A table anomaly detection method and device for improving network platform security

Abstract

This invention discloses a method and apparatus for table anomaly detection to improve the security of network platforms. The method includes: feeding the original feature matrix into a Transformer branch, capturing global cross-column dependencies using multi-head self-attention, and injecting relative position information using rotational position encoding to output global features; using the global features output from the Transformer branch as input to a depthwise separable convolutional encoder, extracting local neighborhood features through channel-wise and point-wise convolution to obtain global-local fused features, which are then used as input to initiate parallel dual-branch operations; using the anomaly score obtained from the reconstruction error of the depthwise separable convolutional decoder through a learnable scaling layer as a soft label, calculating the mean square error with the anomaly probability obtained from the classification branch through softmax, forming a consistency regularization term; weighting and summing the reconstruction loss, classification loss, and consistency loss according to learnable weights to obtain the overall loss, and training the entire network end-to-end through gradient backpropagation; and automatically optimizing the network structure hyperparameters using Bayesian optimization to finally obtain the table data anomaly detection results.

Description

Technical Field

[0001] This invention relates to the field of data anomaly detection, and more particularly to a table anomaly detection method and apparatus based on TransDepth-CAE-Dual (a dual-branch anomaly detection algorithm combining Transformer and depthwise separable convolution) for improving the security of network platforms. Background Technology

[0002] With the advent of the big data era, tabular data is playing an increasingly important role in various industries. Tabular data not only records detailed information in business processes but also hides potential abnormal behaviors and security threats. Anomaly detection technology plays a crucial role in tabular data security. By monitoring and analyzing tabular data in real time, abnormal patterns can be quickly detected, and security threats such as fraudulent transactions and data breaches can be identified, thereby effectively preventing security incidents and ensuring data security.

[0003] However, tabular data possesses complex characteristics such as high dimensionality, nonlinearity, and dynamic changes, placing higher demands on the accuracy and generalization ability of models. Traditional anomaly detection methods, such as statistical methods and clustering-based methods, often exhibit limitations when dealing with high-dimensional, nonlinear, and dynamically changing data. For example, statistical methods rely heavily on hypotheses, and only a limited amount of statistical data for hypothesis testing can be used to detect anomalies; selecting the optimal statistical data is usually not straightforward. Clustering analysis methods are susceptible to the "curse of dimensionality" in high-dimensional data, leading to poor detection results.

[0004] In recent years, with the rapid development of deep learning technology, deep learning-based anomaly detection methods have become the mainstream methods for anomaly detection in tabular data due to their powerful feature extraction capabilities, modeling capabilities for complex nonlinear relationships, and processing capabilities for high-dimensional data. Commonly used deep learning algorithms include autoencoders, generative adversarial networks, Transformers, and convolutional neural networks.

[0005] These methods have improved the accuracy and robustness of anomaly detection to some extent, but some challenges remain, such as poor model interpretability, limited ability to capture complex patterns, and the need to improve accuracy. Summary of the Invention

[0006] This invention provides a method and apparatus for detecting table anomalies to improve the security of network platforms. This invention can effectively extract complex characteristics from table data on network platforms, such as high dimensionality, nonlinearity, and dynamic changes, effectively improving the accuracy and reliability of anomaly detection. This helps network platforms identify security threats such as fraudulent transactions and data breaches, effectively preventing security incidents and ensuring data security. See the description below for details:

[0007] Firstly, a method for detecting table anomalies to improve the security of a network platform, the method comprising:

[0008] Collect tabular data from the network platform, establish a tabular anomaly detection dataset, and perform missing value imputation, numerical normalization, and categorical variable encoding to obtain the original feature matrix;

[0009] The original feature matrix is ​​fed into the Transformer branch, where multi-head self-attention is used to capture global cross-column dependencies, and rotational position encoding is used to inject relative position information to output global features.

[0010] The global features output from the Transformer branch are used as input and fed into the depthwise separable convolutional encoder. Local neighborhood features are extracted by adding pointwise convolutions to each channel to obtain global-local fused features, which are then used as input to start the dual branches in parallel.

[0011] The anomaly score obtained by passing the reconstruction error of the depthwise separable convolutional decoder through a learnable scaling layer is used as a soft label. The mean squared error is calculated together with the anomaly probability obtained by passing the softmax layer of the classification branch to form a consistency regularization term.

