Data annotation entity anomaly detection method and device, storage medium and computer equipment

Abstract

The invention discloses a data annotation entity anomaly detection method and device, a storage medium and computer equipment. The method comprises the steps of performing entity extraction on to-be-annotated data based on a hidden Markov model; inputting the extracted entity data into an entity data content anomaly detection model constructed based on a univariate Gaussian prediction function, and judging whether the input entity data is abnormal data or not through the entity data content anomaly detection model; determining first abnormal entity data which is judged to be abnormal data in the input entity data, and acquiring original corpus context information of the first abnormal entity data in original corpus; re-judging whether the first abnormal entity data is abnormal data or not based on the original corpus context information through an entity data context anomaly detection model; and determining second abnormal entity data of which the re-judgment result is abnormal data in the first abnormal entity data, and labeling the second abnormal entity data.

Description

Technical Field

[0001] This application relates to the field of data annotation technology, and in particular to a method, apparatus, storage medium and computer equipment for detecting anomalies in data-annotated entities. Background Technology

[0002] As artificial intelligence (AI) technology enters the stage of large-scale application, data annotation, as a fundamental step in AI model training, is becoming increasingly important. Data annotation involves manually assigning correct labels to data such as speech, images, and text. Generative AI corpora primarily consist of massive amounts of unlabeled text data collected from sources such as books, magazines, encyclopedias, and forums. Entity anomaly detection technology in data annotation provides significant technological innovations to address the subjectivity of entity recognition, inconsistent annotation standards, and biases in entity annotation data. Automated and accurate entity data annotation drives the development of the data annotation industry and has profound implications for the digital economy, industrial upgrading, and even the intelligent transformation of social life.

[0003] Existing data annotation techniques for anomaly detection in unannotated corpora employ the nearest neighbor algorithm. This algorithm is primarily based on the initial assumption that normal, similar corpus entities tend to cluster together, while anomalies are often far from their neighbors. In the nearest neighbor algorithm, the distance from a corpus entity to its Kth nearest neighbor is used as the anomaly score. The basic mechanism is: the anomaly score of a corpus entity is the distance between it and its Kth nearest neighbor. By setting a predefined threshold, if the anomaly score of the tested corpus entity exceeds this threshold, then the entity is considered anomalous; otherwise, it is considered normal. Alternatively, all corpus entities can be sorted by their anomaly scores, and the N highest scores can be selected as anomalies.

[0004] The basic principle of nearest neighbor anomaly detection algorithms is to score the results based on the distance from the detected point to its Kth nearest neighbor. However, the success rate of nearest neighbor anomaly detection algorithms in actual annotated corpora is highly random, and the choice of parameter K has a significant impact on the anomaly detection results. If K is small, some small-scale entity anomalies will not be detected; conversely, if K is large, many normal corpus entities will be falsely reported. In practical data annotation applications, the scale of anomalies is usually irregular and uneven, meaning that anomalies in corpus entities are often isolated and sometimes small-scale, leading to a very high false positive rate for existing nearest neighbor-based corpus entity anomaly detection algorithms. Summary of the Invention

[0005] In view of this, embodiments of this application provide a method, apparatus, storage medium, and computer device for detecting anomalies in data-annotated entities.

[0006] According to one aspect of this application, a method for detecting entity anomalies in data annotation is provided, the method comprising: Entity extraction is performed on the labeled data based on Hidden Markov Model (HMM). The extracted entity data is input into an entity data content anomaly detection model built based on a univariate Gaussian prediction function. The entity data content anomaly detection model is used to determine whether the input entity data is abnormal. Identify the first abnormal entity data that is judged to be abnormal data in the input entity data, and obtain the original corpus context information of the first abnormal entity data in the original corpus; The entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal based on the context information of the original corpus; Identify a second abnormal entity data in the first abnormal entity data that is again determined to be abnormal data, and label the second abnormal entity data.

[0007] Optionally, the step of further determining whether the first abnormal entity data is abnormal data based on the context information of the original corpus using the entity data context anomaly detection model includes: Determine the number of clusters for the first abnormal entity data, and perform cluster analysis on the first abnormal entity data to determine the cluster category for each of the first abnormal entity data. For each of the first abnormal entity data, the density of the first abnormal entity data is calculated. Based on the density, the K-means clustering algorithm is used to iterate the abnormal entity data to the cluster corresponding to the category. The entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal based on the density and the original corpus context information.

[0008] Optionally, determining the number of clusters for the first abnormal entity data and performing cluster analysis on the first abnormal entity data to determine the cluster category for each of the first abnormal entity data includes: The first abnormal entity data is obtained as an entity object set, and a specified number of clusters N is obtained as the number of clusters of the first abnormal entity data. N objects are randomly selected from the entity object set as initial cluster centers. Based on the similarity criterion, the first abnormal entity data is assigned to the cluster center with the highest similarity to form a class. The average vector of the entity data in each class is used as the new cluster center. The first abnormal entity data is then redistributed until the cluster center meets the preset cluster center convergence error tolerance.

