Abnormality detection model training and anomaly detection method, device and equipment

Abstract

The invention discloses an anomaly detection model training and anomaly detection method, device and equipment, and relates to the technical field of computer application. The method comprises the following steps: performing knowledge graph construction on original data to obtain a sample knowledge graph; determining training sample data according to the sample knowledge graph; according to the to-be-observed head entity, the sample semantic relationship between the head entity and the tail entity and the sample time information, predicting from the candidate tail entity set to obtain a predicted tail entity; according to a to-be-observed tail entity, a sample semantic relationship between the head entity and the tail entity, and sample time information, predicting from the candidate head entity set to obtain a predicted head entity; and performing training according to the to-be-observed map, the prediction tail entity and the prediction head entity to obtain an anomaly detection model. According to the technical scheme, the detection efficiency of the abnormal data can be improved.

Description

Technical Field

[0001] This invention relates to the field of computer application technology, and in particular to a training method, apparatus and equipment for anomaly detection model and anomaly detection. Background Technology

[0002] Credit risk, market risk, and operational risk are the three major risks faced by commercial banks, with credit risk being the most critical and complex. In lending operations, rising customer default rates are increasingly threatening the profitability of domestic commercial banks. Meanwhile, with the advent of the big data era, user attributes and behavioral characteristics are exhibiting a trend towards high dimensionality and strong sparsity, further exacerbating the difficulty of risk identification and modeling. Against this backdrop, how to effectively process this data and mine core features to improve the accuracy of credit risk assessment, given the challenges posed by high-dimensional sparse features, imbalanced sample data, and massive amounts of data, has become a research hotspot of widespread concern among financial professionals and regulatory agencies. Summary of the Invention

[0003] This invention provides a training method, apparatus, and device for anomaly detection model, and anomaly detection equipment, to improve the detection accuracy of anomalous behavior data.

[0004] According to one aspect of the present invention, a method for training an anomaly detection model is provided, the method comprising:

[0005] A knowledge graph is constructed from the original data to obtain the sample knowledge graph;

[0006] Training sample data is determined based on the sample knowledge graph; the training sample data includes a candidate head entity set, a candidate tail entity set, and an observation graph; wherein, the observation graph includes the head entities to be observed, the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and sample time information;

[0007] Based on the head entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information, the predicted tail entity is predicted from the candidate tail entity set;

[0008] Based on the tail entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information, the predicted head entity is predicted from the candidate head entity set;

[0009] An anomaly detection model is obtained by training based on the observed spectra, the predicted tail entities, and the predicted head entities.

[0010] According to another aspect of the present invention, an anomaly detection method is provided, the method comprising:

[0011] Knowledge graph extraction is performed on the target data to determine the target knowledge graph; the target knowledge graph includes target head entities, target tail entities, target semantic relationships between the target head entities and the target tail entities, and target time information;

[0012] Anomaly analysis is performed on the target knowledge graph based on the anomaly detection model to obtain anomaly prediction values; wherein, the anomaly detection model is trained using the training method for anomaly detection models provided in this embodiment of the invention;

[0013] Anomaly analysis is performed on the target data based on the predicted anomalies.

[0014] According to another aspect of the present invention, a training apparatus for an anomaly detection model is provided, the apparatus comprising:

[0015] The sample knowledge graph determination module is used to construct a knowledge graph from the original data to obtain the sample knowledge graph.

[0016] The training sample determination module is used to determine training sample data based on the sample knowledge graph; the training sample data includes a candidate head entity set, a candidate tail entity set, and a graph to be observed; wherein, the graph to be observed includes head entities to be observed, tail entities to be observed, sample semantic relationships between head entities and tail entities, and sample time information;

[0017] The entity prediction module is used to predict the predicted tail entity from the candidate tail entity set based on the head entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information.

[0018] The entity prediction module is also used to predict the predicted head entity from the candidate head entity set based on the tail entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information;

[0019] The model training module is used to train an anomaly detection model based on the observed spectrogram, the predicted tail entity, and the predicted head entity.

