Anomaly explanation method and apparatus, and device and storage medium

Abstract

Provided in the embodiments of the present application are an anomaly explanation method and apparatus, and an electronic device and a computer storage medium. The anomaly explanation method comprises: acquiring an anomaly detection result including a plurality of detection features; acquiring a target association rule corresponding to the anomaly detection result, wherein the target association rule includes an antecedent feature value rule and a consequent feature value rule, an antecedent feature in the anomaly detection result meets the antecedent feature value rule, and a consequent feature in the anomaly detection result does not meet the consequent feature value rule; and determining the consequent feature in the anomaly detection result as an abnormal feature, and determining that the cause of an anomaly is the value of the abnormal feature violating the consequent feature value rule. In an anomaly explanation solution provided in the embodiments of the present application, by means of a pre-established association rule, an abnormal feature is determined, and the cause of an anomaly is further determined, so that explanation content included in anomaly explanation is enriched, and the explanation content is more comprehensive, thereby facilitating quick anomaly processing on the basis of the explanation content.

Description

Abnormal interpretation method, device, equipment and storage medium Technical Field

[0001] The embodiments of the present application relate to the field of language processing technology, and in particular to an exception interpretation method, device, electronic device, and computer storage medium. Background Art

[0002] Anomaly detection aims to identify data instances that do not conform to expected behavior. It is a classic machine learning task with numerous applications in diverse fields, such as fraud detection and intrusion detection. However, after detecting anomalous data instances, explaining them is equally important. For example, when a fault detection program for critical factory equipment reports an anomaly, operators need to obtain an explanation based on the abnormal data in order to perform subsequent actions, such as fault diagnosis and system maintenance.

[0003] Existing anomaly interpretation methods typically only identify the anomaly feature from multiple features contained in the anomaly data instance, and the interpretation process is considered complete. This approach provides a relatively simple and incomplete explanation of the anomaly.

[0004] Summary of the Invention

[0005] In view of this, one of the technical problems solved by the embodiments of the present application is to provide an abnormality interpretation method, device, electronic device and computer storage medium, so as to obtain richer and more comprehensive interpretation content when interpreting abnormal data.

[0006] In a first aspect, an embodiment of the present application provides an anomaly interpretation method, wherein the method includes:

[0007] Obtain anomaly detection results containing multiple detection features;

[0008] Obtain a target association rule corresponding to the anomaly detection result; wherein the target association rule is an association relationship between detection feature values ​​obtained in advance based on a detection result set; the target association rule includes a pre-feature value rule and a post-feature value rule; the pre-feature and post-feature are both detection features included in the anomaly detection result; the pre-feature in the anomaly detection result satisfies the pre-feature value rule, and the post-feature in the anomaly detection result does not satisfy the post-feature value rule;

[0009] The post-position feature in the abnormality detection result is determined to be an abnormal feature, and the cause of the abnormality is determined to be that the value of the abnormal feature violates the post-position feature value rule.

[0010] In a second aspect, an embodiment of the present application provides an abnormality interpretation device, wherein the device includes:

[0011] Anomaly detection result acquisition module, used to obtain anomaly detection results containing multiple detection features;

[0012] A target association rule acquisition module is configured to acquire a target association rule corresponding to the anomaly detection result; wherein the target association rule is an association relationship between the values ​​of each detection feature obtained in advance based on a set of detection results; the target association rule includes a pre-feature value selection rule and a post-feature value selection rule; the pre-feature and post-feature are both detection features included in the anomaly detection result; the pre-feature in the anomaly detection result satisfies the pre-feature value selection rule, and the post-feature in the anomaly detection result does not satisfy the post-feature value selection rule;

[0013] The abnormality interpretation module is used to determine the post-feature in the abnormality detection result as an abnormal feature, and determine that the cause of the abnormality is that the value of the abnormal feature violates the post-feature value rule.

[0014] In a third aspect, an embodiment of the present application provides an electronic device comprising a processor, a communication interface, a memory, and a communication bus, wherein the processor, the memory, and the communication interface communicate with each other through the communication bus; the memory is used to store computer programs, and when the processor is used to execute the programs stored in the memory, the method described in the first aspect is implemented.

[0015] In a fourth aspect, an embodiment of the present application provides a computer storage medium on which a computer program is stored. When the computer program is executed by a processor, the method described in the first aspect is implemented.

[0016] The embodiment of the present application provides an anomaly interpretation method, device, electronic device and computer storage medium. In the embodiment of the present application, after obtaining the anomaly detection result, a pre-constructed target association rule that characterizes the association relationship between the values ​​of each detection feature and the target association rule that the anomaly detection result violates is also obtained. Specifically, the target association rule includes a pre-feature value rule and a post-feature value rule, and when the pre-feature in the anomaly detection result satisfies the above-mentioned pre-feature value rule, the post-feature of the anomaly detection result violates (does not satisfy) the above-mentioned post-feature value rule. Therefore, it can be determined that the post-feature in the anomaly detection result is an abnormal feature, and further, it can also be determined that the abnormal cause corresponding to the anomaly detection result is: the value of the abnormal feature violates the above-mentioned post-feature value rule. Compared with the existing anomaly interpretation method, the anomaly interpretation scheme provided by the embodiment of the present application, with the help of pre-established association rules, determines the abnormal cause while determining the abnormal feature, enriches the interpretation content contained in the anomaly interpretation, makes the interpretation content more comprehensive, and thus facilitates rapid anomaly processing based on the interpretation content. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Hereinafter, some specific embodiments of the present application will be described in detail in an exemplary and non-limiting manner with reference to the accompanying drawings. The same reference numerals in the accompanying drawings indicate the same or similar components or parts. It should be understood by those skilled in the art that these drawings are not necessarily drawn to scale. In the accompanying drawings:

[0018] FIG1 is a flow chart of an anomaly interpretation method provided in an embodiment of the present application.

