time period is performed to obtain the time-series parameters of the clusters, including: Based on the business indicators corresponding to the clusters in the second historical time period, seasonal and trend decompositions using local weighted regression are performed to obtain trend, seasonal and residual terms. Extrapolate the trend terms to obtain the trend value of the indicator. The trend items are grouped according to the unit duration in the preset period, and the standard deviation of the trend values ​​in the group with a specified unit duration in the preset period is determined as the index period value.

6. The method according to claim 1, characterized in that, The step of determining the threshold range of the target business indicator based on the target time series parameters and matched historical event information, and utilizing the reasoning capability of a large language model, includes: Based on the target time series parameters and the matched historical event information, prompt words are constructed. These prompt words are used to instruct the large language model to output the influence factor corresponding to the abnormal query information. Input the prompt words into the large language model to obtain the influence factor corresponding to the abnormal query information output by the large language model; Based on the target time series parameters and the impact factors corresponding to the abnormal query information, the target threshold of the target business indicator is obtained; Based on the target threshold and the target business indicator, determine the threshold range of the target business indicator.

7. The method according to claim 6, characterized in that, The target time series parameters include indicator trend values ​​and indicator period values, and the influencing factors include periodic impact factors and event adjustment factors; The target threshold is the sum of the indicator trend value, the product term, and the event adjustment factor, whereby the product term is the product of the periodic influence factor and the indicator periodic value.

8. The method according to claim 1, characterized in that, The historical event database includes event vectors derived from historical events, and the event vectors are associated with historical event information. The step of searching for historical event information that matches the abnormal query information through the historical event database includes: Based on the abnormal query information, the event description information corresponding to the abnormal query information is obtained; The event description information is converted into a query vector; Calculate the similarity between the query vector and the event vectors in the historical event database; Historical event information associated with event vectors that meet the similarity matching criteria is identified as the matched historical event information.

9. The method according to claim 1, characterized in that, Also includes: Receive feedback information provided by the party that initiated the abnormal query information; If the feedback information indicates that the detection result is correct, historical event information is generated based on the abnormal query information and the influencing factors corresponding to the abnormal query information. The generated historical event information is stored in the historical event database.

10. An adaptive anomaly detection device, characterized in that, include: The matching module is used to search for sub-scene tags that match the received abnormal query information in the offline parameter library, and determine the time series parameters corresponding to the matched sub-scene tags as target time series parameters. The offline parameter library includes sub-scene tags and time series parameters with corresponding relationships. The sub-scene tags and time series parameters with corresponding relationships are obtained based on user business behavior information in the first historical time period. The abnormal query information includes target business indicators. The retrieval module is used to search for historical event information that matches the abnormal query information through a historical event database. The historical event information includes impact factors. The threshold range generation module is used to determine the threshold range of the target business indicator based on the target time series parameters and the matched historical event information, using the reasoning ability of a large language model. The detection module is used to obtain detection results based on the target business indicator and the threshold range, and the detection results are used to characterize whether the target business indicator is abnormal.

11. An adaptive anomaly detection device, characterized in that, include: Processor and memory storing computer program instructions; When the processor executes the computer program instructions, it implements the adaptive anomaly detection method as described in any one of claims 1 to 9.

12. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer program instructions that, when executed by a processor, implement the adaptive anomaly detection method as described in any one of claims 1 to 9.

13. A computer program product, characterized in that, The method includes a computer program that, when executed by a processor, implements the adaptive anomaly detection method according to any one of claims 1 to 9.

Images