[0012] The reconstruction loss, classification loss, and consistency loss are weighted and summed according to learnable weights to obtain the overall loss. The entire network is then trained end-to-end through gradient backpropagation. Bayesian optimization is used to automatically optimize the network structure hyperparameters, and finally, the results of anomaly detection in the tabular data are obtained.

[0013] The dual branches include a self-supervised branch and a supervised branch.

[0014] The self-supervised branch takes the unified fused features output by the common feature encoder as input, and uses a decoder structure composed of depthwise separable convolution and three fully connected layers to reconstruct and restore the input features dimension by dimension, with the optimization objective being to minimize the reconstruction error between the original features and the reconstructed features.

[0015] The supervised branch takes the unified fused features output by the common feature encoder as input, and constructs a classifier structure by stacking three fully connected layers and combining them with the ReLU nonlinear activation function. Under the supervision signal with known abnormal or normal labels, the network parameters are optimized with the cross-entropy loss function, so that the model learns the discrimination boundary between abnormal data and normal data, and realizes end-to-end abnormal classification output of input samples.

[0016] The consistency loss is as follows:

[0017] =

[0018]

[0019] =

[0020] In the formula, This is the reconstruction loss, where N is the number of samples and F is the number of features. It is the f-th feature of the i-th sample. It is the f-th feature of the reconstructed i-th sample. It is classification loss. It is the true label of the i-th sample. It is the classification probability of the i-th sample. It is a two-branch consistency loss; The mean error of feature reconstruction for a single sample.

[0021] A second aspect is a table anomaly detection device for improving network platform security, the device comprising: a processor and a memory, the memory storing program instructions, the processor calling the program instructions stored in the memory to cause the device to perform the method described in any of the first aspects.

[0022] Third aspect, a computer-readable storage medium storing a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of the first aspects.

[0023] The beneficial effects of the technical solution provided by this invention are:

[0024] 1. This invention addresses the issues of decision bias and insufficient collaboration in bi-branch decision-making in tabular data anomaly detection. It constructs the TransDepth-CAE-Dual framework, which integrates the global modeling of Transformer with the local extraction capabilities of the depthwise separable convolutional encoder at the common feature encoder level, forming a unified and robust feature input. Subsequently, the self-supervised reconstruction branch of the depthwise separable convolutional decoder and the fully connected supervised classification branch are deployed in parallel to achieve complementary advantages in reconstruction and discrimination. Finally, the decision logic is aligned by forcing the bi-branch consistency loss, which significantly improves the model's accuracy and stability in capturing complex anomaly patterns.

[0025] 2. The common feature encoder of this invention abandons the traditional absolute position embedding and introduces Rotated Position Encoding (RoPE). It injects relative position information into the self-attention calculation in the form of a rotation matrix, taking into account both the flexibility of sequence length and the long-distance decay characteristics, so that the model can still maintain excellent global dependency characterization ability in the scenario of variable-length table column order.

[0026] 3. The depthwise separable convolutional decoder reconstruction branch of the present invention consists of only three fully connected decoders. It achieves self-supervised memory of normal data distribution with a lightweight structure, reducing the number of parameters and training overhead, while providing highly sensitive reconstruction error for abnormal samples and improving the anomaly discrimination.

[0027] 4. The supervised classification branch of this invention adopts a simple structure of three fully connected layers + ReLU, which directly performs anomaly detection on common features and shares encoder parameters with the depthwise separable convolutional decoder branch, avoiding repeated calculations and accelerating inference.

[0028] 5. The bi-branch consistency loss proposed in this invention reconstructs the error distribution to be consistent with the classification probability distribution through mean square error constraints, which can alleviate the bias between the two task objectives without additional manual labels and enhance the branch synergy and model generalization ability.

[0029] 6. The overall framework of this invention supports end-to-end training. All hyperparameters (e.g., loss weights, learning rate, hidden layer dimensions, etc.) are automatically optimized using Bayesian optimization, reducing the cost of manual parameter tuning and quickly adapting to different business scenarios.

[0030] 7. This invention uses three indicators—accuracy, F1 score, and ROC-AUC—to comprehensively evaluate its detection accuracy on real tabular datasets. Experimental results show that its detection accuracy is superior to existing comparative algorithms. It can be widely applied in key areas such as financial fraud identification, abnormal medical case detection, and industrial quality inspection, effectively reducing security risks and economic losses.