[0020] According to another aspect of the present invention, an anomaly detection device is provided, the device comprising:

[0021] The target knowledge graph determination module is used to extract knowledge graphs from target data and determine the target knowledge graph; the target knowledge graph includes target head entities, target tail entities, target semantic relationships between the target head entities and the target tail entities, and target time information;

[0022] An anomaly prediction module is used to perform anomaly analysis on the target knowledge graph based on an anomaly detection model to obtain anomaly prediction values; wherein, the anomaly detection model is trained by the training method of the anomaly detection model provided in the embodiment of the present invention;

[0023] An anomaly analysis module is used to perform anomaly analysis on the target data based on the anomaly prediction value.

[0024] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0025] At least one processor; and

[0026] A memory communicatively connected to the at least one processor; wherein,

[0027] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the training method or anomaly detection method of the anomaly detection model according to any embodiment of the present invention.

[0028] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the training method or anomaly detection method of the anomaly detection model according to any embodiment of the present invention.

[0029] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements a training method or an anomaly detection method for an anomaly detection model according to any embodiment of the present invention.

[0030] The technical solution of this invention involves constructing a knowledge graph from the original data to obtain a sample knowledge graph; determining training sample data based on the sample knowledge graph, the training sample data including a candidate head entity set, a candidate tail entity set, and an observation graph; wherein, the observation graph includes the head entities to be observed, the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and sample time information; predicting the predicted tail entities from the candidate tail entity set based on the head entities to be observed, the sample semantic relationships between the head entities and the tail entities, and the sample time information; predicting the predicted head entities from the candidate head entity set based on the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and the sample time information; and training an anomaly detection model based on the observation graph, the predicted tail entities, and the predicted head entities. This technical solution, by deeply mining the original data to construct a knowledge graph and mining deep-perception features for entity prediction, obtains an anomaly detection model, thereby improving the detection of abnormal behavior data.

[0031] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0032] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 This is a flowchart of a training method for an anomaly detection model provided according to an embodiment of the present invention;

[0034] Figure 2 This is a flowchart of a training method for an anomaly detection model provided according to an embodiment of the present invention;

[0035] Figure 3 This is a flowchart of an anomaly detection method provided according to an embodiment of the present invention;

[0036] Figure 4 This is a schematic diagram of the structure of a training device for an anomaly detection model according to an embodiment of the present invention;

[0037] Figure 5 This is a schematic diagram of the structure of an anomaly detection device according to an embodiment of the present invention;

[0038] Figure 6 This is a schematic diagram of the structure of an electronic device that implements the training method or anomaly detection method of the anomaly detection model in the embodiments of the present invention. Detailed Implementation

[0039] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0040] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0041] Furthermore, it should be noted that the collection, storage, use, processing, transmission, provision, and disclosure of raw data, such as user behavior data, involved in the technical solution of this invention all comply with relevant laws and regulations and do not violate public order and good morals. It should also be noted that the acquisition of user behavior data and related data is only authorized by the user and used for anomaly detection, such as business risk detection.

[0042] Figure 1 This is a flowchart illustrating a training method for an anomaly detection model according to an embodiment of the present invention. This embodiment is applicable to situations in financial settings such as banking where abnormal data is detected to identify business risks. The method can be executed by a training device for the anomaly detection model, which can be implemented in hardware and / or software. This device can be configured in an electronic device that carries the training function of the anomaly detection model, such as a server. Figure 1 As shown, the method includes:

[0043] S110. Construct a knowledge graph from the original data to obtain the sample knowledge graph.

[0044] In this embodiment, the raw data refers to the user's behavioral data within the financial institution. It should be noted that the acquisition of the raw data for anomaly detection is authorized by the user. The so-called sample knowledge graph refers to the knowledge graph extracted and constructed from the raw data, used for training the anomaly detection model. Optionally, the sample knowledge graph includes head entities, tail entities, sample semantic relationships between head and tail entities, and sample time information. Head entities refer to entities such as user names that represent user affiliation; tail entities refer to entities related to the location or place where the user's actions occurred; sample semantic relationships refer to the types of relationships between head and tail entities, including but not limited to registration location, login location, etc.; sample time information refers to the time information involved in the user's actions, including but not limited to timestamps, time intervals, and periodic patterns.

[0045] Specifically, entities are extracted from the raw data. Key entities include people, organizations, behaviors, geographic information, and data records, as shown in Table 1 below.

[0046] Table 1

[0047]

[0048] Then, semantic relationships between entities are identified from user behavior records, log data, structured data, etc., and the edges of the sample knowledge graph are constructed, as shown in Table 2 below.

