An outlier detection method, device, and medium based on a sphere model

Abstract

This disclosure presents an outlier detection method, device, and medium based on a sphere model. First, unlabeled business data is cleaned and normalized, representing it as spheres. Then, an initial set of spheres is adaptively generated through conditional recursive splitting based on weighted sphere density. Next, spheres affected by outliers are identified and split a second time using a radius criterion. Then, a sphere quality evaluation function is designed, calculating a quality score based on the proportion of samples within each sphere and the distance from the sphere's center to the origin, and sorting the scores. Finally, samples within low-quality spheres are selected as outliers, and key parameters can be optimized based on feedback. This disclosure achieves unsupervised, high-efficiency anomaly detection, is insensitive to changes in data dimensionality, can adaptively fit complex distributions, and is suitable for real-time anomaly detection in scenarios such as cloud computing.

Description

Technical Field

[0001] The application generally relates to the field of data processing technology, and in particular to an outlier detection method, device and medium based on a particle-sphere model. Background Technology

[0002] In current cloud computing services, service providers commonly employ resource overprovisioning strategies to maximize resource utilization. This means that the total amount of virtual resources allocated by the virtualization platform often exceeds the actual physical resources of the underlying physical servers. Under normal user behavior and reasonable resource consumption, the system can maintain stable operation through scheduling. However, if individual users maliciously or abnormally consume excessive resources—for example, by running cryptocurrency programs, launching denial-of-service attacks, or performing large-scale data scraping—it will severely crowd out the resources of other legitimate users, leading to a decline in overall service performance or even service interruption. These users are typically referred to as aberrant tenants or aberrant cloud users.

[0003] Therefore, automatically and accurately identifying these abnormal users from massive amounts of user behavior data is crucial for ensuring the service quality, security, and fairness of cloud platforms. Current technical solutions mainly involve monitoring users across multiple dimensions (such as CPU, memory, network traffic, disk I / O, etc.) and applying anomaly detection algorithms to analyze these time-series or statistical data to identify outliers whose behavioral patterns significantly deviate from the mainstream group.

[0004] Existing anomaly detection technologies each have their own characteristics, but when dealing with the specific scenario of cloud environments, they all reveal some inherent limitations: Statistical analysis-based methods require pre-assuming that user behavior data follows a certain theoretical distribution (such as a Gaussian distribution), and classifying data points that do not conform to this distribution as anomalies. This method may be effective quickly in simple scenarios, but cloud user behavior is complex and variable, and it is difficult to accurately describe it with a single distribution. This leads to invalid model assumptions, unreliable detection results, and a sharp increase in computational cost as the data dimensionality increases.

[0005] Distance- or proximity-based methods (such as the K-nearest neighbors algorithm) assume that outliers are far from most other points. While they do not rely on distribution assumptions, they require calculating the pairwise distances between all data points, resulting in enormous computational costs and low efficiency when processing massive amounts of high-dimensional cloud data. Furthermore, setting appropriate key parameters such as the "proximity range" or "K value" is itself a challenge; improper parameter settings can severely impact detection performance.

[0006] Density-based methods (such as the LOF algorithm) identify anomalies by comparing the density of local regions of data points, thus discovering local outliers. However, their performance is also extremely sensitive to the choice of neighborhood size, and in high-dimensional spaces, data sparsity leads to unstable density calculations and the curse of dimensionality becomes prominent, significantly reducing both the algorithm's effectiveness and efficiency.

[0007] Clustering-based methods (such as K-means and DBSCAN) first group the data, then consider small clusters or points far from the cluster center as anomalies. This is an intuitive technical approach and belongs to unsupervised learning, requiring no pre-labeled data. However, its core problem is that the effectiveness of anomaly detection depends entirely on the quality of the initial clustering results. Traditional clustering algorithms often struggle to achieve high-quality clustering when dealing with high-dimensional, non-linearly distributed cloud user data, and their computational complexity increases significantly with increasing dimensionality.