[0031] 8. This invention is highly adaptable to the real-time detection needs of high-concurrency, streaming, and multi-source heterogeneous table data on network platforms. It can directly perform low-latency online anomaly detection on dynamic table data such as user behavior logs, business interaction records, and platform operation and maintenance data generated in real time by the network platform. It can quickly respond to security risks such as sudden abnormal traffic, malicious operations, and violations on the network platform, and greatly improve the operational security and risk handling efficiency of the network platform. Attached Figure Description

[0032] Figure 1 This is a schematic diagram illustrating a method for detecting anomalies in tabular data on a data and network platform.

[0033] Figure 2 This is a flowchart illustrating the process of detecting anomalies in table data on a web platform.

[0034] Figure 3 This is a schematic diagram of the TransDepth-CAE-Dual structure;

[0035] Figure 4 This is a schematic diagram of a depth-separable convolutional encoder.

[0036] Figure 5 This is a schematic diagram of the structure of a depth-separable convolutional decoder;

[0037] Figure 6 This is a schematic diagram of the classifier structure. Detailed Implementation

[0038] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below.

[0039] Example 1

[0040] This invention provides a table anomaly detection method based on TransDepth-CAE-Dual for improving network platform security. The method includes the following steps:

[0041] Step 101: Collect tabular data from the network platform, establish a tabular anomaly detection dataset, and perform preprocessing such as missing value imputation, numerical normalization, and categorical variable encoding to obtain the original feature matrix;

[0042] Step 102: Feed the original feature matrix into the Transformer branch, use multi-head self-attention to capture global cross-column dependencies, and use Rotation Position Encoding (RoPE) to inject relative position information and output global features;

[0043] Step 103: Take the global features output by the Transformer branch as input and feed them into the depthwise separable convolutional encoder. Further extract local neighborhood features through channel-wise + point-wise convolution to obtain global-local fused features.

[0044] Step 104: Using the global-local fusion features obtained in step 103 as input, start the dual branches in parallel;

[0045] Among them, the two branches include:

[0046] Self-supervised branch: Taking the unified fused features output by the common feature encoder as input, a decoder structure is constructed by cascading depthwise separable convolution and three fully connected layers. The input features are reconstructed and restored dimension by dimension. The optimization goal is to minimize the reconstruction error between the original features and the reconstructed features. Through unsupervised methods, the overall detection framework TransDepth-CAE-Dual learns and memorizes the potential distribution patterns of normal tabular data. At the same time, it outputs highly sensitive sample reconstruction errors to provide quantitative basis for subsequent anomaly judgment.

[0047] Supervised branch: Taking the unified fused features output by the common feature encoder as input, a classifier structure is constructed by stacking three fully connected layers and combining them with the ReLU nonlinear activation function. Under the supervision signal with known abnormal / normal labels, the network parameters are optimized with the cross-entropy loss function, enabling the model to directly learn the discrimination boundary between abnormal and normal data, and achieve end-to-end abnormal classification output of input samples. This branch shares encoder parameters with the self-supervised reconstruction branch, which improves discrimination accuracy while reducing the number of model parameters and computational redundancy.

[0048] Step 105: Calculate the bi-branch consistency loss: Use the anomaly score obtained by passing the reconstruction error of the depthwise separable convolutional decoder through the learnable scaling layer as a soft label, and calculate the mean square error with the anomaly probability obtained by passing the softmax layer through the classification branch to form a consistency regularization term to alleviate the bias between the two task objectives.

[0049] Step 106: The reconstruction loss, classification loss and consistency loss are weighted and summed according to the learnable weights to obtain the total loss. The entire network is then trained end-to-end through gradient backpropagation.

[0050] Step 107: Use Bayesian optimization to automatically optimize the network structure hyperparameters (e.g., hidden layer dimension, learning rate, loss weights, etc.) to finally obtain the table data anomaly detection results.

[0051] In summary, the embodiments of the present invention, through steps 101-107, significantly improve the accuracy and robustness of anomaly detection in tabular data without the need for additional manual feature engineering. It can be widely applied in scenarios such as financial anti-fraud, medical quality control, and industrial defect detection, effectively reducing security risks and economic losses.