[0049] Table 2

[0050]

[0051] Finally, the sample time information is determined, adding time information to the sample semantic relationships between each head entity and tail entity. The final sample knowledge graph can be represented by Table 3 below.

[0052] Table 3

[0053]

[0054] Furthermore, the sample knowledge graph is stored in the database in the form of Table 3.

[0055] S120. Determine the training sample data based on the sample knowledge graph.

[0056] In this embodiment, the training sample data includes a candidate head entity set, a candidate tail entity set, and an observation graph. The candidate head entity set refers to the set of entities used for head entity prediction. The candidate tail entity set refers to the set of entities used for tail entity prediction. The observation graph refers to the graph used for entity prediction based on knowledge in the observation graph; the observation graph includes the head entities to be observed, the tail entities to be observed, the semantic relationships between the head and tail entities, and sample time information; the head entities to be observed are the real head entities corresponding to the head entity prediction; the tail entities to be observed are the real tail entities corresponding to the tail entity prediction.

[0057] Specifically, some head entities are extracted from the sample knowledge graph as a candidate head entity set, and some tail entities are extracted from the sample knowledge graph as a candidate tail entity set. A portion of the knowledge graph is selected from the sample knowledge graph as the graph to be observed.

[0058] S130. Based on the observed head entity, the sample semantic relationship between the head entity and the tail entity, and the sample time information, predict the predicted tail entity from the candidate tail entity set.

[0059] In this embodiment, the predicted tail entity refers to the tail entity corresponding to the predicted tail entity to be observed.

[0060] Specifically, the semantic relationships between the head entity, the head entity, and the tail entity, as well as the sample time information, can be input into the entity prediction model to predict the tail entity from the candidate tail entity set. It should be noted that the entity prediction model is a deep learning model used for entity prediction.

[0061] S140. Based on the semantic relationship between the tail entity to be observed, the head entity and the tail entity, and the sample time information, predict the predicted head entity from the candidate head entity set.

[0062] In this embodiment, the predicted head entity refers to the head entity corresponding to the predicted head entity to be observed.

[0063] Specifically, the semantic relationships between the tail entities to be observed, the head entities, and the tail entities, as well as the sample time information, can be input into the entity prediction model to predict the predicted head entities from the candidate head entity set.

[0064] S150. An anomaly detection model is obtained by training based on the observed spectrum, predicted tail entities, and predicted head entities.

[0065] In this embodiment, the anomaly detection model refers to the model used for anomaly detection.

[0066] An alternative approach is to determine the training loss based on a preset loss function, such as cross-entropy loss, according to the head entities to be observed and the predicted head entities in the observed graph, and according to the tail entities to be observed and the predicted tail entities in the observed graph, and then train the anomaly detection model based on the training loss.

[0067] The technical solution of this invention involves constructing a knowledge graph from the original data to obtain a sample knowledge graph; determining training sample data based on the sample knowledge graph, the training sample data including a candidate head entity set, a candidate tail entity set, and an observation graph; wherein, the observation graph includes the head entities to be observed, the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and sample time information; predicting the predicted tail entities from the candidate tail entity set based on the head entities to be observed, the sample semantic relationships between the head entities and the tail entities, and the sample time information; predicting the predicted head entities from the candidate head entity set based on the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and the sample time information; and training an anomaly detection model based on the observation graph, the predicted tail entities, and the predicted head entities. This technical solution, by deeply mining the original data to construct a knowledge graph and mining deep-perception features for entity prediction, obtains an anomaly detection model, thereby improving the detection of abnormal behavior data.

[0068] Figure 2 This is a flowchart of a training method for an anomaly detection model according to an embodiment of the present invention. Based on the above embodiments, this embodiment further optimizes the process of "training an anomaly detection model based on the observed graph, predicted tail entities, and predicted head entities," providing an optional implementation scheme. For example... Figure 2 As shown, the method includes:

[0069] S210. Construct a knowledge graph from the original data to obtain the sample knowledge graph.

[0070] The sample knowledge graph includes head entities, tail entities, sample semantic relationships between head entities and tail entities, and sample time information.

[0071] S220. Determine the training sample data based on the sample knowledge graph. The training sample data includes the candidate head entity set, the candidate tail entity set, and the graph to be observed.