[0008] Classification-based methods (such as those using support vector machines or neural networks) attempt to distinguish between normal and abnormal data through supervised learning. These methods can theoretically perform well, but they require a large amount of accurately labeled training data. In abnormal user detection scenarios, abnormal samples are extremely scarce, manual labeling is costly, and it can lead to a severe imbalance in the ratio of positive to negative samples in the training data, making it difficult for the classification model to learn effectively and prone to biased predictions.

[0009] In summary, in cloud computing scenarios that require processing high-dimensional, unlabeled, and massive amounts of data while balancing efficiency and accuracy, existing anomaly detection technologies all face significant challenges: they either rely on unrealistic assumptions, have excessively high computational costs and difficulty in setting parameters, or are hampered by the difficulty of data labeling. Therefore, there is an urgent need for a novel anomaly detection scheme that can adapt to data distribution, is computationally efficient, requires no prior labels, and effectively handles high-dimensional characteristics. Summary of the Invention

[0010] This disclosure addresses some of the shortcomings mentioned in the background art by providing an outlier detection method, device, and medium based on a particle-sphere model.

[0011] In a first aspect, embodiments of this disclosure provide an outlier detection method based on a particle-sphere model, comprising the following steps: S1. Collect sample data of the target scene and preprocess the sample data to obtain a standardized dataset; S2. Initialize the dataset into initial spheres, and based on preset sphere splitting rules, adaptively split the initial spheres and their resulting sub-spheres until all spheres no longer meet the splitting conditions, forming the first set of spheres; wherein, a single sphere is characterized by its center coordinates and radius; S3. Calculate the statistical characteristic value of the radius of all spheres in the first sphere set, traverse the spheres in the first sphere set, and if the radius of the current sphere exceeds the threshold determined based on the radius statistical characteristics, perform the adaptive split in step S2 on the current sphere to generate the second sphere set. S4. Calculate a quality score for each sphere in the second set of spheres, wherein the quality score is positively correlated with the number of samples contained in the corresponding sphere and negatively correlated with the feature value reflecting the center position of the sphere. S5. Sort all the balls in the second ball set according to the quality score, and determine the sample points contained in the balls whose quality scores meet the preset conditions in the sorting results as outliers.

[0012] In one embodiment of the first aspect, step S1, which involves preprocessing the sample data to obtain a normalized dataset, further includes: Missing values ​​in the dataset are filled in, and all feature dimensions of the dataset are standardized or normalized to ensure that the data values ​​fall within a uniform numerical range.

[0013] In one embodiment of the first aspect, step S2 further includes, For any granule to be split, select the two sample points that are furthest apart inside it as the initial centroids; Based on the initial centroid, the sample points within the target particle sphere are divided into two sub-clusters through iterative clustering, and each sub-particle sphere is formed. Calculate the internal density indices of the target particle and the two sub-particles respectively; Based on the density indices of the two sub-particles and their sample size, the weighted density index of the target particle is calculated. If the weighted density index is greater than the internal density index of the target granule, then splitting is confirmed; otherwise, splitting does not occur.

[0014] In one embodiment of the first aspect, the step of performing the splitting operation in step S2 on the current sphere to generate a second set of spheres if the radius of the current sphere exceeds a threshold determined based on radius statistical features further includes, The radius statistics include the mean and / or median of all sphere radii; The threshold is a predetermined multiple of the maximum value among the average and the median; For any sphere in the sphere set whose radius exceeds the threshold, perform the adaptive splitting operation in step S2.

[0015] In one embodiment of the first aspect, step S4 is the step of calculating a quality score for each ball in the second set of balls, and further includes introducing an adjustable parameter value in the calculation of the quality score. The adjustable parameter value is dynamically adjusted according to the feedback information of historical detection results through an optimization algorithm so that the outlier detection model fits the data distribution.

[0016] In one embodiment of the first aspect, step S5 further includes: setting a preset quality score threshold, determining particles in the second particle set whose quality score is lower than the quality score threshold as low-quality particles, and outputting their sample points as outliers.