[0009] Optionally, calculating the density of the first abnormal entity data includes: The first abnormal entity data is determined to be entity data point P, and the K-distance of entity data point P is calculated; Calculate K-distance neighbor clustering for entity data point P based on K-distance; For each entity data point O in the K-distance neighbor cluster of the entity data point P, calculate the reachability distance between entity data point P and entity data point O; The density of the entity data point P is calculated based on the reachability distance.

[0010] Optionally, calculating the reachability distance between entity data point P and entity data point O includes: Calculate the true distance between entity data point P and entity data point O; If the true distance is greater than or equal to the distance threshold, then the true distance is determined to be the reachable distance between entity data point P and entity data point O; If the actual distance is less than the distance threshold, then the K-distance of the entity data point O is taken as the reachable distance between the entity data point P and the entity data point O.

[0011] Optionally, the step of iterating the content-abnormal entity data to the cluster corresponding to the category using the K-means clustering algorithm based on the density includes: For each cluster category, the weight of each first abnormal entity data is determined based on the density of each first abnormal entity data in the cluster category. The vectors of each first abnormal entity data are then weighted and summed based on their respective weights to update the cluster center of the cluster category. Based on the updated cluster centers of each cluster category, the data of each of the first abnormal entities are assigned to a cluster category.

[0012] Optionally, the step of further determining whether the first abnormal entity data is abnormal based on the density using the entity data context anomaly detection model includes: By analyzing the contextual semantic coherence of the first abnormal entity data in the contextual information of the original corpus, a semantic interval threshold corresponding to the first abnormal entity data is set. Calculate the distance between entity data point P and the cluster center of its cluster category, and calculate the average density of entity data point P and entity data point O. If the distance is less than the semantic interval threshold and the average density is greater than the density threshold, then the first abnormal entity data is determined to be normal data. Otherwise, the first abnormal entity data is determined to be abnormal data.

[0013] According to another aspect of this application, a data annotation entity anomaly detection device is provided, the device comprising: The entity extraction module is used to extract entities from the labeled data based on the Hidden Markov Model. The first judgment module is used to input the extracted entity data into the entity data content anomaly detection model built based on the univariate Gaussian prediction function, and to determine whether the input entity data is abnormal data through the entity data content anomaly detection model; The second judgment module is used to determine the first abnormal entity data in the input entity data that is judged to be abnormal data, obtain the original corpus context information of the first abnormal entity data in the original corpus, and make a second judgment on whether the first abnormal entity data is abnormal data based on the original corpus context information through the entity data context anomaly detection model. The annotation module is used to identify second abnormal entity data in the first abnormal entity data that is again judged as abnormal data, and to annotate the second abnormal entity data.

[0014] Optionally, the second determination module is used for: Determine the number of clusters for the first abnormal entity data, and perform cluster analysis on the first abnormal entity data to determine the cluster category for each of the first abnormal entity data. For each of the first abnormal entity data, the density of the first abnormal entity data is calculated. Based on the density, the K-means clustering algorithm is used to iterate the abnormal entity data to the cluster corresponding to the category. The entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal based on the density and the original corpus context information.

[0015] Optionally, the second determination module is used for: The first abnormal entity data is obtained as an entity object set, and a specified number of clusters N is obtained as the number of clusters of the first abnormal entity data. N objects are randomly selected from the entity object set as initial cluster centers. Based on the similarity criterion, the first abnormal entity data is assigned to the cluster center with the highest similarity to form a class. The average vector of the entity data in each class is used as the new cluster center. The first abnormal entity data is then redistributed until the cluster center meets the preset cluster center convergence error tolerance.

[0016] Optionally, the second determination module is used for: The first abnormal entity data is determined to be entity data point P, and the K-distance of entity data point P is calculated; Calculate K-distance neighbor clustering for entity data point P based on K-distance; For each entity data point O in the K-distance neighbor cluster of the entity data point P, calculate the reachability distance between entity data point P and entity data point O; The density of the entity data point P is calculated based on the reachability distance.

[0017] Optionally, the second determination module is used for: Calculate the true distance between entity data point P and entity data point O; If the true distance is greater than or equal to the distance threshold, then the true distance is determined to be the reachable distance between entity data point P and entity data point O; If the actual distance is less than the distance threshold, then the K-distance of the entity data point O is taken as the reachable distance between the entity data point P and the entity data point O.

[0018] Optionally, the step of iterating the content-abnormal entity data to the cluster corresponding to the category using the K-means clustering algorithm based on the density includes: For each cluster category, the weight of each first abnormal entity data is determined based on the density of each first abnormal entity data in the cluster category. The vectors of each first abnormal entity data are then weighted and summed based on their respective weights to update the cluster center of the cluster category. Based on the updated cluster centers of each cluster category, the data of each of the first abnormal entities are assigned to a cluster category.

[0019] Optionally, the step of further determining whether the first abnormal entity data is abnormal based on the density using the entity data context anomaly detection model includes: By analyzing the contextual semantic coherence of the first abnormal entity data in the contextual information of the original corpus, a semantic interval threshold corresponding to the first abnormal entity data is set. Calculate the distance between entity data point P and the cluster center of its cluster category, and calculate the average density of entity data point P and entity data point O. If the distance is less than the semantic interval threshold and the average density is greater than the density threshold, then the first abnormal entity data is determined to be normal data. Otherwise, the first abnormal entity data is determined to be abnormal data.