[0072] The observation map includes the head entity to be observed, the tail entity to be observed, the semantic relationship between the head entity and the tail entity, and the sample time information;

[0073] S230. Based on the observed head entity, the sample semantic relationship between the head entity and the tail entity, and the sample time information, predict the predicted tail entity from the candidate tail entity set.

[0074] S240. Based on the semantic relationship between the tail entity to be observed, the head entity and the tail entity, and the sample time information, predict the predicted head entity from the candidate head entity set.

[0075] S250. Perform multi-dimensional vector embedding on the observed head entity, sample semantic relationship, observed tail entity, sample time information, predicted tail entity and predicted head entity respectively to obtain head embedding feature, tail embedding feature, relationship embedding feature, time embedding feature, predicted tail embedding feature and predicted head embedding feature.

[0076] In this embodiment, head embedding features refer to the multi-dimensional vector features corresponding to the head entity to be observed; tail embedding features refer to the multi-dimensional vector features corresponding to the tail entity to be observed; relation embedding features refer to the multi-dimensional vector features corresponding to the semantic relations of the samples; time embedding features refer to the multi-dimensional vector features corresponding to the time information of the samples; prediction tail embedding features refer to the multi-dimensional vector features corresponding to the predicted tail entity; and prediction head embedding features refer to the multi-dimensional vector features corresponding to the predicted head entity.

[0077] Specifically, for better representation, the present invention adopts ( This represents the head entity to be observed, the semantic relationship of the sample, the tail entity to be observed, and the time information of the sample. Indicates the predicted head entity. This represents the predicted tail entity; head entity ID, tail entity ID, and semantic ID are assigned to the observed head entity, the observed tail entity, and the sample semantic relationship, respectively. The head entity ID, tail entity ID, and semantic ID are then mapped to a k-dimensional second-order multi-vector embedding M, i.e. , We obtain head embedding features, tail embedding features, and relation embedding features; and map the sample time information, predicted tail entity, and predicted head entity into k-dimensional second-order multi-vector embeddings to obtain time embedding features, predicted tail embedding features, and predicted head embedding features.

[0078] For example, the head embedding features and the tail embedding features are respectively = + + + and = + + + Relational embedding features and temporal embedding features are respectively = + + + and = + + + ;

[0079] Predicting tail embedding features and predicting head embedding features = + + + and = + + + .

[0080] S260. Reconstruct the features from the head embedding features, tail embedding features, relational embedding features, temporal embedding features, predicted tail embedding features, and predicted head embedding features to obtain a reconstructed feature set.

[0081] In this embodiment, the reconstructed feature set refers to the feature set obtained by reconstructing the head embedding feature, tail embedding feature, relation embedding feature, time embedding feature, predicted tail embedding feature, and predicted head embedding feature, including the multidimensional reconstructed feature set, the predicted head reconstructed feature set, the predicted head reconstructed feature set, the tail conjugate feature, and the predicted tail conjugate feature.

[0082] An optional approach involves reconstructing features from head embedding features, tail embedding features, relation embedding features, temporal embedding features, predicted tail embedding features, and predicted head embedding features to obtain a reconstructed feature set. This includes: reconstructing features based on head embedding features, relation embedding features, and temporal embedding features to obtain a multidimensional reconstructed feature set; reconstructing features based on predicted head embedding features, relation embedding features, and temporal embedding features to obtain a predicted head reconstructed feature set; reconstructing features based on head embedding features, relation embedding features, and temporal embedding features to obtain a predicted tail reconstructed feature set; performing conjugation processing on tail embedding features and predicted tail embedding features to obtain tail conjugated features and predicted tail conjugated features; and using the multidimensional reconstructed feature set, predicted head reconstructed feature set, predicted tail reconstructed features, tail conjugated features, and predicted tail conjugated features as the reconstructed feature set.

[0083] Specifically, feature reconstruction is performed based on head embedding features, relation embedding features, and temporal embedding features to obtain a multi-dimensional reconstructed feature set, such as:

[0084] = + + + ;

[0085] = + + + ;

[0086] = + + + ;

[0087] Feature reconstruction is performed based on the prediction head embedding features, relation embedding features, and time embedding features to obtain the prediction tail head feature set, such as:

[0088] = + + + ;

[0089] = + + + ;

[0090] = + + + ;

[0091] It should be noted that the predicted tail reconstruction feature set and the multidimensional reconstruction feature set are the same.