[0017] In one embodiment of the first aspect, step S5 further includes identifying sample points within the top predetermined ranks of the quality evaluation values ​​as outliers. All particles in the second particle set are sorted from low to high according to their quality scores, and the particles at the top of the sort are identified as low-quality particles, with their sample points output as outliers.

[0018] In one embodiment of the first aspect, the method is applied to a scenario of detecting abnormal cloud users in a cloud computing environment, wherein the sample data is multidimensional resource consumption index data of cloud users.

[0019] In a second aspect, embodiments of this disclosure provide an electronic device including a memory and a processor, wherein the memory stores a program that runs on the processor, and the processor executes an outlier detection method based on a particle-sphere model as described in the first aspect when running the program.

[0020] In a third aspect, embodiments of this disclosure provide a computer-readable storage medium having computer instructions stored thereon, which, when executed, perform an outlier detection method based on a particle-sphere model as described in the first aspect.

[0021] This disclosure proposes an outlier detection method, device, and medium based on a granular model, which has the following beneficial effects: (1) Achieved efficient and scalable unsupervised anomaly detection: The unsupervised clustering detection method disclosed in this paper does not require labeled training data or strong prior assumptions about the data distribution, and has wide applicability. Its core lies in using the simple geometric model of spheres to represent and divide the data. The time complexity of the sphere generation process is low, and most importantly, its core calculations (such as center and radius) are not affected by the increase of data dimensionality, effectively overcoming the curse of dimensionality problem, so that the computational complexity does not increase significantly with the increase of data dimensionality, which is particularly suitable for processing high-dimensional, massive cloud environment monitoring data.

[0022] (2) The accuracy and robustness of anomaly detection are improved through an innovative splitting strategy: This disclosure adopts a splitting method based on weighted sphere density, which can adaptively generate spheres that fit the natural distribution of data. More importantly, a secondary splitting criterion based on global radius statistics is introduced, which can actively identify and disassemble spheres whose radii are abnormally inflated due to enclosing a few outliers. This dual splitting mechanism ensures that outliers can be effectively separated from the normal data cluster and form independent small spheres, thereby significantly improving the probability of accurate detection of outliers and reducing false positives and false negatives.

[0023] (3) An interpretable and customizable anomaly screening mechanism is provided: This disclosure designs an intuitive particle quality evaluation function, which transforms the anomaly detection problem into a one-dimensional ranking of particle quality by comprehensively considering the proportion of samples within the particle and the extremes of its center point (such as the distance to the origin of resource consumption). The physical meaning of this function is clear, and users can flexibly adjust the evaluation dimension according to the definition of "anomaly" in different business scenarios. This quality ranking-based screening method not only provides interpretable results, but also facilitates the optimization of the model through feedback data, enabling it to continuously adapt to business changes and ultimately achieve stable and automated anomaly screening.

[0024] In summary, this disclosure effectively solves the problems of low computational efficiency, strong parameter dependence, high annotation cost, and poor performance in high-dimensional data processing faced by existing methods in complex scenarios such as cloud computing, and provides an outlier detection solution with high accuracy, high efficiency, and strong practicality. Attached Figure Description

[0025] Figure 1 This is a flowchart of an outlier detection method based on a particle-sphere model. Figure 2 Based on the embodiments of this disclosure A schematic diagram of granulocyte splitting; Figure 3 This is a schematic diagram of outlier detection based on the particle-sphere model in an embodiment of this disclosure. Detailed Implementation

[0026] The present application / disclosure will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application / disclosure and are not intended to limit the scope of the present application / disclosure. Furthermore, it should be noted that, for ease of description, only the parts relevant to the present application / disclosure are shown in the accompanying drawings, not the entire structure.

[0027] Example 1 Figure 1 The flowchart of the outlier detection method based on the particle-sphere model of this disclosure will be referenced below. Figure 1This paper provides a detailed description of the outlier detection method based on the particle-sphere model disclosed herein.