[0020] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described data annotation entity anomaly detection method.

[0021] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described data annotation entity anomaly detection method.

[0022] By employing the above technical solutions, the present application provides a data annotation entity anomaly detection method, apparatus, storage medium, and computer equipment. It accurately extracts entities using a Hidden Markov Model; through a two-step judgment mechanism based on a univariate Gaussian prediction function and an entity data context anomaly detection model, it combines content and contextual information to improve anomaly detection accuracy and reduce false positives and false negatives; finally, it annotates truly anomalous entities, providing high-quality data for subsequent data analysis and model training, improving model performance, adapting to data scenarios of varying complexity, and enhancing data processing reliability.

[0023] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0024] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 A flowchart illustrating a data annotation entity anomaly detection method provided in an embodiment of this application is shown. Figure 2 A flowchart illustrating another data annotation entity anomaly detection method provided in an embodiment of this application is shown. Figure 3 A flowchart illustrating another data annotation entity anomaly detection method provided in an embodiment of this application is shown. Figure 4 A schematic diagram of the structure of a data annotation entity anomaly detection device provided in an embodiment of this application is shown. Detailed Implementation

[0025] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0026] This embodiment provides a method for detecting anomalies in data-annotated entities, such as... Figure 1 As shown, the method includes: Step 101: Extract entities from the labeled data based on the Hidden Markov Model (HMM); Step 102: Input the extracted entity data into the entity data content anomaly detection model constructed based on the univariate Gaussian prediction function, and use the entity data content anomaly detection model to determine whether the input entity data is abnormal data; Step 103: Determine the first abnormal entity data that is judged to be abnormal data in the input entity data, and obtain the original corpus context information of the first abnormal entity data in the original corpus; Step 104: Based on the context information of the original corpus, the entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal data. Step 105: Determine the second abnormal entity data in the first abnormal entity data that is again judged as abnormal data, and mark the second abnormal entity data.

[0027] In this embodiment, entities are first extracted from the data to be labeled using a Hidden Markov Model (HMM). The Hidden Markov Model (HMM) is applied to entity data extraction during the data labeling process. An HMM is a directed graphical probabilistic model that contains a hidden sequence of states and an observable sequence of observations. Each state represents an observable event, and the observed event is a random function of the states. The structure of the HMM model is as follows: Figure 2 As shown, each circle represents a random variable, where xt is the hidden state at time t, and yt is the observed value at time t. The arrows in the diagram indicate conditional dependencies. The Hidden Markov Model (HMM) has two fundamental assumptions: 1. The state at any time t depends only on the state at the previous time and is independent of other observations and states, i.e., P(xt|xt) = ... 1,xt 2,...,x1,yt 1,yt 2,...,y1)=P(xt|xt 1); 2. An observation at any given time depends only on the state of the Markov chain at that time, and is independent of other observations and states, i.e., P(yt|xt,xt) 1,xt 2,...,x1,yt 1,yt 2,...,y1)=P(yt|xt). When applied to entity recognition problems, the state in the HMM model corresponds to the labeling of words. The labeling problem can be regarded as performing sequence labeling on a given observation sequence.

[0028] Secondly, the extracted entity data is input into an entity data content anomaly detection model built based on a univariate Gaussian prediction function. This model determines whether the input entity data is anomalous based on its content characteristics, completing preliminary anomaly screening. In this step, a content anomaly detection model is constructed based on the extracted entity data using a univariate Gaussian prediction function. By constructing this entity content anomaly detection model, content anomalies are detected in the extracted entity data. The entity data content anomaly detection algorithm in the model processes each new entity data input to the central database in real time, enabling rapid processing, prediction, and classification. It can be applied to entity data content anomaly detection during the processing of large volumes of high-speed data annotation.

[0029] The algorithm for detecting anomalies in entity data content is as follows: #include <iostream> #include <vector> #include <cmath> #include <algorithm> using namesPace std; / / Assuming these functions have already been implemented bOOl UnivariateGaussianPredictOr(cOnst vectOr <double>&COllectingDataValue, vectOr <double>&cOntent); bOOl IsAnOmalOus(cOnst vectOr <double>&cOntent); bOOl IsRandOmCOntextChecK(cOnst vectOr <double>&cOntent); vectOr <double>GetCOllectingDataValuePrOfile(cOnst vectOr <double>&COllectingDataValue); bOOl MultivariateGaussianPredictOr(cOnst vectOr <double>&COllectingDataValue, cOnst vectOr <double>&PrOfile, vectOr <double>&cOntext); bOOl AnOmalyDetectiOn(cOnst vectOr <double>&COllectingDataValue) { vectOr <double>cOntent; / / Univariate Gaussian prediction if (!UnivariateGaussianPredictOr(COllectingDataValue, cOntent)) { return false; / / Prediction failed or an exception occurred } / / Check for anomalies or randomness if (IsAnOmalOus(cOntent) || IsRandOmCOntextChecK(cOntent)) { vectOr <double>PrOfile = GetCOllectingDataValuePrOfile(COllectingDataValue); vectOr <double>cOntext; / / Multivariate Gaussian Prediction if (MultivariateGaussianPredictOr(COllectingDataValue, PrOfile,cOntext)) { return IsAnOmalOus(cOntext); } } return false; } int main() { / / Example usage vectOr <double>inPutData = {1.0, 2.0, 3.0}; / / Example input data bOOl result = AnOmalyDetectiOn(inPutData); The above entity data content detection algorithm is used to perform content detection on the input entity data. Entities that are judged to have abnormal content are output and entity context anomaly detection is performed.