[0092] The tail embedding features and the predicted tail embedding features are conjugated separately to obtain the tail conjugated features. and predicted tail conjugate features .

[0093] Understandably, by reconstructing multidimensional embedded features, it is possible to achieve deep-level interaction of core features of user data.

[0094] S270. Train the reconstructed feature set to determine the anomaly detection model.

[0095] An optional approach involves training an anomaly detection model on a reconstructed feature set, including: determining a true anomaly evaluation value based on a multidimensional reconstructed feature set and tail conjugate features; determining a predicted head anomaly evaluation value based on a predicted head reconstructed feature set and tail conjugate features; determining a predicted tail anomaly evaluation value based on a predicted tail reconstructed feature set and tail conjugate features; determining a training loss based on the true anomaly evaluation value, the predicted head anomaly evaluation value, and the predicted tail anomaly evaluation value; and training a behavioral anomaly model based on the training loss to obtain an anomaly detection model.

[0096] Specifically, this invention provides an anomaly detection model, such as the Deep Fusion Mining and Perception Model (MDIG), which uses a scoring function based on a multidimensional reconstructed feature set and tail conjugate features to determine the true anomaly evaluation value. The scoring function corresponding to the true anomaly evaluation value is as follows:

[0097] .

[0098] in, Represents the scoring function. This represents the element-wise geometric product between second-order multi-vector embeddings. A detailed example of the formula is shown below. = + - + ( ) +( ) +( ) ;Sc() represents the multiplying vector of the scalar components of a multi-vector embedding;1 represents a k×1 vector whose k elements are all equal to 1; This represents the element-wise conjugation operation of multiple vectors, i.e., the tail conjugation feature.

[0099] Therefore, the true anomaly assessment value is Similarly, based on the scoring function, the anomaly evaluation value of the predicted head is determined according to the reconstructed feature set of the predicted head and the conjugate features of the tail.

[0100] .

[0101] Similarly, based on the scoring function, the predicted tail anomaly evaluation value is determined according to the predicted tail reconstructed feature set and the predicted tail conjugate features, i.e.,

[0102] = .

[0103] Finally, based on the cross-entropy loss function, the training loss L is determined according to the true anomaly evaluation value, the predicted head anomaly evaluation value, and the predicted tail anomaly evaluation value.

[0104]

[0105] in, The observed knowledge graph is obtained by sampling from the sample knowledge graph Π.

[0106] The abnormal behavior model is iteratively trained based on the training loss until the training loss converges, thus obtaining the abnormality detection model.

[0107] The technical solution provided in this invention involves constructing a knowledge graph from the original data to obtain a sample knowledge graph; determining training sample data based on the sample knowledge graph, including a candidate head entity set, a candidate tail entity set, and an observation graph; predicting a tail entity from the candidate tail entity set based on the head entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information; predicting a head entity from the candidate head entity set based on the tail entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information; performing multi-dimensional vector embedding on the head entity to be observed, the sample semantic relationship, the tail entity to be observed, the sample time information, the predicted tail entity, and the predicted head entity to obtain head embedding features, tail embedding features, relationship embedding features, time embedding features, predicted tail embedding features, and predicted head embedding features; reconstructing the head embedding features, tail embedding features, relationship embedding features, time embedding features, predicted tail embedding features, and predicted head embedding features to obtain a reconstructed feature set; and training the reconstructed feature set to determine an anomaly detection model. The aforementioned technical features, through the fusion of deeper user feature extraction based on reconstructed feature extraction, thereby improving the identification of users with abnormal behavioral tendencies.

[0108] Figure 3This is a flowchart of an anomaly detection method according to an embodiment of the present invention. This embodiment is applicable to situations in financial settings such as banking where abnormal data is detected to identify business risks. The method can be executed by an anomaly detection device, which can be implemented in hardware and / or software. This device can be configured in an electronic device carrying anomaly detection functionality, such as a server. Figure 3 As shown, the method includes:

[0109] S310. Extract knowledge graphs from the target data to determine the target knowledge graph.

[0110] In this embodiment, the target knowledge graph refers to the knowledge graph that needs to perform real-time detection of abnormal user behavior; optionally, the target knowledge graph includes target head entities, target tail entities, target semantic relationships between target head entities and target tail entities, and target time information.

[0111] S320. Based on the anomaly detection model, perform anomaly analysis on the target knowledge graph to obtain anomaly prediction values.