[0028] In step 101, sample data of the target scene is collected and preprocessed to obtain a standardized dataset.

[0029] In one embodiment, the data metrics to be monitored need to be defined based on the specific application scenario of anomaly detection. For example, when detecting abnormal users in a cloud computing environment, core metrics typically cover dimensions such as computing resource utilization, storage space usage, network traffic, and disk I / O frequency. Data collection is carried out based on these preset metrics. The collected data can be real-time streaming data or average values ​​aggregated and statistically analyzed over a fixed time window (such as hourly or 24-hour periods).

[0030] In one embodiment, after data collection, preliminary targeted processing is required. Taking cloud phone scenarios as an example, since different users have different product specifications (such as CPU and memory size), their resource usage baselines also differ. Therefore, the collected raw data needs to be classified according to the user's product specifications before being sent to subsequent processes. In addition, to improve analysis efficiency and accuracy, data from known normal users (i.e., whitelisted users) and records with consistently zero or severely missing monitoring metrics should be removed from the current dataset beforehand.

[0031] In one embodiment, the collected and initially screened data may contain some missing feature values. To ensure the integrity of the dataset, missing values ​​need to be imputed. Common imputation strategies include replacing the missing values ​​with the statistical value of the feature across all valid samples, such as the mean, median, or mode. After imputation, the data needs to be scaled. Since the units and numerical ranges of different monitoring indicators vary greatly, directly calculating distance or density will produce bias. Therefore, it is necessary to normalize the values ​​of all features to a uniform range, such as [0, 1]. This step is used to eliminate the influence of units, so that the subsequent distance-based particle-sphere model can fairly process each feature dimension.

[0032] In step 102, the dataset is initialized as an initial sphere, and based on the preset sphere splitting rules, the initial sphere and its sub-spheres are adaptively split until all spheres no longer meet the splitting conditions, forming the first sphere set; wherein, a single sphere is characterized by its center coordinates and radius.

[0033] In this embodiment, the granular ball is an important model method that has developed in the field of granular computing in recent years. It is an efficient, robust, and scalable learning method. Its core idea is to use "GB (Granular Ball)" to cover or partially cover the sample space. The sphere's geometry is completely symmetrical, has the simplest mathematical model expression, and requires only two data points to represent it in any dimension: the center and the radius, where the center c = ( This represents the sample points within the sphere, where N is the number of samples in the sphere. The radius r can be expressed in two ways: the average radius r = ... And the maximum radius r = max(|| The average radius r represents the average distance from all sample points in the sphere to the center c. Using the average radius of the sphere will result in poorer coverage, but it can obtain a more uniform data distribution within the sphere and a clearer decision boundary. The maximum radius r represents the distance from the sample point farthest from the center c to the center c. The decision boundary is slightly worse, but it can completely cover all sample points in the sphere. The radius of the sphere used in this embodiment is the maximum radius.

[0034] In one embodiment, a sphere density DM is defined to measure the compactness of data within a sphere. DM is calculated by measuring the number of data points n within a sphere. i With the total radius s of the sphere i It is measured by the ratio. This method can effectively describe the distribution of data, and the calculation formula is as follows: s i = Formula 1 DM i Formula 2 The larger the DM value, the more sample points are contained within a unit distance, and the more compact and dense the spheres are.

[0035] In this embodiment, a novel sphere generation method can be constructed based on the DM index, which can be applied to unlabeled datasets. The initial splitting process is a recursive binary splitting process. First, the normalized dataset is regarded as a sphere A; then, the two points c1 and c2 in A with the greatest Euclidean distance are selected to generate two subspheres A1 and A2 from sphere A, according to k. The means algorithm generates sub-spheres, including first treating sample points c1 and c2 as k. The initial centroid of means is determined, and then iterated until the cluster assignment stabilizes, thus classifying all samples into two clusters, forming two candidate sub-spheres A1 and A2. Next, the DM values ​​of spheres A, A1, and A2 are calculated, and the results are DM... A DM A1 and DMA2 Then calculate the weighted spheroid density: DM weig t = + Formula 3 in, , , These represent the number of sample points in spheres A, A1, and A2, respectively. The weighted sphere density reflects the overall density level of the two sub-regions after splitting.