[0052] Example 2

[0053] The following section, using specific examples and calculation formulas, further illustrates the scheme in Example 1. See the description below for details:

[0054] Step 201: Collect and analyze the tabular data from the online platform, establish a tabular dataset, and perform data preprocessing to obtain the raw data;

[0055] The collected data is saved in CSV file format. Python is used to preprocess outliers and missing values ​​in the original data to avoid missing values ​​affecting the prediction results. In specific implementation, this embodiment of the invention uses a dataset from Kaggle as the model input data for illustration.

[0056] The "communication protocol" feature in this dataset has 1966 missing values, which indicate that encryption technology is not used. Therefore, this invention fills these missing values ​​with 0.

[0057] Non-numerical data is converted into numerical data by using label encoding, mapping each category to a unique integer before proceeding to the next step.

[0058] The training, validation, and test sets are divided into an 8:1:1 ratio. The min-max normalization formula is then applied to these divisions.

[0059]

[0060]

[0061] In the formula, For the first input sample The maximum value of each feature, For the first input sample The minimum value of each feature. For the first input sample The normalized values ​​of each feature, where Y is the final result. To be the maximum value within a specified range, The minimum value within the specified interval.

[0062] Step 202: Use the Transformer encoder to extract long-range features from the tabular data;

[0063] The Transformer encoder comprises two core sub-modules: a multi-head self-attention mechanism and a feedforward neural network. The multi-head self-attention mechanism allows the model to focus on information features at different positions in the sequence in parallel, thereby accurately capturing multi-dimensional dependencies between elements. The feedforward neural network performs non-linear transformations on the feature vectors at each position, further enhancing the model's feature representation capabilities. For each position i in the sequence, the self-attention mechanism generates a query vector Q, a key vector K, and a value vector V. An attention score is obtained by calculating the dot product of Q and K. The relevance score, after scaling and softmax normalization, is used as a weight to sum V, yielding the output. The multi-head attention mechanism, by setting up multiple self-attention heads in parallel, allows the model to simultaneously capture dependencies across different dimensions in the sequence. Each head independently completes its attention calculation, and the outputs are concatenated and linearly transformed to obtain the final features. This design enhances both the model's representational capabilities and the efficiency of parallel computation.

[0064] The Transformer encoder used in this invention has undergone targeted improvements in the positional encoding stage: abandoning the traditional fixed-position embedding method and introducing Rotated Positional Encoding (RoPE). Traditional positional embedding encodes sequence positional information through preset position vectors, which is prone to limited generalization ability in short sequence scenarios; while RoPE transforms positional information into a rotation matrix, and incorporates the relative positional relationships of sequence elements into the attention calculation process through rotation operations, which can more accurately model the relative positional dependencies between elements and effectively improve the generalization performance of the model in short sequence tasks. When performing feature extraction based on this improved Transformer encoder, its architecture design, which integrates multi-head self-attention mechanism, feedforward neural network and RoPE, can efficiently capture long-distance dependencies between elements in the input sequence and generate feature representations containing rich contextual information.

[0065] Step 203: Take the global features output by the Transformer as input and feed them into the depthwise separable convolutional encoder. Further extract local neighborhood features through channel-wise and point-wise convolution to obtain global-local fused features.

[0066] The depthwise separable convolutional encoder is a feature extraction module built on depthwise separable convolution. Its core lies in decoupling the two-step operation of "spatial convolution - channel fusion" in standard convolution and introducing residual connections to optimize the training characteristics of deep networks. While maintaining the accuracy of local feature capture, it significantly reduces the parameter size and computational cost of the model, while improving the integrity of feature representation and training stability.

[0067] This encoder employs a dual-path structure for data processing: a main branch (depth-separable convolutional flow) and a residual branch (dimension-matching flow). The main branch handles refined local feature extraction—first, it performs independent single-channel convolution on each channel of the input data using depthwise convolution, employing a k×k small-size convolution kernel equal to the number of input channels (Cin) to capture the spatial local information of each channel. Then, batch normalization and ReLU activation introduce non-linear representations, followed by pointwise convolution (1×1 kernel) to fuse cross-channel features. This uses 1×1×Cin×Cout parameters to map features to Cout target channels, completing the core process of depth-separable convolution. Finally, batch normalization is applied again to prepare for residual fusion. The residual branch handles dimension matching and feature complementarity. It adjusts the channel dimensions of the original input features using 1×1 convolution to ensure a perfect match between the output dimensions and the main branch features. Then, it performs element-wise addition with the main branch output to achieve complementary integration of the original input features and the main branch's local features. The depth-separable convolutional encoder is described below. Figure 4 As shown.