[0019] FIG2 is a logic diagram of selecting a feature value threshold from candidate feature value thresholds provided by an embodiment of the present application;

[0020] FIG3 is a schematic structural diagram of an abnormality interpretation device provided in an embodiment of the present application.

[0021] List of reference numerals:

[0022] 101: Obtain anomaly detection results including multiple detection features;

[0023] 102: Obtain target association rules corresponding to the anomaly detection results; the target association rules include pre-feature value rules and post-feature value rules; the pre-features in the anomaly detection results satisfy the pre-feature value rules, and the post-features in the anomaly detection results do not satisfy the post-feature value rules;

[0024] 103: Determine the post-position feature in the anomaly detection result as an abnormal feature, and determine that the cause of the abnormality is that the value of the abnormal feature violates the post-position feature value rule;

[0025] t1, t2, t3, t4, t5: candidate feature value thresholds;

[0026] 30: Abnormal interpretation device;

[0027] 301: Anomaly detection result acquisition module;

[0028] 302: target association rule acquisition module;

[0029] 303: Exception explanation module. DETAILED DESCRIPTION

[0030] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the embodiments of the present application, all other embodiments obtained by ordinary technicians in this field should fall within the scope of protection of the embodiments of the present application.

[0031] It should be noted that the embodiments and features in the embodiments of this application can be combined with each other unless there is a conflict. The first and second in this application are only for distinguishing names and do not represent a sequential relationship. They should not be understood as indicating or implying relative importance or implicitly indicating the number of technical features indicated. For example, the first user, the second user, and the third user are only for distinguishing different users.

[0032] The specific implementation of the embodiment of the present application is further explained below in conjunction with the accompanying drawings of the embodiment of the present application.

[0033] The present application provides an exception interpretation method. FIG1 is a flowchart of an exception interpretation method provided by the present application. As shown in FIG1 , the method includes the following steps:

[0034] Step 101: Obtain anomaly detection results including multiple detection features.

[0035] In the examples of this application, there is no limitation on the specific method for obtaining anomaly detection results. For example, the results may be obtained manually, or through any machine learning model used for anomaly detection or anomaly identification. Anomaly detection results may include multiple detection features. In the examples of this application, there is no limitation on the specific content of the detection features or the number of detection features.

[0036] To facilitate understanding of anomaly detection results, let's take the anomaly detection results obtained after performing anomaly detection on a water tank control system as an example: Assume that for the four detection features of liquid level, pump, valve, and temperature, the anomaly detection result obtained is X = [11.1, open, close, 25]. The above anomaly detection result X represents: the liquid level value is 11.1 (assuming the unit is mm), the pump is in the open state, the valve is in the closed state, and the temperature is 25°C.

[0037] Step 102: Obtain target association rules corresponding to the anomaly detection results; the target association rules include pre-feature value rules and post-feature value rules; the pre-features in the anomaly detection results satisfy the pre-feature value rules, and the post-features in the anomaly detection results do not satisfy the post-feature value rules.

[0038] The target association rule is the association relationship between the values ​​of each detection feature obtained in advance based on the detection result set; the pre-features and post-features are both detection features included in the abnormality detection results.

[0039] Specifically, the target association rule may be a value-taking rule followed by each detection feature in a normal detection result extracted based on a detection result sample set.

[0040] The pre-features may be some of the multiple detection features included in the anomaly detection result, and the number of pre-features may be 1 or more. In particular, the number of pre-features may also be 0, that is, the pre-features are empty. Correspondingly, the post-features may also be some of the multiple detection features included in the anomaly detection result, and the number of post-features may be 1 or more. However, the pre-features and post-features do not contain the same detection features.

[0041] The target association rules include the pre-feature value rules for the pre-features and the post-feature value rules for the post-features. The pre-features in the anomaly detection results meet the pre-feature value rules in the target association rules, but the post-features in the anomaly detection results do not meet the post-feature value rules in the target association rules.

[0042] For ease of understanding, let's take the anomaly detection result X = [11.1, open, closed, 25] in step 101 as an example. For X, assume the target association rule obtained is: Liquid Level > 10, Pump = Open → Valve = Open. This target association rule states that if the liquid level > 10 and the pump is on, then the valve should be open. This target association rule contains two pre-features: "Liquid Level" and "Pump," and one post-feature: "Valve." For the pre-feature "Liquid Level," the pre-feature value rule is: "Liquid Level > 10." For the pre-feature "Pump," the pre-feature value rule is: "Pump = Open." For the post-feature "Valve," the post-feature value rule is: "Valve = Open." For the anomaly detection result X, both the pre-features "Liquid Level" and "Pump" satisfy the pre-feature value rule in the target association rule, while the post-feature "Valve" does not.