[0112] The anomaly detection model is trained using the training method for anomaly detection models provided in this embodiment of the invention.

[0113] Specifically, the target knowledge graph is input into the anomaly detection model to perform anomaly analysis and obtain anomaly prediction values.

[0114] S330. Perform anomaly analysis on the target data based on the anomaly prediction values.

[0115] Specifically, the predicted anomaly value is compared with the anomaly threshold. If the predicted anomaly value is greater than the anomaly threshold, it is determined that the user corresponding to the target knowledge graph has a tendency to behave abnormally. The anomaly threshold can be set by those skilled in the art based on the actual situation.

[0116] The technical solution provided in this invention extracts a knowledge graph from the target data to determine the target knowledge graph, performs anomaly analysis on the target knowledge graph based on an anomaly detection model to obtain anomaly prediction values, and then performs anomaly analysis on the target data based on the anomaly prediction values. This technical solution can effectively improve the accuracy of detecting users with abnormal behavior.

[0117] Figure 4 This is a schematic diagram of a training device for an anomaly detection model according to an embodiment of the present invention. This embodiment is applicable to situations in financial settings such as banking where abnormal data is detected to identify business risks. The training device for the anomaly detection model can be implemented in hardware and / or software, and can be configured in an electronic device that carries the training function of the anomaly detection model, such as a server. Figure 4 As shown, the device includes:

[0118] The sample knowledge graph determination module 410 is used to construct a knowledge graph from the original data to obtain a sample knowledge graph.

[0119] The training sample determination module 420 is used to determine training sample data based on the sample knowledge graph. The training sample data includes a set of candidate head entities, a set of candidate tail entities, and a graph to be observed. The graph to be observed includes head entities to be observed, tail entities to be observed, the semantic relationship between head entities and tail entities, and sample time information.

[0120] The entity prediction module 430 is used to predict the predicted tail entity from the candidate tail entity set based on the observed head entity, the sample semantic relationship between the head entity and the tail entity, and the sample time information.

[0121] The entity prediction module 430 is also used to predict the predicted head entity from the candidate head entity set based on the sample semantic relationship between the tail entity to be observed, the head entity and the tail entity, and the sample time information.

[0122] The model training module 440 is used to train an anomaly detection model based on the observed map, predicted tail entities, and predicted head entities.

[0123] The technical solution of this invention involves constructing a knowledge graph from the original data to obtain a sample knowledge graph; determining training sample data based on the sample knowledge graph, the training sample data including a candidate head entity set, a candidate tail entity set, and an observation graph; wherein, the observation graph includes the head entities to be observed, the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and sample time information; predicting the predicted tail entities from the candidate tail entity set based on the head entities to be observed, the sample semantic relationships between the head entities and the tail entities, and the sample time information; predicting the predicted head entities from the candidate head entity set based on the tail entities to be observed, the sample semantic relationships between the head entities and the tail entities, and the sample time information; and training an anomaly detection model based on the observation graph, the predicted tail entities, and the predicted head entities. This technical solution, by deeply mining the original data to construct a knowledge graph and mining deep-perception features for entity prediction, obtains an anomaly detection model, thereby improving the detection of abnormal behavior data.

[0124] Optional, model training module 440, used for:

[0125] Multidimensional vector embeddings are performed on the observed head entity, sample semantic relationship, observed tail entity, sample time information, predicted tail entity, and predicted head entity respectively to obtain head embedding features, tail embedding features, relationship embedding features, time embedding features, predicted tail embedding features, and predicted head embedding features.

[0126] Feature reconstruction is performed on the head embedding feature, tail embedding feature, relation embedding feature, time embedding feature, predicted tail embedding feature, and predicted head embedding feature to obtain the reconstructed feature set;

[0127] The anomaly detection model is determined by training the reconstructed feature set.

[0128] Optional, model training module 440, specifically used for:

[0129] Feature reconstruction is performed based on head embedding features, relation embedding features, and time embedding features to obtain a multi-dimensional reconstructed feature set;

[0130] Based on the prediction head embedding features, relation embedding features, and time embedding features, feature reconstruction is performed to obtain the prediction head reconstruction feature set;

[0131] Feature reconstruction is performed based on head embedding features, relation embedding features, and time embedding features to obtain the predicted tail reconstruction feature set;

[0132] The tail embedding features and the predicted tail embedding features are conjugated separately to obtain tail conjugated features and predicted tail conjugated features.