[0068] In the TransDepth-CAE-Dual framework, this encoder works in synergy with the Transformer encoder: the Transformer encoder excels at modeling long-range global dependencies, but has limited ability to capture local fine-grained patterns; the depthwise separable convolutional encoder, on the other hand, relies on the design of depthwise separable convolution and residual connections to achieve both local feature refinement and feature integrity and training stability. The two construct a complementary mechanism of global dependency capture and local pattern enhancement, enabling the fused features to have both global contextual information and local detail representation, providing more comprehensive feature support for subsequent reconstruction error calculation and anomaly probability prediction.

[0069] Step 204: Using the fused features as input, initiate the dual branches in parallel to complete self-supervised reconstruction and supervised anomaly detection respectively, thereby achieving collaborative optimization of the dual branches;

[0070] The core of this step is to start the self-supervised reconstruction branch and the supervised classification branch in parallel based on the global-local fusion features obtained in step 203. Through the collaborative training and mutual constraints of the two branches, the detection accuracy and generalization ability of the overall detection framework for anomalies in the tabular data of the network platform are improved, while taking into account the flexibility of unsupervised learning and the accuracy of supervised learning.

[0071] (1) Specific implementation process of self-supervised reconstruction branch

[0072] The depth-separable decoder is the core module responsible for the self-supervised reconstruction branch in the TransDepth-CAE-Dual framework. Corresponding to the depth-separable encoder mentioned earlier, it achieves upsampling recovery through transposed convolution, gradually recovers the sequence dimension of features, restores the local pattern details of the input data, and finally outputs reconstructed data with the same dimension as the original input, providing a basis for the calculation of reconstruction error in subsequent anomaly detection.

[0073] The depthwise separable decoder uses a progressive structure with three transposed convolutional layers and a final activation layer to restore the feature dimensions. The reconstruction result output by this decoder is used to calculate the reconstruction error with the original input, and then combined with the anomaly probability output by the classifier to complete anomaly detection. The structure of the depthwise separable convolutional decoder is as follows: Figure 5 As shown.

[0074] (2) The specific implementation process of supervised classification branching

[0075] The core component of the supervised classification branch is a classifier consisting of three fully connected layers and a ReLU activation function (hereinafter referred to as "fully connected-ReLU classifier"). The core objective is to optimize the network parameters through the cross-entropy loss function under the supervision signal with known abnormal / normal labels, learn the discrimination boundary between abnormal and normal data, and achieve end-to-end abnormal classification output for input samples.

[0076] This classifier employs a three-layer fully connected structure with a Softmax output layer. The first fully connected layer takes a global-local fusion feature vector as input and uses ReLU as the activation function to achieve non-linear feature filtering, retaining key features related to anomaly detection (e.g., features corresponding to "abnormal login IP" and "violation type" in a network platform table). The second fully connected layer uses ReLU as the activation function to further refine the features and suppress redundant feature interference. The third fully connected layer maps the input feature dimension to 2 (adapting to binary classification tasks: normal samples and abnormal samples), and uses a sigmoid activation function to map the output to the [0,1] interval, representing the probability that a sample belongs to a certain category. If the probability value is greater than a preset threshold (preferably 0.5 in this embodiment), it is determined to be an abnormal sample; otherwise, it is a normal sample. The classifier structure is as follows: Figure 6 As shown.

[0077] Step 205: Calculate the bi-branch consistency loss: The anomaly score obtained by passing the reconstruction error of the depthwise separable convolutional decoder through a learnable scaling layer is used as a soft label. This soft label is then used to calculate the mean squared error of the anomaly probability obtained by passing the softmax layer through the classification branch. This forms a consistency regularization term to mitigate the bias between the two task objectives. The loss function is calculated as follows:

[0078] =

[0079]

[0080] =

[0081] In the formula, This is the reconstruction loss, where N is the number of samples and F is the number of features. It is the f-th feature of the i-th sample. It is the f-th feature of the reconstructed i-th sample. It is classification loss. It is the true label (0 or 1) of the i-th sample. It is the classification probability of the i-th sample. It is a two-branch consistency loss; The mean error of feature reconstruction for a single sample.