[0043] Optionally, in one embodiment, step 102 may include the following steps:

[0044] Obtaining an association rule set comprising a plurality of association rules that is pre-constructed based on a test result sample set; the test result sample set comprises a plurality of test result samples;

[0045] A preset number of violation association rules are selected from the association rule set as target association rules corresponding to the anomaly detection result; wherein the violation association rules are association rules that the anomaly detection result has violated.

[0046] Specifically, the test result sample set can be a set containing a large number of test result data samples. This set can include a relatively large number of normal test results and a relatively small number of abnormal test results. Furthermore, since the key rules are the value-selection rules followed by each detection feature in the normal test results obtained based on the test result sample set, in order to improve the accuracy of the obtained association rules, this set can only include normal test results and not abnormal test results.

[0047] The violation of the association rule may be an association rule that has been violated by the anomaly detection result, that is, the value of the leading feature in the anomaly detection result satisfies the leading feature value rule in the aforementioned violation of the association rule, while the value of the trailing feature in the anomaly detection result does not satisfy the trailing feature value rule in the aforementioned violation of the association rule.

[0048] In the above steps, when selecting a preset number of violation association rules from the association rule set, any appropriate selection principle can be used for selection, and the embodiment of the present application does not limit this. However, in order to further increase the accuracy of the target association rule finally selected, the following method can be used for selection:

[0049] Calculate the support and confidence of each association rule in the association rule set; wherein the support of the association rule represents the proportion of detection result samples that meet the association rule in the detection result sample set; the confidence of the association rule represents the proportion of detection result samples that meet the post-feature value rule of the association rule among the detection result samples that meet the pre-feature value rule of the association rule;

[0050] Based on the support and confidence of each association rule, a candidate score of each association rule is calculated; the candidate score is positively correlated with the support and / or the confidence;

[0051] In descending order of candidate scores, a preset number of violation association rules are selected from the association rule set as target association rules corresponding to the anomaly detection result.

[0052] Specifically, the detection result samples that satisfy the association rules refer to detection result samples that satisfy both the pre-feature value selection rules and the post-feature value selection rules in the association rules.

[0053] Furthermore, the candidate score of each association rule can be calculated based on the support and confidence of each association rule using the following formula:

[0054] Wherein, A represents the association rule; sup(A) represents the support of association rule A; conf(A) represents the confidence of association rule A; θ is the preset support threshold; γ is the preset confidence threshold; α is the preset support weight; β is the preset confidence weight.

[0055] In the above target association rule selection method, the candidate score of each association rule is calculated, and then a preset number of violation association rules are selected in descending order of candidate scores as the target association rules for the final anomaly interpretation. Because the above candidate scores are positively correlated with the support and confidence of the association rules, and the support of the association rule can reflect the coverage of the association rule in the detection result sample set to a certain extent, and the confidence of the association rule can reflect the accuracy of the association rule in the detection result sample set to a certain extent, the above target association rule selection method can select violation association rules with higher data coverage and higher accuracy as the target association rules for the final anomaly interpretation, thereby facilitating more accurate and reasonable anomaly interpretation content.

[0056] Step 103: determine the post-feature in the anomaly detection result as an abnormal feature, and determine that the cause of the abnormality is that the value of the abnormal feature violates the post-feature value rule.

[0057] Specifically, taking the above-mentioned anomaly detection result X and target association rule as an example, the post-feature "valve" in the anomaly detection result X can be determined as an abnormal feature, and the cause of the abnormality is determined to be: the value of "valve" in X violates the post-feature value rule "valve = open" in the above-mentioned target association rule.

[0058] The anomaly interpretation method provided in the embodiment of the present application, after obtaining the anomaly detection result, also obtains the pre-constructed characterization of the association relationship between the values ​​of each detection feature, and the target association rule that the anomaly detection result violates. Specifically, the target association rule includes a pre-feature value rule and a post-feature value rule, and, when the pre-feature in the anomaly detection result satisfies the above-mentioned pre-feature value rule, the post-feature of the anomaly detection result violates (does not satisfy) the above-mentioned post-feature value rule. Therefore, it can be determined that the post-feature in the anomaly detection result is an abnormal feature, and, further, it can also be determined that the abnormal cause corresponding to the anomaly detection result is: the value of the abnormal feature violates the above-mentioned post-feature value rule. Compared with the existing anomaly interpretation method, the anomaly interpretation scheme provided in the embodiment of the present application, with the help of pre-established association rules, determines the abnormal cause while determining the abnormal feature, enriches the interpretation content contained in the abnormal interpretation, makes the interpretation content more comprehensive, and thus facilitates rapid anomaly processing based on the interpretation content.