[0030] Next, the first anomalous entity data identified in the initial assessment is determined, and the original corpus context information of these first anomalous entity data is obtained. Context information is crucial for accurately determining whether an entity is anomalous, as the behavior of an entity in a specific context can influence whether it is considered anomalous. Furthermore, using an entity data context anomaly detection model, the first anomalous entity data is reassessed based on the obtained original corpus context information. This step, by combining context, provides a more comprehensive and accurate assessment of entity anomalousness. Finally, the second anomalous entity data that remains anomalous in the reassessment is identified, and these second anomalous entity data are labeled. Labeling clearly identifies anomalous entities in the data, facilitating subsequent data processing and analysis.

[0031] By applying the technical solution of this embodiment, entities are accurately extracted using a Hidden Markov Model; a two-step judgment mechanism based on a univariate Gaussian prediction function and an entity data context anomaly detection model is used, combining content and context information to improve the accuracy of anomaly detection and reduce false positives and false negatives; finally, the truly abnormal entities are labeled, which can provide high-quality data for subsequent data analysis and model training, improve model performance, adapt to data scenarios of different complexities, and enhance the reliability of data processing.

[0032] Optionally, in this embodiment of the application, the step of re-determining whether the first abnormal entity data is abnormal based on the original corpus context information using the entity data context anomaly detection model includes: determining the number of clusters of the first abnormal entity data, performing cluster analysis on the first abnormal entity data, and determining the cluster category of each first abnormal entity data; for each first abnormal entity data, calculating the density of the first abnormal entity data, iterating the content abnormal entity data to the cluster corresponding to the category using the K-means clustering algorithm based on the density, and re-determining whether the first abnormal entity data is abnormal based on the density and the original corpus context information using the entity data context anomaly detection model.

[0033] In this embodiment, the number of clusters for the first abnormal entity data is first determined. Then, cluster analysis is used to determine the cluster category for each first abnormal entity data. This process helps to initially classify abnormal entity data with similar characteristics. Next, the density of each first abnormal entity data is calculated. The density reflects the concentration of data in a specific space and can reflect the distribution characteristics of the data. Based on the calculated density, the K-means clustering algorithm is used to iteratively assign the content abnormal entity data to the corresponding cluster, so that the data achieves a more reasonable distribution within the clusters. Finally, the entity data context anomaly detection model combines the density and the original corpus context information to re-determine whether the first abnormal entity data is abnormal. In this way, the position of the abnormal entity data in the overall data distribution and its relationship with the surrounding context can be considered more meticulously, avoiding the bias that may be caused by a single judgment criterion. Its beneficial effects are that, by using cluster analysis and density calculation, combined with contextual information, the first abnormal entity data can be comprehensively evaluated from multiple dimensions, which improves the accuracy of anomaly judgment, reduces misjudgments caused by data distribution characteristics or contextual factors, and makes the finally identified abnormal entity data more accurate and reliable, providing a high-quality foundation for subsequent data annotation work.

[0034] Optionally, in this embodiment, determining the number of clusters of the first abnormal entity data and performing cluster analysis on the first abnormal entity data to determine the cluster category of each of the first abnormal entity data includes: obtaining the first abnormal entity data as an entity object set, obtaining a specified number of clusters N as the number of clusters of the first abnormal entity data, randomly selecting N objects in the entity object set as initial cluster centers; assigning the first abnormal entity data to the cluster center with the highest similarity according to the similarity criterion to form a class, using the average vector of the entity data in each class as the new cluster center, reallocating the first abnormal entity data, and returning to the point where the cluster center meets the preset cluster center convergence error tolerance.

[0035] In this embodiment, the first abnormal entity data is first used as the entity object set, and the number of clusters N is specified as the number of clusters. Then, N initial cluster centers are randomly selected from the object set. Next, each entity data is assigned to the most similar cluster center to form an initial cluster according to the similarity criterion. The average vector of each type of entity data is calculated as the new cluster center. The data allocation and center update steps are repeated until the cluster centers meet the preset convergence error tolerance.

[0036] Optionally, in this embodiment, calculating the density of the first abnormal entity data includes: determining that the first abnormal entity data is an entity data point P, and calculating the K-distance of the entity data point P; calculating the K-distance neighbor cluster of the entity data point P based on the K-distance of the entity data point P; calculating the reachability distance between the entity data point P and the entity data point O for each entity data point O in the K-distance neighbor cluster of the entity data point P; and calculating the density of the entity data point P based on the reachability distance.