[0036] In one embodiment, the granule splits as follows: Figure 2 As shown, when DM weig t DM A If the condition is met, then split ball A into A1 and A2, and add A1 and A2 to the ball set GBL. Otherwise, stop splitting and mark A as stable and add it to the ball set GBL. Traverse the balls in GBL, treat each ball in the queue that is not marked as stable as ball A and perform step 102 on it until all balls stop splitting. This round of splitting ends, and an initial first ball set GBL is obtained.

[0037] In step 103, the statistical characteristic value of the radius of all spheres in the first sphere set is calculated. The spheres in the first sphere set are traversed. If the radius of the current sphere exceeds the threshold determined based on the radius statistical characteristics, the adaptive split in step S102 is performed on the current sphere to generate the second sphere set.

[0038] In this embodiment, as Figure 3 As shown, after step 102, the data has been initially segmented, but some particles may have abnormal radii due to the presence of a few outliers far from the main body. We need to identify sample points that differ from most of the normal data. These sample points constitute a very small proportion and often deviate from the normal data distribution, such as outliers.

[0039] In one embodiment, the median (r) and mean (r) of the radii of all spheres in the current first sphere set are calculated. These two statistics together describe the central tendency and general level of the sphere radii under the current data partition. Then, each sphere in the first sphere set is traversed sequentially, and the GB of each sphere is obtained. k radius r k , its radius r k It is compared to a dynamic threshold, defined as twice the larger of the global radius median and the mean, i.e., 2×max(mean(r),median(r)), if r kIf the value is greater than 2×max(mean(r),median(r)), then the grain radius is considered abnormal, meaning the grain size significantly deviates from the normal range of the overall grain group. This deviation is usually not caused by the mainstream distribution of the data, but is most likely caused by one or a few extreme points (i.e., potential outliers) far from the center of the grain. To remove this interference, it is necessary to perform GB analysis on this grain. k Perform further splitting.

[0040] In one embodiment, the current particle GB k Treat it as a new object to be split, and apply the weighted density-based bisection process from step 102 (i.e., iteratively partition it using its two furthest internal points as initial centroids). This process will divide GB... k It splits into two new sub-spheres GB k1 and GB k2 After splitting, the original GB spheres were... k Remove from the first set of sub-spheres GBL, and add the newly generated sub-spheres GB... k1 and GB k2 Add it to the set of the first ball, GBL.

[0041] In this embodiment, because the newly added sub-spheres GB after one split... k1 and GB k2 The radius of the first set of particles may still satisfy the splitting condition (for example, one of the sub-spheres happens to contain an extreme outlier). Therefore, it is necessary to continuously traverse and check the updated first set of particles, GBL, repeatedly performing the above calculation, comparison, and splitting operations. Finally, when the entire first set of particles has been traversed and no particle's radius satisfies the condition of being greater than 2×max(mean(r),median(r)), the iteration stops. At this point, the final optimized set of particles, the second set of particles, GBL={ B1, B2,..., B k In this set, the influence of outliers on granular structure has been minimized.

[0042] In step 104, a quality score is calculated for each sphere in the second sphere set, wherein the quality score is positively correlated with the number of samples contained in the corresponding sphere and negatively correlated with the feature value reflecting the center position of the sphere.

[0043] In one embodiment, the balls in the second ball set GBL are traversed sequentially, and the mass (quality(GB)) of each ball is calculated using the following formula: quality (GB) i )=λ Formula 4 Where n is the number of sample points in the dataset, therefore This reflects the proportion of the data point within the entire dataset; the smaller the proportion, the less common the user behavior pattern represented by that data point. ||C i ||For granules GB i center point C i Euclidean distance to the origin (i.e., the reference point where all eigenvalues ​​are 0); |GB i | represents the number of sample points in particle i; λ is a variable whose value is dynamically adjusted based on the features of the dataset and the outlier detection results.