[0059] In the above embodiment, the target association rule is selected from an association rule set that is pre-constructed based on a sample set of detection results and includes multiple association rules. The following describes the construction process of each association rule in the association rule set:

[0060] Association rules can include multi-feature association rules, where multi-feature association rules refer to association rules where both the pre-feature and the post-feature are not empty. The construction process of multi-feature association rules can include:

[0061] Constructing a feature value rule corresponding to each detection feature; wherein the support degree of the feature value rule in the detection result sample set is greater than a preset first support threshold;

[0062] For each test result sample in the test result sample set, a corresponding candidate rule combination is generated; wherein the candidate rule combination is composed of a combination of feature value rules satisfied by the test result sample;

[0063] Selecting a combination rule whose support is greater than a preset second support threshold from the candidate combination rules corresponding to each test result sample;

[0064] The selected combination rule is subjected to feature splitting to obtain a multi-feature association rule, wherein the multi-feature association rule includes a pre-feature value rule and a post-feature value rule split from the combination rule.

[0065] Specifically, the support of the feature value rule in the detection result sample set refers to the proportion of the detection result samples that meet the feature value rule in the detection result sample set.

[0066] The following example explains the process of generating candidate rule combinations corresponding to each test result sample:

[0067] Assume that the constructed feature value rules are: p1, p2, ..., pn. For any test result sample Mi in the test result sample set, since it only satisfies the two feature value rules p1 and p2, the candidate rule combination corresponding to Mi is {p1, p2}.

[0068] In the embodiments of the present application, there is no limitation on the specific construction method of the feature value rules corresponding to each detection feature, and any suitable rule construction method can be used so that the support of the constructed feature value rules in the detection result sample set is greater than a preset first support threshold. The support of the feature value rules in the detection result sample set refers to the proportion of detection result samples that meet the feature value rules in the entire detection result sample set.

[0069] Furthermore, detection features can generally be discrete features or continuous features. A discrete feature is a detection feature whose possible values ​​(candidate values) are discrete numerical values; a continuous feature is a detection feature whose possible values ​​(candidate values) are continuous value ranges. For example, for the four detection features "liquid level, pump, valve, and temperature", the possible values ​​of "pump" and "valve" are discrete values: "on" or "off", so the detection features "pump" and "valve" are discrete features, and the possible values ​​of "liquid level" and "temperature" are range intervals, so the detection features "liquid level" and "temperature" are continuous features.

[0070] For the discrete features, constructing feature value rules corresponding to each detection feature may include:

[0071] Generate corresponding candidate feature value rules based on the candidate feature values ​​of the discrete features;

[0072] The candidate feature value rule whose support is greater than a preset third support threshold is determined as the feature value rule corresponding to the discrete feature.

[0073] Specifically, for example: for the above-mentioned discrete feature "pump", its candidate feature values ​​are "on" and "off", therefore, the candidate feature value rule "pump = on" corresponding to "on" and the candidate feature value rule "pump = off" corresponding to "off" can be generated.

[0074] In addition, for candidate feature value rules whose support is less than or equal to the preset third support threshold, such candidate feature value rules can be combined to obtain a combined candidate feature value rule, and then the combined candidate feature value rule whose support is greater than the third support threshold is determined as the feature value rule corresponding to the discrete feature. For example: assuming that for candidate feature value rules P1 and P2, the support of P1 and the support of P2 are both less than the third support threshold, and after combining P1 and P2, the support of the combined candidate feature value rule P1 or P2 is greater than the third support threshold, then the combined candidate feature value rule P1 or P2 can be determined as the feature value rule.

[0075] Furthermore, for continuous features, constructing feature value rules corresponding to each detection feature may include:

[0076] Obtaining a characteristic value threshold of a continuous feature, and dividing the value range of the continuous feature into a plurality of value intervals based on the characteristic value threshold;

[0077] Based on each value interval of the continuous feature, corresponding candidate feature value rules are generated; and the candidate feature value rules with support greater than a preset fourth support threshold are determined as the feature value rules corresponding to the continuous feature.

[0078] Specifically, for example, for a continuous feature Fn, the feature value thresholds obtained are T1 and T2, and T1 < T2. The value range of the continuous feature can be divided into two intervals: interval 1: (-∞, T1], interval 2: (T1, T2), and interval 3: [T2, +∞). Based on interval 1, the corresponding candidate feature value rule is generated as: Fn ≤ T1; based on interval 2, the corresponding candidate feature value rule is generated as: T1 < Fn < T2; based on interval 3, the corresponding candidate feature value rule is generated as: T2 ≤ Fn.

[0079] The embodiments of the present application do not limit the method for obtaining the eigenvalue thresholds of continuous features. For example, they can be obtained by randomly setting them, or by calculating them using any preset calculation method. In addition, the embodiments of the present application do not limit the number of eigenvalue thresholds, and they can be customized according to actual circumstances.

[0080] Furthermore, in order to ultimately obtain a greater number of candidate feature value rules that meet the support requirement (greater than the preset fourth support threshold), the feature value threshold of the continuous feature can be obtained in the following manner:

[0081] Build decision tree regression models for continuous features;

[0082] Training the decision tree regression model based on the detection result sample set to obtain a trained regression model;

[0083] Extracting node attribute information of each node in the trained regression model; wherein the node attribute information includes a candidate feature value threshold;

[0084] A selection is made among the candidate eigenvalue thresholds to obtain an eigenvalue threshold.