[0082] Step 206: Sum the reconstruction loss, classification loss, and consistency loss using learnable weights to obtain the overall loss. Train the entire network end-to-end using gradient backpropagation. The overall loss function is calculated as follows:

[0083]

[0084] In the formula, It is the overall loss function. , and These are the weights of the three types of losses.

[0085] Step 207: Use Bayesian optimization to automatically optimize the network structure hyperparameters (e.g., hidden layer dimension, learning rate, loss weights, etc.) to finally obtain the table data anomaly detection results.

[0086] The Bayesian optimization algorithm is used for parameter tuning to determine the optimal parameters for the model. The biggest advantage of the Bayesian hyperparameter optimization algorithm is its efficient search for optimal hyperparameter configurations. During the search, the following parameters are considered: the feature dimension of the hidden layers, the number of heads in the multi-head attention mechanism of the Transformer encoder, the learning rate, the dropout rate, and the loss weight coefficients. , and We will search for the optimal hyperparameters.

[0087] When detecting anomalies, three metrics—accuracy, F1 score, and ROC-AUC—are used to evaluate the effectiveness of the neural network framework.

[0088] in:

[0089]

[0090]

[0091]

[0092]

[0093] In the formula, ROC-AUC plots the area under the ROC curve with the false positive rate on the horizontal axis and the true positive rate on the vertical axis.

[0094] Example 3

[0095] An anomaly detection device based on TransDepth-CAE-Dual includes a processor and a memory. The memory stores program instructions, and the processor calls the program instructions stored in the memory to cause the device to execute the following method steps in Embodiment 1:

[0096] The original feature matrix is ​​fed into the Transformer branch, where multi-head self-attention is used to capture global cross-column dependencies, and Rotation Position Encoding (RoPE) is employed to inject relative position information, outputting the global features as follows:

[0097] The original feature matrix first undergoes dimensionality mapping through a feature embedding layer. Then, the embedded vectors enter a multi-head self-attention module, which calculates the attention weight matrix between different columns of features to accurately capture the global dependencies across columns in the feature matrix. To address the problem of absolute position encoding losing relative position information, a Rotated Position Encoding (RoPE) mechanism is introduced. Finally, after nonlinear transformation by a feedforward neural network, and combined with residual connections and layer normalization to eliminate the gradient vanishing problem, the final output is a global feature vector that can fully represent the global feature associations.

[0098] The global features output by the Transformer are used as input and fed into a depthwise separable convolutional encoder. Local neighborhood features are further extracted through channel-wise and point-wise convolutions to obtain the global-local fused features:

[0099] The obtained fusion features are used as input, and the two branches are started in parallel as follows:

[0100] The fused feature is simultaneously fed into two parallel and parameter-independent branch networks: one is a deep convolutional decoder branch, whose core function is to reconstruct the fused feature and calculate the reconstruction error, representing the degree of deviation of the data; the other is a classification branch, which consists of three fully connected layers, and whose core function is to perform binary classification of the fused feature as abnormal or normal. The two branches share the fused feature input, are calculated synchronously during the forward propagation process, and output the reconstructed feature and the classification prediction value, respectively.

[0101] The bi-branch consistency loss is calculated as follows:

[0102] First, the reconstruction loss (mean squared error) of the reconstruction branch is calculated to measure the difference between the reconstructed features and the input fused features, and the original reconstruction error is obtained as a soft label reflecting the degree of data anomaly. At the same time, the original output of the classification branch is normalized by the softmax function to obtain the probability value of the sample belonging to the anomaly category. The mean squared error of the two is calculated to obtain the bi-branch consistency loss.

[0103] The reconstruction loss, classification loss, and consistency loss are weighted and summed according to learnable weights to obtain the total loss:

[0104] In the formula, It is the overall loss function. , and These are the weights of the three types of losses.

[0105] It should be noted that the device descriptions in the above embodiments correspond to the method descriptions in the embodiments, and the embodiments of the present invention will not be repeated here.