[0037] In this embodiment, the calculation logic for the density of the first anomalous entity data is described in detail, specifically through the following steps: First, the first anomalous entity data is considered as entity data point P, and its K-distance is calculated to determine the local neighborhood range; then, based on the K-distance, a K-distance neighbor cluster of P is obtained, which is the set of all data points within the K-distance; for each entity data point O in this neighborhood, the reachable distance between P and O is calculated. This distance is usually defined as the larger of the K-distance of P and the actual distance from O to P, thus reflecting the relative density between data points; finally, the density of P is calculated based on all reachable distances. The higher the density value, the denser the data points in the area where P is located. This calculation method provides a key basis for anomaly judgment by quantifying the distribution density of data points in the local space—data points in high-density areas are more likely to belong to the normal pattern, while data points in low-density areas may be anomalous. Its core beneficial effect lies in the fact that by accurately characterizing the local density features of data points, combined with preceding clustering analysis and contextual information, a three-dimensional judgment dimension from global distribution to local features is formed. This not only improves the precision of anomaly detection, but also effectively identifies hidden anomalies caused by uneven data distribution or contextual dependence, avoiding the limitations of single-indicator judgment. Ultimately, it makes the judgment of anomalous entity data more in line with the actual data characteristics, providing more reliable anomalous data samples for subsequent annotation, while enhancing the adaptability of the anomaly detection model to complex data scenarios.

[0038] In this embodiment of the application, optionally, calculating the reachability distance between entity data point P and entity data point O includes: calculating the true distance between entity data point P and entity data point O; if the true distance is greater than or equal to a distance threshold, then determining the true distance as the reachability distance between entity data point P and entity data point O; if the true distance is less than the distance threshold, then using the K-distance of entity data point O as the reachability distance between entity data point P and entity data point O.

[0039] In this embodiment, the first anomalous entity data is first treated as entity data point P, and its K-distance is calculated to determine its local neighborhood range. Then, based on the K-distance, a K-distance neighbor cluster of P is obtained, which is the set of all data points within the K-distance range. For each entity data point O within this neighborhood, the reachability distance between P and O is calculated to reflect the relative density between data points. Finally, the density of P is calculated based on all reachability distances; a higher density value indicates a denser data point area in which P is located. This calculation method provides a key basis for anomaly judgment by quantifying the distribution density of data points in local space. For example, data points in high-density areas are more likely to belong to the normal pattern, while data points in low-density areas may be anomalous. The beneficial effect is that by accurately characterizing the local density features of data points and combining cluster analysis and contextual information, a three-dimensional judgment dimension from global distribution to local features is formed. This not only improves the precision of anomaly detection, but also effectively identifies hidden anomalies caused by uneven data distribution or contextual dependence, avoiding the limitations of single-indicator judgment. Ultimately, it makes the judgment of anomalous entity data more in line with the actual data characteristics, provides more reliable anomalous data samples for subsequent annotation, and enhances the adaptability of the anomaly detection model to complex data scenarios.

[0040] For example, the K-distance of data point P in the abnormal entity data is calculated. The K-distance of P can also be called K-distance, where K is any natural number. The K-distance of data point P is defined as the Kth nearest neighbor of data point P. The distance is ) . It needs to satisfy the following two conditions at the same time: (1) There are at least K elements satisfy (2) There are at most K-1 elements satisfy The K-distance neighbor clustering of entity data point P is calculated based on the K-distance of entity data point P. Neighbor clustering, also known as neighbor grouping, is the set of all entity elements in the K-distance neighbor group of entity data point P. Specifically, calculating the reachability distance between entity data point P and entity data point O includes: calculating the true distance between entity data point P and entity data point O; if the true distance is greater than or equal to a distance threshold, then the true distance is determined as the reachability distance between entity data point P and entity data point O; if the true distance is less than the distance threshold, then the K-distance of entity data point O is used as the reachability distance between entity data point P and entity data point O. Taking K=5 as an example... Figure 3 As shown, if a data point O is relatively far away, for example... Figure 3 In Then the reachable distance between the two is the true distance between them. However, if an entity data point is close enough to O, for example... Figure 3 In Therefore, the reachable distance between the two is the K-distance of O, which can reduce the number of entity data points near O. The fluctuations can be smoothed by adjusting K, which involves calculating the K-distance, the K-distance neighbor cluster, and the reachable distance. The reachability density of entity data point P is calculated as the reciprocal of the average reachable distance between entity data point P and all entity data points O.

[0041] Optionally, in this embodiment, the step of iterating the abnormal entity data into the cluster corresponding to the category using the K-means clustering algorithm based on the density includes: for each cluster category, determining the weight of each of the first abnormal entity data based on the density of each of the first abnormal entity data in the cluster category; performing a weighted summation on the vectors of each of the first abnormal entity data based on the weights of each of the first abnormal entity data to update the cluster center of the cluster category; and assigning each of the first abnormal entity data to the cluster category based on the updated cluster centers of each cluster category.