[0085] Specifically, when training a decision tree regression model based on test result samples, the current continuous feature being processed can be used as the model output, while the remaining continuous features except for the current continuous feature can be used as input. Furthermore, information gain and variance reduction can be used as metrics for model quality, and a stopping criterion can be used for model training: the minimum number of samples required for each leaf node in the model is greater than D×θ, where D is the total number of test result samples contained in the test result sample set and θ is the preset support threshold. This can avoid obtaining too many feature value thresholds.

[0086] In addition, in the embodiment of the present application, the specific selection method for selecting the feature value threshold from the candidate feature value thresholds is not limited and can be customized according to actual conditions. For example, a random selection method or a preset selection algorithm can be used.

[0087] Furthermore, the node attribute information further includes: a reduction in the node's promiscuity; correspondingly, the process of selecting from the candidate eigenvalue thresholds to obtain the eigenvalue threshold may include:

[0088] In descending order of the amount of reduction in promiscuity, for each corresponding candidate eigenvalue threshold, based on the value interval obtained by the candidate eigenvalue threshold and the previous candidate eigenvalue threshold, generate the candidate eigenvalue value rule corresponding to the candidate eigenvalue threshold;

[0089] If the support of each candidate feature value rule corresponding to the candidate feature value threshold is greater than the preset fifth support threshold, the candidate feature value threshold is determined as the feature value threshold.

[0090] Specifically, the reduction in node complexity represents the reduction in node complexity. A greater reduction in node complexity indicates a higher predictability of the node for continuous features, i.e., reduced uncertainty about the continuous features. In the embodiments of the present application, a candidate eigenvalue threshold corresponding to a larger reduction in complexity is selected as the final eigenvalue threshold whenever possible. This is more conducive to ultimately finding association rules that include the aforementioned eigenvalue thresholds and have higher data coverage and greater accuracy.

[0091] When generating corresponding candidate feature value rules for each candidate feature value threshold, the candidate feature value threshold can be determined as the current candidate feature value threshold, and the previous candidate feature value threshold refers to other candidate feature value thresholds of the current candidate feature value threshold.

[0092] Furthermore, in order to reduce the amount of data processing during the association rule construction process, the number of characteristic value thresholds finally determined may be limited. For example, the number of characteristic value thresholds finally determined may be less than a preset number threshold, and so on.

[0093] See Figure 2, which is a logical diagram of selecting a feature value threshold from candidate feature value thresholds provided in an embodiment of the present application. The process of selecting a feature value threshold is explained below in conjunction with Figure 2:

[0094] Set t1, t2, t3, t4 and t5 as candidate eigenvalue thresholds for the continuous feature Fn, wherein the node promiscuity reduction corresponding to t1, t2, t3, t4 and t5 decreases in sequence; for t1, t1 divides the value interval of Fn into two: (-∞, t1] and (t1, +∞), and based on the two intervals, generates alternative feature value rules: Fn≤t1 with t1<Fn; since the support of Fn≤t1 with t1<Fn is greater than the preset fifth support threshold, the candidate eigenvalue threshold t1 is determined as the eigenvalue threshold; for t2, t2 and t1, divides the value interval of Fn into three: (-∞, t1], (t1, t2] and (t2, +∞), and based on the three intervals, generates alternative feature value rules: Fn≤t1, t1<Fn≤t2 and t2<Fn; at this time, since Fn≤ The support levels of t1 and t2<Fn are both greater than the preset fifth support threshold. Therefore, the candidate eigenvalue threshold t2 can be determined as the eigenvalue threshold only when the support level of t1<Fn≤t2 is also greater than the preset fifth support threshold; and by analogy, for t3, the candidate eigenvalue threshold t3 can be determined as the eigenvalue threshold only when the support level of t3≤Fn<t1 is also greater than the preset fifth support threshold; for t4, the candidate eigenvalue threshold t4 can be determined as the eigenvalue threshold only when the support level of t1≤Fn<t4 is greater than the preset fifth support threshold, and the support level of t4≤Fn<t2 is also greater than the preset fifth support threshold; and for t5, the candidate eigenvalue threshold t5 can be determined as the eigenvalue threshold only when the support level of t2≤Fn<t5 is greater than the preset fifth support threshold.

[0095] In addition, since the abnormality of an abnormal detection result may also be caused by the value of a single detection feature not meeting the feature value rules, in the embodiment of the present application, the association rules may also include single-feature association rules, wherein the single-feature association rules only include the value rules of one detection feature. Based on the single-feature association rules, it is possible to explain the anomaly of a simple detection feature value exceeding the preset value rules. Specifically, the construction process of the single-feature association rules includes:

[0096] Construct an empty set as the pre-feature value rule of the single-feature association rule;

[0097] For a discrete single detection feature, the single detection feature is used as a post-feature, and based on all candidate values ​​of the single detection feature, a post-feature value rule is obtained;

[0098] For continuous single detection features, the single detection feature is used as the post-feature, and based on the average value and standard deviation of the single detection feature in the detection result sample set, the post-feature value rule is generated according to the Laida criterion (3σ criterion).