[0106] The execution entities of the aforementioned processor and memory can be devices with computing functions such as computers, microcontrollers, and single-chip microcomputers. In specific implementations, the embodiments of the present invention do not limit the execution entities and can select them according to the needs of actual applications.

[0107] Data signals are transmitted between the memory and the processor via a bus, which will not be elaborated upon in this embodiment of the invention.

[0108] Based on the same inventive concept, embodiments of the present invention also provide a computer-readable storage medium, the storage medium including a stored program, which, when the program is running, controls the device where the storage medium is located to execute the method steps in the above embodiments.

[0109] The computer-readable storage medium includes, but is not limited to, flash memory, hard disk, solid-state drive, etc.

[0110] It should be noted that the description of the readable storage medium in the above embodiments corresponds to the description of the method in the embodiments, and the embodiments of the present invention will not be repeated here.

[0111] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of the present invention is generated.

[0112] A computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in or transmitted through a computer-readable storage medium. A computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be magnetic or semiconductor, etc.

[0113] Unless otherwise specified, the model numbers of the various devices in this embodiment of the invention are not limited, and any device that can perform the above functions is acceptable.

[0114] Those skilled in the art will understand that the accompanying drawings are merely schematic diagrams of a preferred embodiment, and the sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0115] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting table anomalies to improve the security of a network platform, characterized in that, The method includes: Collect tabular data from the network platform, establish a tabular anomaly detection dataset, and perform missing value imputation, numerical normalization, and categorical variable encoding to obtain the original feature matrix; The original feature matrix is ​​fed into the Transformer branch, where multi-head self-attention is used to capture global cross-column dependencies, and rotational position encoding is used to inject relative position information to output global features. The global features output from the Transformer branch are used as input and fed into the depthwise separable convolutional encoder. Local neighborhood features are extracted by adding pointwise convolutions to each channel to obtain global-local fused features, which are then used as input to start the dual branches in parallel. The anomaly score obtained by passing the reconstruction error of the depthwise separable convolutional decoder through a learnable scaling layer is used as a soft label. The mean squared error is calculated together with the anomaly probability obtained by passing the softmax layer of the classification branch to form a consistency regularization term. The reconstruction loss, classification loss, and consistency loss are weighted and summed according to learnable weights to obtain the overall loss. The entire network is then trained end-to-end through gradient backpropagation. Bayesian optimization is used to automatically optimize the network structure hyperparameters, and finally, the results of anomaly detection in the tabular data are obtained.

2. The table anomaly detection method for improving network platform security according to claim 1, characterized in that, The dual branches include: a self-supervised branch and a supervised branch.

3. The table anomaly detection method for improving network platform security according to claim 1, characterized in that, The self-supervised branch takes the unified fused features output by the common feature encoder as input, and uses a depthwise separable convolution and three fully connected layers cascaded to form a decoder structure to reconstruct and restore the input features dimension by dimension, with the optimization objective being to minimize the reconstruction error between the original features and the reconstructed features.

4. The table anomaly detection method for improving network platform security according to claim 1, characterized in that, The supervised branch takes the unified fused features output by the common feature encoder as input, and constructs a classifier structure by stacking three fully connected layers and combining them with the ReLU nonlinear activation function. Under the supervision signal with known abnormal or normal labels, the network parameters are optimized with the cross-entropy loss function, so that the model learns the discrimination boundary between abnormal data and normal data, and realizes end-to-end abnormal classification output of input samples.

5. The table anomaly detection method for improving network platform security according to claim 1, characterized in that, The consistency loss is: = ； ； = ； In the formula, This is the reconstruction loss, where N is the number of samples and F is the number of features. It is the f-th feature of the i-th sample. It is the f-th feature of the reconstructed i-th sample. It is classification loss. It is the true label of the i-th sample. It is the classification probability of the i-th sample. It is a two-branch consistency loss; The mean error of feature reconstruction for a single sample.

6. A table anomaly detection device for improving network platform security, characterized in that, The device includes a processor and a memory, wherein the memory stores program instructions, and the processor invokes the program instructions stored in the memory to cause the device to perform the method according to any one of claims 1-5.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, the computer program including program instructions that, when executed by a processor, cause the processor to perform the method described in any one of claims 1-5.

Images