[0044] In step 105, all the balls in the second ball set are sorted according to the quality score, and the sample points contained in the balls whose quality scores meet the preset conditions in the sorting results are identified as outliers.

[0045] In this embodiment, after calculating the quality score of each particle in the second particle set GBL, they are sorted from low to high scores to generate an ordered particle quality list GBQ. Particles that consume significant physical machine resources and deviate from the data distribution are identified; particles with lower scores are considered to have lower quality. These low-quality particles at the top of the ranking typically correspond to users with very small numbers (|GBQ). i | Value is small) and resource consumption is abnormally high (||C) i Groups with high || values, whose behavioral characteristics closely match those of abnormal cloud users, are therefore identified as key targets for investigation. This calculation and ranking transforms a complex, multi-dimensional anomaly identification problem into a problem of ranking particle quality.

[0046] In one embodiment, after obtaining the list of granular balls GBQ sorted by mass fraction, according to the sorting result of the list GBQ, starting from the granular ball with the lowest mass fraction, each sample therein (corresponding to a specific cloud user account or instance) is verified. Combining other business data such as the user's resource consumption details, operation logs, and billing records, it is manually judged whether it is a real abnormal user (such as performing illegal operations like attacks). The abnormal candidates output by the algorithm are matched and verified with the abnormal instances in the real business. Subsequently, according to the feedback results of this or multiple historical manual verifications, the model needs to be optimized, and the balance coefficient λ in Formula 4 is adjusted. The value of λ directly affects the sorting of the granular ball quality. If there are many false positives or some real abnormal users are missed among the users selected by the current model, it means that the value of λ fails to optimally fit the distribution characteristics of the current data. At this time, a dynamic optimization algorithm (such as the particle swarm optimization algorithm) can be used for automatic adjustment. The adjustment criterion is to select as many abnormal cloud users as possible, aiming to make the granular ball outlier detection model better fit the data distribution. This algorithm aims to maximize the detection effect (for example, pursuing a comprehensive index F1-Score of higher precision and recall rate), and automatically finds and determines a better value of λ through multiple iterative simulations. This process is essentially to let the model learn from the feedback of actual applications, thereby continuously enhancing its ability to describe the data distribution and identify outliers.

[0047] In one embodiment, when the model has undergone sufficient rounds of optimization and practical verification and its detection performance tends to be stable and reliable, it can enter the automated operation mode. At this time, a fixed quality threshold p can be set, and only the cloud users corresponding to the samples in the granular balls with a quality lower than p need to be selected. After analyzing the new monitoring data thereafter, for all granular balls with a mass fraction quality(GB i ) < p, the users inside will be automatically marked as abnormal users and an alarm will be triggered, without relying on manual verification of the sorted list item by item. This threshold p becomes the automated watershed for distinguishing normal from abnormal, enabling the entire anomaly detection process to run efficiently and in real time.

[0048] The present disclosure provides an outlier detection method, device, and medium based on a granular ball model, which do not require a class label training set and prior knowledge, are applicable to various types of data, and have a wide application range. Since the granular ball can represent any dimension and any number of data using the granular ball center and radius, the computational complexity of the method in this embodiment will not increase significantly as the data dimension increases. Based on the weighted granular ball density DM weig tThe generated spheres fit the data distribution well, with their Normalized Mutual Information (NMI) and Adjusted Rand Index (ARI) outperforming common clustering algorithms. This is achieved by calculating the relationship between the sphere radius and the median (r) and mean (r) of all sphere radii. k The expression >2×max(mean(r), median(r)) can more effectively split particles that are significantly affected by outliers into individual particles, thereby filtering out outliers. In summary, the method disclosed herein is effective and efficient, suitable for application in the field of anomaly detection in cloud computing environments or other related fields, enabling the rapid and efficient detection of anomaly users and preventing further losses.