[0099] Specifically, for the continuous feature Fc, assuming that the candidate values ​​are 1, 2, and 3, the generated post-feature value rule is: Fc∈{1, 2, 3}, and the final single feature association rule is: Represents an empty set. This single-feature association rule indicates that the value of Fc should be one of 1, 2, and 3.

[0100] For the continuous feature Fn, assuming that the average value of a single detection feature in the detection result sample set is μ and the standard deviation is σ, the generated post-feature value rule is: μ-3σ≤Fn≤μ+3σ. The final single feature association rule is: The single-feature association rule represents that the value of Fn is in the range of [μ-3σ, μ+3σ].

[0101] See Table 1 below, which lists the corresponding explanations obtained using different abnormality interpretation methods for the four detection features of liquid level, pump, valve, and temperature in step 101, as well as the abnormality detection result X = [11.1, open, close, 25]:

[0102] Table 1

[0103] It can be clearly seen from Table 1 that the exception interpretation method provided in the embodiment of the present application provides a more comprehensive interpretation (while determining the abnormal characteristics, it also determines the cause of the abnormality), enriches the interpretation content contained in the abnormal interpretation, makes the interpretation content more comprehensive, and thus facilitates rapid exception handling based on the interpretation content.

[0104] Based on an anomaly interpretation method provided in any of the above embodiments, an embodiment of the present application provides an anomaly interpretation device, as shown in FIG3 , which is a schematic structural diagram of an anomaly interpretation device provided in an embodiment of the present application. The anomaly interpretation device 30 includes: an anomaly detection result acquisition module 301, a target association rule acquisition module 302, and an anomaly interpretation module 303;

[0105] Anomaly detection result acquisition module 301, used to obtain anomaly detection results including multiple detection features;

[0106] The target association rule acquisition module 302 is used to obtain the target association rule corresponding to the anomaly detection result; wherein the target association rule is the association relationship between the values ​​of each detection feature obtained in advance based on the detection result set; the target association rule includes a pre-feature value selection rule and a post-feature value selection rule; the pre-feature and post-feature are both detection features included in the anomaly detection result; the pre-feature in the anomaly detection result satisfies the pre-feature value selection rule, and the post-feature in the anomaly detection result does not satisfy the post-feature value selection rule;

[0107] The abnormality interpretation module 303 is used to determine the post-feature in the abnormality detection result as an abnormal feature, and determine that the cause of the abnormality is that the value of the abnormal feature violates the post-feature value rule.

[0108] Optionally, in one embodiment of the present application, the target association rule acquisition module 302 is specifically configured to:

[0109] Obtaining an association rule set comprising multiple association rules that is pre-built based on a test result sample set; the test result sample set comprises multiple test result samples;

[0110] A preset number of violation association rules are selected from the association rule set as target association rules corresponding to the anomaly detection result; wherein the violation association rule is the association rule that the anomaly detection result has violated.

[0111] Optionally, in one embodiment of the present application, when executing the step of selecting a preset number of violation association rules from the association rule set as target association rules corresponding to the anomaly detection result, the target association rule acquisition module 302 is specifically configured to:

[0112] Calculate the support and confidence of each association rule in the association rule set; the support of the association rule represents the proportion of detection result samples that meet the association rule in the detection result sample set; the confidence of the association rule represents the proportion of detection result samples that meet the post-feature value rules of the association rule in the detection result samples that meet the pre-feature value rules of the association rule;

[0113] Based on the support and confidence of each association rule, the candidate score of each association rule is calculated; the candidate score is positively correlated with the support and / or confidence;

[0114] In descending order of candidate scores, a preset number of violation association rules are selected from the association rule set as target association rules corresponding to the anomaly detection result.

[0115] Optionally, in one embodiment of the present application, the association rule includes a multi-feature association rule; and the anomaly interpretation device 30 further includes:

[0116] A multi-feature association rule construction module is used to construct feature value rules corresponding to each detection feature; the support of the feature value rules in the detection result sample set is greater than a preset first support threshold; for each detection result sample in the detection result sample set, a corresponding candidate rule combination is generated; wherein the candidate rule combination is composed of a combination of feature value rules satisfied by the detection result sample; from the candidate combination rules corresponding to each detection result sample, a combination rule with a support greater than a preset second support threshold is selected; the selected combination rule is feature-splitting to obtain a multi-feature association rule, wherein the multi-feature association rule includes a pre-feature value rule and a post-feature value rule split by the combination rule.

[0117] Optionally, in one embodiment of the present application, the detection features include discrete features; for the discrete features, the multi-feature association rule construction module, when executing the step of constructing feature value rules corresponding to each detection feature, is specifically configured to:

[0118] Generate corresponding candidate feature value rules based on the candidate feature values ​​of the discrete features;

[0119] The candidate feature value rules whose support is greater than a preset third support threshold are determined as the feature value rules corresponding to the discrete features.