[0133] The multidimensional reconstruction feature set, the prediction head reconstruction feature set, the prediction tail reconstruction feature set, the tail conjugate feature set, and the prediction tail conjugate feature set are used as the reconstruction feature set.

[0134] Optional, model training module 440, specifically used for:

[0135] The true anomaly assessment value is determined based on the multidimensional reconstructed feature set and tail conjugate features;

[0136] The anomaly assessment value of the predicted head is determined based on the predicted head reconstruction feature set and the tail conjugate feature.

[0137] The predicted tail anomaly evaluation value is determined based on the predicted tail reconstruction feature set and the predicted tail conjugate features.

[0138] The training loss is determined based on the actual anomaly assessment value, the predicted head anomaly assessment value, and the predicted tail anomaly assessment value.

[0139] The abnormal behavior model is trained based on the training loss to obtain the abnormality detection model.

[0140] The training device for the anomaly detection model provided in this embodiment of the invention can execute the training method for the anomaly detection model provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0141] Figure 5This is a schematic diagram of an anomaly detection device according to an embodiment of the present invention. This embodiment is applicable to situations in financial settings such as banking where abnormal data is detected to identify business risks. The anomaly detection device can be implemented in hardware and / or software, and can be configured in an electronic device carrying anomaly detection functionality, such as a server. Figure 5 As shown, the device includes:

[0142] The target knowledge graph determination module 510 is used to extract knowledge graphs from target data and determine the target knowledge graph; the target knowledge graph includes target head entities, target tail entities, target semantic relationships between target head entities and target tail entities, and target time information;

[0143] Anomaly prediction module 520 is used to perform anomaly analysis on the target knowledge graph based on anomaly detection model to obtain anomaly prediction values; wherein, the anomaly detection model is trained by the training method of the anomaly detection model provided in the embodiment of the present invention.

[0144] The anomaly analysis module 530 is used to perform anomaly analysis on target data based on anomaly prediction values.

[0145] The technical solution provided in this invention extracts a knowledge graph from the target data to determine the target knowledge graph, performs anomaly analysis on the target knowledge graph based on an anomaly detection model to obtain anomaly prediction values, and then performs anomaly analysis on the target data based on the anomaly prediction values. This technical solution can effectively improve the accuracy of detecting users with abnormal behavior.

[0146] The anomaly detection device provided in the embodiments of the present invention can execute the anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0147] According to embodiments of the present invention, the present invention also provides an electronic device, a readable storage medium, and a computer program product.

[0148] Figure 6 This is a schematic diagram of the structure of an electronic device that implements the training method or anomaly detection method of the anomaly detection model in the embodiments of the present invention. Figure 6A schematic diagram of an electronic device 10 that can be used to implement embodiments of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0149] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0150] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0151] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as training methods for anomaly detection models or anomaly detection methods.

[0152] In some embodiments, the training method for the anomaly detection model or the anomaly detection method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the training method for the anomaly detection model or the anomaly detection method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to execute the training method for the anomaly detection model or the anomaly detection method by any other suitable means (e.g., by means of firmware).

[0153] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0154] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0155] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0156] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0157] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or middleware components (e.g., application servers), or frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0158] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0159] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0160] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A training method for an anomaly detection model, characterized in that, include: A knowledge graph is constructed from the original data to obtain the sample knowledge graph; Training sample data is determined based on the aforementioned sample knowledge graph; The training sample data includes a set of candidate head entities, a set of candidate tail entities, and a graph to be observed; wherein, the graph to be observed includes head entities to be observed, tail entities to be observed, the semantic relationships between head entities and tail entities, and sample time information; Based on the head entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information, the predicted tail entity is predicted from the candidate tail entity set; Based on the tail entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information, the predicted head entity is predicted from the candidate head entity set; An anomaly detection model is obtained by training based on the observed spectra, the predicted tail entities, and the predicted head entities.