[0042] In this embodiment, the K-means clustering process is optimized through density weighting. Specifically, for each cluster category, weights are first assigned based on the density of the first outlier data within each category. Then, the cluster center vector is updated through weighted summation. Finally, data is redistributed based on the new centers. The core innovation of this mechanism lies in transforming density into a weighting factor—data points with high density are more likely to represent typical category characteristics and therefore receive higher weights, exerting a greater influence during cluster center updates. This makes the center positions closer to dense data areas, thereby more accurately characterizing the distribution of category features. Its beneficial effects are reflected in multi-dimensional performance improvements: First, by adjusting the weights, it avoids the shortcomings of traditional K-means, such as sensitivity to initial centers and susceptibility to local optima, making cluster centers more closely match the actual data distribution and significantly improving clustering accuracy. Second, the synergistic effect of density weights and contextual information forms a three-dimensional judgment dimension from global distribution to local density, which not only enhances the reliability of anomaly detection but also effectively identifies hidden anomalies caused by uneven data distribution or contextual dependence. Finally, the weight mechanism reduces the interference of noise points and outliers on the clustering process, improves the model's adaptability and robustness to complex data scenarios, ensures that the judgment of anomalous entity data is more in line with actual characteristics, provides more reliable and high-quality anomalous samples for subsequent labeling, and ultimately promotes a qualitative improvement in the accuracy and effectiveness of the entire data processing process.

[0043] Optionally, in this embodiment, the step of re-determining whether the first abnormal entity data is abnormal based on the density and the original corpus context information using the entity data context anomaly detection model includes: analyzing the contextual semantic coherence of the first abnormal entity data in the original corpus context information, setting a semantic interval threshold corresponding to the first abnormal entity data; calculating the distance between entity data point P and the cluster center of its cluster category, and calculating the average density of entity data point P and entity data point O; if the distance is less than the semantic interval threshold and the average density is greater than the density threshold, then the first abnormal entity data is determined to be normal data; otherwise, the first abnormal entity data is determined to be abnormal data.

[0044] In this embodiment, the semantic coherence of the first abnormal entity data is first analyzed based on the context of the original corpus, and a semantic interval threshold is set to quantify the context fit. Specifically, semantic coherence analysis can be performed using methods well-known to those skilled in the art to generate a semantic coherence score. The preset initial semantic interval threshold is then dynamically adjusted based on the semantic coherence score to obtain the semantic coherence threshold. For example, based on a pre-defined mapping relationship between the semantic coherence score and the threshold adjustment value, the adjustment value corresponding to the semantic coherence score for the initial semantic interval threshold is determined, and the initial semantic interval threshold is adjusted to obtain the semantic interval threshold. Subsequently, the distance between entity data point P and its cluster center is calculated to assess its belonging strength in the feature space. Simultaneously, the average density of P and its neighboring points O is combined to reflect the local data distribution density. The final judgment logic employs a dual-condition constraint: if and only if the distance is less than the semantic interval threshold and the average density exceeds the preset threshold, the data is judged as normal; otherwise, the abnormal judgment is maintained. This design achieves a three-dimensional judgment from semantic, spatial distribution, and density dimensions: the semantic interval threshold ensures that anomaly judgments align with actual language usage scenarios, avoiding misjudgments caused by semantic disconnect from context; the correlation between distance metrics and cluster centers strengthens the capture of global data distribution characteristics, making judgments more consistent with the data's inherent structure; and the density average identifies hidden anomalies through local density analysis, particularly adept at handling cases where traditional methods miss detections due to uneven or marginalized data distribution. The synergistic effect of these three elements creates a complementary enhancement: semantic coherence filtering addresses the "contextuality" problem, distance metrics address the "mainstream distribution" problem, and the density average addresses the "high-confidence density region" problem, ultimately achieving accurate decision-making through logical and conditional constraints.

[0045] In a specific application scenario, entity data includes: data streams (as byte arrays) and information such as time, space, and people, as well as multimedia information such as video, images, and audio. The attributes and domain definitions of the dataset are shown in Table 1 below. The time attribute has been discretized into new segments: the time of day is discretized into three values: 0 indicates that it occurs during normal office hours, 9:00 AM to 5:00 PM; 1 indicates that it occurs during the morning work hours, 9:00 AM to 1:00 PM; and 2 indicates that it occurs during the afternoon work hours, 2:00 PM to 5:00 PM.

[0046] Table 1 Attribute and Domain Definitions

[0047] The first set of entity datasets provided by the entity database consists of 101,384 tuples, of which 85% are used for model training and 15% for data testing. The test entity dataset simulates a real-world data stream from multiple data collectors. This is achieved by using timestamps and individual data collectors to generate four test datasets. The simulated real-world environment processes the data stream of entities concurrently every 10ms. Static simulation is optimal and does not fully represent a real-world simulation, but the results are still useful for research environments. The second set of entity datasets consists of 26,943 tuples. This dataset is divided into 85% for training data and the remaining 15% for test data. This dataset includes five records of data from the data collectors, as shown in Table 2. These data collectors are distributed across different regions, with two records representing the collectors' own collection values. More contextual information can be extracted from the temporal attributes in dataset 1, as shown in Table 3.