[0120] Optionally, in one embodiment of the present application, the detection features further include continuous features. For the continuous features, the multi-feature association rule construction module, when executing the step of constructing feature value rules corresponding to each detection feature, is specifically configured to:

[0121] Obtaining a characteristic value threshold of the continuous feature, so as to divide the value range of the continuous feature into multiple value intervals based on the characteristic value threshold;

[0122] Based on each value interval of the continuous feature, corresponding candidate feature value rules are generated; and the candidate feature value rules with support greater than a preset fourth support threshold are determined as feature value rules corresponding to the continuous feature.

[0123] Optionally, in one embodiment of the present application, when executing the step of obtaining a feature value threshold of a continuous feature, the multi-feature association rule construction module is specifically configured to:

[0124] Build decision tree regression models for continuous features;

[0125] A decision tree regression model is trained based on the test result sample set to obtain a trained regression model;

[0126] Extracting node attribute information of each node in the trained regression model; wherein the node attribute information includes a candidate feature value threshold;

[0127] Select from the candidate eigenvalue thresholds to obtain the eigenvalue threshold.

[0128] Optionally, in one embodiment of the present application, the node attribute information further includes: the amount of reduction in the node's promiscuity; and when the multi-feature association rule construction module performs the step of selecting from candidate feature value thresholds to obtain a feature value threshold, the module is specifically configured to:

[0129] In descending order of the amount of reduction in promiscuity, for each corresponding candidate eigenvalue threshold, based on the value interval obtained by the candidate eigenvalue threshold and the previous candidate eigenvalue threshold, generate the candidate eigenvalue value rule corresponding to the candidate eigenvalue threshold;

[0130] If the support of each candidate feature value rule corresponding to the candidate feature value threshold is greater than the preset fifth support threshold, the candidate feature value threshold is determined as the feature value threshold.

[0131] Optionally, in one embodiment of the present application, the association rule further includes a single-feature association rule; and the anomaly interpretation device 30 further includes:

[0132] Single-feature association rule construction module, used to construct an empty set as the pre-feature value rule of the single-feature association rule;

[0133] For a discrete single detection feature, the single detection feature is used as a post-feature, and based on all candidate values ​​of the single detection feature, a post-feature value rule is obtained;

[0134] For continuous single detection features, the single detection feature is used as a post-feature, and based on the average value and standard deviation of the single detection feature in the detection result sample set, the post-feature value rule is generated according to the Laida criterion.

[0135] The anomaly interpretation device of the present application embodiment is used to implement the corresponding anomaly interpretation methods of the aforementioned multiple method embodiments and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here. In addition, the functional implementation of each module in the anomaly interpretation device of the present application embodiment can refer to the description of the corresponding parts in the aforementioned method embodiments, which will not be described in detail here.

[0136] Based on the exception interpretation method described in any of the above embodiments, an embodiment of the present application provides an electronic device, including: a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory is used to store computer programs, and the processor is used to execute the program stored in the memory, thereby implementing the method described in any of the above embodiments.

[0137] Based on the exception interpretation method described in any of the above embodiments, an embodiment of the present application provides a computer storage medium storing a computer program, which implements the method described in any of the above embodiments when executed by a processor.

[0138] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0139] The above-described methods according to the embodiments of the present application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk, or magneto-optical disk), or as computer code originally stored in a remote recording medium or non-transitory machine-readable medium downloaded via a network and then stored in a local recording medium, so that the methods described herein can be stored in such software processing on a recording medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware (such as an ASIC or FPGA). It is understood that a computer, processor, microprocessor controller, or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the control method of the adjustment machine described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the control method of the adjustment machine shown herein, the execution of the code converts the general-purpose computer into a dedicated computer for executing the control method of the adjustment machine shown herein.

[0140] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0141] Those skilled in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of this application.

[0142] The various embodiments in this specification are described in a progressive manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiments are generally similar to the method embodiments, so the description is relatively simple. For relevant parts, refer to the description of the method embodiments.

[0143] The above implementation methods are only used to illustrate the embodiments of the present application, and are not intended to limit the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also fall within the scope of the embodiments of the present application, and the scope of patent protection of the embodiments of the present application should be defined by the claims.

Claims

1. A method for explaining anomalies, wherein: The method comprises: Obtain anomaly detection results including multiple detection features; Obtaining a target association rule corresponding to the anomaly detection result; wherein the target association rule is an association relationship between the values ​​of each detection feature obtained in advance based on a set of detection results; the target association rule includes a pre-feature value rule and a post-feature value rule; the pre-feature and the post-feature are both detection features included in the anomaly detection result; the pre-feature in the anomaly detection result satisfies the pre-feature value rule, and the post-feature in the anomaly detection result does not satisfy the post-feature value rule; The post-feature in the abnormal detection result is determined as an abnormal feature, and the cause of the abnormality is determined to be that the value of the abnormal feature violates the post-feature value rule.

2. The method according to claim 1, wherein: The obtaining of the target association rule corresponding to the anomaly detection result includes: Acquire an association rule set including a plurality of association rules that is pre-constructed based on a detection result sample set; the detection result sample set includes a plurality of detection result samples; A preset number of violation association rules are selected from the association rule set as target association rules corresponding to the anomaly detection result; wherein the violation association rules are association rules that the anomaly detection result has violated.