2. The method according to claim 1, characterized in that, An anomaly detection model is trained based on the observed spectrogram, the predicted tail entity, and the predicted head entity, including: Multidimensional vector embedding is performed on the head entity to be observed, the sample semantic relationship, the tail entity to be observed, the sample time information, the predicted tail entity, and the predicted head entity respectively to obtain head embedding features, tail embedding features, relationship embedding features, time embedding features, predicted tail embedding features, and predicted head embedding features; The head embedding feature, the tail embedding feature, the relation embedding feature, the time embedding feature, the predicted tail embedding feature, and the predicted head embedding feature are reconstructed to obtain a reconstructed feature set; The reconstructed feature set is used to train and determine the anomaly detection model.

3. The method according to claim 2, characterized in that, The head embedding feature, tail embedding feature, relation embedding feature, temporal embedding feature, predicted tail embedding feature, and predicted head embedding feature are reconstructed to obtain a reconstructed feature set, including: Based on the head embedding features, the relation embedding features, and the time embedding features, feature reconstruction is performed to obtain a multi-dimensional reconstructed feature set; Based on the prediction head embedding features, the relation embedding features, and the time embedding features, feature reconstruction is performed to obtain the prediction head reconstruction feature set; Based on the head embedding features, the relation embedding features, and the time embedding features, feature reconstruction is performed to obtain the predicted tail reconstruction feature set; The tail embedding feature and the predicted tail embedding feature are conjugated to obtain tail conjugated features and predicted tail conjugated features, respectively. The multidimensional reconstruction feature set, the prediction head reconstruction feature set, the prediction tail reconstruction feature, the tail conjugate feature, and the prediction tail conjugate feature are used as the reconstruction feature set.

4. The method according to claim 3, characterized in that, The anomaly detection model is obtained by training the reconstructed feature set, including: The true anomaly assessment value is determined based on the multidimensional reconstructed feature set and the tail conjugate feature. Based on the predicted head reconstruction feature set and the tail conjugate features, the predicted head anomaly evaluation value is determined; The prediction tail anomaly evaluation value is determined based on the predicted tail reconstruction feature set and the predicted tail conjugate features; The training loss is determined based on the actual anomaly evaluation value, the predicted head anomaly evaluation value, and the predicted tail anomaly evaluation value. The abnormal behavior model is trained based on the training loss to obtain the abnormality detection model.

5. An anomaly detection method, characterized in that, include: Knowledge graph extraction is performed on the target data to determine the target knowledge graph; The target knowledge graph includes target head entities, target tail entities, target semantic relationships between the target head entities and the target tail entities, and target time information; Anomaly analysis is performed on the target knowledge graph based on the anomaly detection model to obtain anomaly prediction values; wherein, the anomaly detection model is trained using the training method for anomaly detection models according to any one of claims 1-4; Anomaly analysis is performed on the target data based on the predicted anomalies.

6. A training device for an anomaly detection model, characterized in that, include: The sample knowledge graph determination module is used to construct a knowledge graph from the original data to obtain the sample knowledge graph. The training sample determination module is used to determine training sample data based on the sample knowledge graph. The training sample data includes a set of candidate head entities, a set of candidate tail entities, and a graph to be observed; wherein, the graph to be observed includes head entities to be observed, tail entities to be observed, the semantic relationships between head entities and tail entities, and sample time information; The entity prediction module is used to predict the predicted tail entity from the candidate tail entity set based on the head entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information. The entity prediction module is also used to predict the predicted head entity from the candidate head entity set based on the tail entity to be observed, the sample semantic relationship between the head entity and the tail entity, and the sample time information; The model training module is used to train an anomaly detection model based on the observed spectrogram, the predicted tail entity, and the predicted head entity.

7. An anomaly detection device, characterized in that, include: The target knowledge graph determination module is used to extract knowledge graphs from target data and determine the target knowledge graph. The target knowledge graph includes target head entities, target tail entities, target semantic relationships between the target head entities and the target tail entities, and target time information; An anomaly prediction module is used to perform anomaly analysis on the target knowledge graph based on an anomaly detection model to obtain anomaly prediction values; wherein, the anomaly detection model is trained using the training method of the anomaly detection model according to any one of claims 1-4; An anomaly analysis module is used to perform anomaly analysis on the target data based on the anomaly prediction value.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the training method of the anomaly detection model according to any one of claims 1-4, or the anomaly detection method according to claim 5.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the training method of the anomaly detection model according to any one of claims 1-4, or the anomaly detection method according to claim 5.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the training method for the anomaly detection model according to any one of claims 1-4, or the anomaly detection method according to claim 5.

Images