[0048] Table 2 Dataset of the Collector

[0049] When initializing the Gaussian anomaly prediction training dataset, content information values ​​recorded in all entity databases are used. This prediction method is univariate Gaussian prediction, i.e., a content anomaly detection algorithm. To demonstrate this algorithm, the centroid distance parameter needs to be determined, followed by iterative calculations. Real-time prediction evaluation is performed on the data in the entity database using simulated data streams.

[0050] Using N=4 as an example, we perform entity data context anomaly detection on each cluster entity data.

[0051] First, anomaly detection algorithms for real-time entity data content are used to calculate and identify anomalous data. Then, it is determined whether the anomalous entity data is a genuine outlier or a false positive. If the calculation result is a false positive, it is determined not to be anomalous data. During the test simulation, 23 collected data values ​​were considered anomalous. Specifically, these 23 data values ​​were considered anomalous relative to a specific predefined threshold, meaning less than 0.01% of the values ​​were found to be anomalous.

[0052] The 23 entity data points with abnormal content were determined to be either anomalous or false positives. Semantic context anomaly detection was performed based on contextual information from the corpus data, such as the physical location of the data collector, its daytime, time of day (TOD), and other data correlation attributes. After detection, 2 out of the 23 anomalous entity data points were found to be false positives. Therefore, there were 21 truly anomalous entity data points.

[0053] Furthermore, as Figure 1 In terms of specific implementation, this application provides a data annotation entity anomaly detection device, such as... Figure 4 As shown, the device includes: The entity extraction module is used to extract entities from the labeled data based on the Hidden Markov Model. The first judgment module is used to input the extracted entity data into the entity data content anomaly detection model built based on the univariate Gaussian prediction function, and to determine whether the input entity data is abnormal data through the entity data content anomaly detection model; The second judgment module is used to determine the first abnormal entity data in the input entity data that is judged to be abnormal data, obtain the original corpus context information of the first abnormal entity data in the original corpus, and make a second judgment on whether the first abnormal entity data is abnormal data based on the original corpus context information through the entity data context anomaly detection model. The annotation module is used to identify second abnormal entity data in the first abnormal entity data that is again judged as abnormal data, and to annotate the second abnormal entity data.

[0054] Optionally, the second determination module is used for: Determine the number of clusters for the first abnormal entity data, and perform cluster analysis on the first abnormal entity data to determine the cluster category for each of the first abnormal entity data. For each of the first abnormal entity data, the density of the first abnormal entity data is calculated. Based on the density, the K-means clustering algorithm is used to iterate the abnormal entity data to the cluster corresponding to the category. The entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal based on the density and the original corpus context information.

[0055] Optionally, the second determination module is used for: The first abnormal entity data is obtained as an entity object set, and a specified number of clusters N is obtained as the number of clusters of the first abnormal entity data. N objects are randomly selected from the entity object set as initial cluster centers. Based on the similarity criterion, the first abnormal entity data is assigned to the cluster center with the highest similarity to form a class. The average vector of the entity data in each class is used as the new cluster center. The first abnormal entity data is then redistributed until the cluster center meets the preset cluster center convergence error tolerance.

[0056] Optionally, the second determination module is used for: The first abnormal entity data is determined to be entity data point P, and the K-distance of entity data point P is calculated; Calculate K-distance neighbor clustering for entity data point P based on K-distance; For each entity data point O in the K-distance neighbor cluster of the entity data point P, calculate the reachability distance between entity data point P and entity data point O; The density of the entity data point P is calculated based on the reachability distance.

[0057] Optionally, the second determination module is used for: Calculate the true distance between entity data point P and entity data point O; If the true distance is greater than or equal to the distance threshold, then the true distance is determined to be the reachable distance between entity data point P and entity data point O; If the actual distance is less than the distance threshold, then the K-distance of the entity data point O is taken as the reachable distance between the entity data point P and the entity data point O.

[0058] Optionally, the step of iterating the content-abnormal entity data to the cluster corresponding to the category using the K-means clustering algorithm based on the density includes: For each cluster category, the weight of each first abnormal entity data is determined based on the density of each first abnormal entity data in the cluster category. The vectors of each first abnormal entity data are then weighted and summed based on their respective weights to update the cluster center of the cluster category. Based on the updated cluster centers of each cluster category, the data of each of the first abnormal entities are assigned to a cluster category.

[0059] Optionally, the step of further determining whether the first abnormal entity data is abnormal based on the density using the entity data context anomaly detection model includes: By analyzing the contextual semantic coherence of the first abnormal entity data in the contextual information of the original corpus, a semantic interval threshold corresponding to the first abnormal entity data is set. Calculate the distance between entity data point P and the cluster center of its cluster category, and calculate the average density of entity data point P and entity data point O. If the distance is less than the semantic interval threshold and the average density is greater than the density threshold, then the first abnormal entity data is determined to be normal data. Otherwise, the first abnormal entity data is determined to be abnormal data.

[0060] It should be noted that other corresponding descriptions of the functional units involved in the data annotation entity anomaly detection device provided in this application embodiment can be found in the following references. Figures 1 to 3 The corresponding descriptions in the method will not be repeated here.