3. The method according to claim 2, wherein: The step of selecting a preset number of violation association rules from the association rule set as target association rules corresponding to the anomaly detection result includes: Calculate the support and confidence of each association rule in the association rule set; wherein the support of the association rule represents the proportion of the detection result samples that meet the association rule in the detection result sample set; the confidence of the association rule represents the proportion of the detection result samples that meet the post-feature value rule of the association rule in the detection result samples that meet the pre-feature value rule of the association rule; Based on the support and confidence of each association rule, a candidate score of each association rule is calculated; the candidate score is positively correlated with the support and / or the confidence; In descending order of candidate scores, a preset number of violation association rules are selected from the association rule set as target association rules corresponding to the anomaly detection result.

4. The method according to claim 2 or 3, wherein: The association rule includes a multi-feature association rule; the construction process of the multi-feature association rule includes: Constructing a feature value rule corresponding to each detection feature; the support of the feature value rule in the detection result sample set is greater than a preset first support threshold; For each test result sample in the test result sample set, a corresponding candidate rule combination is generated; wherein the candidate rule combination is composed of a combination of feature value rules satisfied by the test result sample; Selecting a combination rule whose support is greater than a preset second support threshold from the candidate combination rules corresponding to each detection result sample; The selected combination rule is subjected to feature splitting to obtain a multi-feature association rule, wherein the multi-feature association rule includes a pre-feature value rule and a post-feature value rule split from the combination rule.

5. The method according to claim 4, wherein: The detection features include discrete features; For the discrete features, the step of constructing feature value rules corresponding to each detection feature includes: Based on the candidate feature values ​​of the discrete features, corresponding candidate feature value rules are generated; The candidate feature value rule whose support is greater than a preset third support threshold is determined as the feature value rule corresponding to the discrete feature.

6. The method according to claim 4, wherein: The detection features further include continuous features; for the continuous features, constructing feature value rules corresponding to each detection feature includes: Obtaining a feature value threshold of a continuous feature, so as to divide the value range of the continuous feature into a plurality of value intervals based on the feature value threshold; Based on each value interval of the continuous feature, a corresponding candidate feature value rule is generated; and the candidate feature value rule whose support is greater than a preset fourth support threshold is determined as the feature value rule corresponding to the continuous feature.

7. The method according to claim 6, wherein: The step of obtaining a characteristic value threshold of a continuous characteristic comprises: Constructing a decision tree regression model for the continuous features; Training the decision tree regression model based on the detection result sample set to obtain a trained regression model; Extracting node attribute information of each node in the trained regression model; wherein the node attribute information includes a candidate feature value threshold; A selection is made among the candidate eigenvalue thresholds to obtain an eigenvalue threshold.

8. The method according to claim 7, wherein: The node attribute information also includes: the amount of reduction in the node's promiscuity; the selection among the candidate eigenvalue thresholds to obtain the eigenvalue threshold includes: In descending order of the amount of promiscuity reduction, for each corresponding candidate eigenvalue threshold, based on the value interval obtained by the candidate eigenvalue threshold and the previous candidate eigenvalue threshold, generate the candidate eigenvalue value rule corresponding to the candidate eigenvalue threshold; If the support of each candidate feature value rule corresponding to the candidate feature value threshold is greater than a preset fifth support threshold, the candidate feature value threshold is determined as the feature value threshold.

9. The method according to claim 2 or 3, wherein: The association rules further include single-feature association rules; the construction process of the single-feature association rules includes: Construct an empty set as the pre-feature value rule of the single-feature association rule; For a discrete single detection feature, the single detection feature is used as a post-feature, and based on all candidate values ​​of the single detection feature, a post-feature value rule is obtained; For continuous single detection features, the single detection feature is used as a post-feature, and based on the average value and standard deviation of the single detection feature in the detection result sample set, the post-feature value rule is generated according to the Laida criterion.

10. An abnormality interpretation device, wherein: The device comprises: An anomaly detection result acquisition module, used to obtain an anomaly detection result containing multiple detection features; A target association rule acquisition module is used to acquire the target association rule corresponding to the abnormal detection result; wherein the target association rule is the association relationship between the values ​​of each detection feature obtained in advance based on the detection result set; the target association rule includes a pre-feature value rule and a post-feature value rule; the pre-feature and the post-feature are both detection features included in the abnormal detection result; the pre-feature in the abnormal detection result satisfies the pre-feature value rule, and the post-feature in the abnormal detection result does not satisfy the post-feature value rule; The abnormality explanation module is used to determine the post-feature in the abnormality detection result as an abnormal feature, and determine that the cause of the abnormality is that the value of the abnormal feature violates the post-feature value rule.

11. An electronic device, comprising: A processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other via the communication bus; Memory, used to store computer programs; A processor, for implementing the method steps described in any one of claims 1 to 9 when executing a program stored in a memory.

12. A computer storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method steps according to any one of claims 1 to 9.

13. A computer program product tangibly stored on a computer readable medium and comprising computer executable instructions which, when executed, cause at least one processor to perform the method steps of any one of claims 1-9.

Images