[0049] In a second aspect, embodiments of this disclosure provide an electronic device including a memory and a processor, wherein the memory stores a program that runs on the processor, and the processor executes the steps of the outlier detection method based on the particle-sphere model as described in the first aspect when running the program. In a third aspect, embodiments of this disclosure provide a computer-readable storage medium having computer instructions stored thereon, which, when executed, perform the steps of the outlier detection method based on the particle-sphere model as described in the first aspect.

Claims

1. An outlier detection method based on a particle-sphere model, characterized in that, Includes the following steps: S1. Collect sample data of the target scene and preprocess the sample data to obtain a standardized dataset; S2. Initialize the dataset into initial spheres, and based on preset sphere splitting rules, adaptively split the initial spheres and their resulting sub-spheres until all spheres no longer meet the splitting conditions, forming the first set of spheres; wherein, a single sphere is characterized by its center coordinates and radius; S3. Calculate the statistical characteristic value of the radius of all spheres in the first sphere set, traverse the spheres in the first sphere set, and if the radius of the current sphere exceeds the threshold determined based on the radius statistical characteristics, perform the adaptive split in step S2 on the current sphere to generate the second sphere set. S4. Calculate a quality score for each sphere in the second set of spheres, wherein the quality score is positively correlated with the number of samples contained in the corresponding sphere and negatively correlated with the feature value reflecting the center position of the sphere. S5. Sort all the balls in the second ball set according to the quality score, and determine the sample points contained in the balls whose quality scores meet the preset conditions in the sorting results as outliers.

2. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, The step S1, which involves preprocessing the sample data to obtain a normalized dataset, further includes... Missing values ​​in the dataset are filled in, and all feature dimensions of the dataset are standardized or normalized to ensure that the data values ​​fall within a uniform numerical range.

3. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, Step S2 further includes, For any granule to be split, select the two sample points that are furthest apart inside it as the initial centroids; Based on the initial centroid, the sample points within the target particle sphere are divided into two sub-clusters through iterative clustering, and each sub-particle sphere is formed. Calculate the internal density indices of the target particle and the two sub-particles respectively; Based on the density indices of the two sub-particles and their sample size, the weighted density index of the target particle is calculated. If the weighted density index is greater than the internal density index of the target granule, then splitting is confirmed; otherwise, splitting does not occur.

4. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, The step of performing the splitting operation in step S2 on the current sphere if the radius of the current sphere exceeds a threshold determined based on radius statistical features, to generate a second set of spheres, further includes: The radius statistics include the mean and / or median of all sphere radii; The threshold is a predetermined multiple of the maximum value among the average and the median; For any sphere in the sphere set whose radius exceeds the threshold, perform the adaptive splitting operation in step S2.

5. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, Step S4 is the step of calculating a quality score for each ball in the second set of balls. It further includes introducing an adjustable parameter value into the calculation of the quality score. The adjustable parameter value is dynamically adjusted according to the feedback information of historical detection results through an optimization algorithm so that the outlier detection model fits the data distribution.

6. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, Step S5 further includes setting a preset quality score threshold, identifying particles in the second particle set whose quality score is lower than the quality score threshold as low-quality particles, and outputting their sample points as outliers.

7. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, Step S5 further includes identifying sample points within the top predetermined ranking of the quality evaluation values ​​as outliers, sorting all the particles in the second particle set according to their quality scores from low to high, identifying the top-ranked particles as low-quality particles, and outputting their sample points as outliers.

8. The outlier detection method based on the particle-sphere model according to claim 1, characterized in that, The method is applied to the detection of abnormal cloud users in a cloud computing environment, and the sample data is multi-dimensional resource consumption index data of cloud users.

9. An electronic device, characterized in that, The device includes a memory and a processor, wherein the memory stores a program that runs on the processor, and the processor executes an outlier detection method based on a particle-sphere model as described in any one of claims 1-8 when running the program.

10. A computer-readable storage medium storing computer instructions thereon, characterized in that, The computer instructions execute the outlier detection method based on the particle-sphere model as described in any one of claims 1-8.

Images