[0061] This application also provides a computer device, specifically a personal computer, server, network device, etc. The computer device includes a bus, processor, memory, and communication interface, and may also include input / output interfaces and a display device. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores location information. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0062] Those skilled in the art will understand that the structure of the computer device described above is only a partial structure related to the solution of this application, and does not constitute a limitation on the computer device to which the solution of this application is applied. A specific computer device may include more or fewer components, or combine certain components, or have different component arrangements.

[0063] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0064] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0065] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0066] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, graphics processors, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0067] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0068] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.< / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / double> < / algorithm> < / cmath> < / vector> < / iostream>

Claims

1. A method for detecting entity anomalies in data annotation, characterized in that, The method includes: Entity extraction is performed on the labeled data based on Hidden Markov Model (HMM). The extracted entity data is input into an entity data content anomaly detection model built based on a univariate Gaussian prediction function. The entity data content anomaly detection model is used to determine whether the input entity data is abnormal. Identify the first abnormal entity data that is judged to be abnormal data in the input entity data, and obtain the original corpus context information of the first abnormal entity data in the original corpus; The entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal based on the context information of the original corpus; Identify a second abnormal entity data in the first abnormal entity data that is again determined to be abnormal data, and label the second abnormal entity data.

2. The method according to claim 1, characterized in that, The step of using an entity data context anomaly detection model to re-determine whether the first anomalous entity data is anomalous based on the context information of the original corpus includes: Determine the number of clusters for the first abnormal entity data, and perform cluster analysis on the first abnormal entity data to determine the cluster category for each of the first abnormal entity data. For each of the first abnormal entity data, the density of the first abnormal entity data is calculated. Based on the density, the K-means clustering algorithm is used to iterate the abnormal entity data to the cluster corresponding to the category. The entity data context anomaly detection model is used to re-determine whether the first abnormal entity data is abnormal based on the density and the original corpus context information.

3. The method according to claim 2, characterized in that, The step of determining the number of clusters for the first abnormal entity data and performing cluster analysis on the first abnormal entity data to determine the cluster category for each of the first abnormal entity data includes: The first abnormal entity data is obtained as an entity object set, and a specified number of clusters N is obtained as the number of clusters of the first abnormal entity data. N objects are randomly selected from the entity object set as initial cluster centers. Based on the similarity criterion, the first abnormal entity data is assigned to the cluster center with the highest similarity to form a class. The average vector of the entity data in each class is used as the new cluster center. The first abnormal entity data is then redistributed until the cluster center meets the preset cluster center convergence error tolerance.

4. The method according to claim 3, characterized in that, The calculation of the density of the first abnormal entity data includes: The first abnormal entity data is determined to be entity data point P, and the K-distance of entity data point P is calculated; Calculate K-distance neighbor clustering for entity data point P based on K-distance; For each entity data point O in the K-distance neighbor cluster of the entity data point P, calculate the reachability distance between entity data point P and entity data point O; The density of the entity data point P is calculated based on the reachability distance.

5. The method according to claim 4, characterized in that, The calculation of the reachability distance between entity data point P and entity data point O includes: Calculate the true distance between entity data point P and entity data point O; If the true distance is greater than or equal to the distance threshold, then the true distance is determined to be the reachable distance between entity data point P and entity data point O; If the actual distance is less than the distance threshold, then the K-distance of the entity data point O is taken as the reachable distance between the entity data point P and the entity data point O.

6. The method according to claim 5, characterized in that, The step of iterating the abnormal content entity data to the corresponding cluster based on the density using the K-means clustering algorithm includes: For each cluster category, the weight of each first abnormal entity data is determined based on the density of each first abnormal entity data in the cluster category. The vectors of each first abnormal entity data are then weighted and summed based on their respective weights to update the cluster center of the cluster category. Based on the updated cluster centers of each cluster category, the data of each of the first abnormal entities are assigned to a cluster category.

7. The method according to claim 6, characterized in that, The step of further determining whether the first abnormal entity data is abnormal based on the density and the original corpus context information using the entity data context anomaly detection model includes: By analyzing the contextual semantic coherence of the first abnormal entity data in the contextual information of the original corpus, a semantic interval threshold corresponding to the first abnormal entity data is set. Calculate the distance between entity data point P and the cluster center of its cluster category, and calculate the average density of entity data point P and entity data point O. If the distance is less than the semantic interval threshold and the average density is greater than the density threshold, then the first abnormal entity data is determined to be normal data. Otherwise, the first abnormal entity data is determined to be abnormal data.

8. A data annotation entity anomaly detection device, characterized in that, The device includes: The entity extraction module is used to extract entities from the labeled data based on the Hidden Markov Model. The first judgment module is used to input the extracted entity data into the entity data content anomaly detection model built based on the univariate Gaussian prediction function, and to determine whether the input entity data is abnormal data through the entity data content anomaly detection model; The second judgment module is used to determine the first abnormal entity data in the input entity data that is judged to be abnormal data, obtain the original corpus context information of the first abnormal entity data in the original corpus, and make a second judgment on whether the first abnormal entity data is abnormal data based on the original corpus context information through the entity data context anomaly detection model. The annotation module is used to identify second abnormal entity data in the first abnormal entity data that is again judged as abnormal data, and to annotate the second abnormal entity data.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images