Data anomaly detection method and apparatus, computer device, computer-readable storage medium, and computer program product

Abstract

The present application relates to a data anomaly detection method and apparatus, a computer device, a computer-readable storage medium, and a computer program product, relating to the technical field of data processing. The method comprises: acquiring initial data information of at least two modalities (S102); using forward diffusion to add noise to the initial data information of each modality, so as to remove a preset modality feature of each modality and obtain corresponding similar modality information; using reverse diffusion to recover a preset modality feature of each piece of similar modality information, so as to obtain corresponding target data information, and on the basis of modality data corresponding to the preset modality feature, aligning the target data information of each modality; using an attention mechanism to identify preset key regions of the aligned target data information (S108); and acquiring, by means of residual detection, a residual value of the target data information within each preset key region, and on the basis of the residual value, determining anomalous data in the corresponding initial data information (S110). By using the present method, the detection efficiency of data anomaly detection can be improved.

Description

Data anomaly detection methods, apparatus, computer equipment, computer-readable storage media, and computer program products Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Technology

[0002] Since the training of high-performance artificial intelligence models relies on a large amount of data, and data poisoning attacks are the main attack method to pollute the underlying data of intelligent services, attackers who poison data have emerged. They mainly do this by injecting malicious data during the data collection stage, causing the data distribution to become skewed, thereby disrupting the data analysis results and achieving their attack objectives.

[0003] Current methods for detecting data poisoning attacks primarily focus on image data. They cannot simultaneously process different data types uniformly. Furthermore, to ensure dataset security, they mainly employ defensive techniques, which reduces data availability and wastes resources. Therefore, current data anomaly detection methods suffer from low detection efficiency. Summary of the Invention

[0004] Therefore, it is necessary to address the technical problem of low detection efficiency in the aforementioned data anomaly detection methods by providing a data anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product.

[0005] Firstly, this application provides a data anomaly detection method, including:

[0006] Acquire initial data information in at least two modalities; the modality characterizes the type of the initial data information.

[0007] The forward diffusion of the diffusion model is used to add noise to the initial data information of each modality to remove the preset modal features in the initial data information of each modality, so as to obtain the corresponding similar modal information.

[0008] The preset modal features of each similar modal information are recovered by back diffusion of the diffusion model to obtain the corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0009] A preset key region for each aligned target data information is identified using an attention mechanism.

[0010] The residual values ​​of the target data information in each of the preset key areas are obtained by residual detection, and the abnormal data in the corresponding initial data information are determined based on the residual values.

[0011] In one embodiment, the forward diffusion using the diffusion model adds noise to the initial data information of each modality, including: for the initial data information of each modality, based on a preset noise addition rule and a preset number of steps, gradually adding the noise to the corresponding initial data information.

[0012] In one embodiment, the step of using the back diffusion of the diffusion model to recover the preset modal features of each of the similar modal information includes: for the initial data information of each modality after the noise has been added, based on a preset noise removal rule and the preset number of steps, gradually removing the noise in the similar modal information to recover the preset modal features of each of the similar modal information.

[0013] In one embodiment, obtaining the residual value of the target data information in each of the preset key regions through residual detection includes: obtaining the residual value based on the preset modal features of the target data information in each of the preset key regions and the features of the target data information in each of the preset key regions at each preset number of steps.

[0014] In one embodiment, determining the abnormal data in the corresponding initial data information based on the residual value includes: comparing each residual value with a preset residual threshold, and determining the abnormal data in the corresponding initial data information based on the comparison result.

[0015] In one embodiment, determining the abnormal data in the corresponding initial data information based on the comparison result includes: when the comparison result is that the residual value is greater than the preset residual threshold, determining that the initial data information corresponding to the residual value is the abnormal data.

[0016] Secondly, this application also provides a data anomaly detection device, comprising:

[0017] An information acquisition module is used to acquire initial data information in at least two modalities; the modality represents the type of the initial data information.

[0018] The noise addition module is used to add noise to the initial data information of each modality using the forward diffusion of the diffusion model, so as to remove the preset modal features in the initial data information of each modality and obtain the corresponding similar modal information.

[0019] The feature recovery module is used to recover the preset modal features of each similar modal information using the back diffusion of the diffusion model, so as to obtain the corresponding target data information, and to align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model;

[0020] The information recognition module is used to identify preset key regions of each aligned target data information using an attention mechanism;

[0021] The result determination module is used to obtain the residual value of the target data information in each of the preset key areas through residual detection, and to determine the abnormal data in the corresponding initial data information based on the residual value.

[0022] Thirdly, this application also provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program. , When the processor executes the computer program, it performs the following steps:

[0023] Acquire initial data information in at least two modalities; the modality characterizes the type of the initial data information.

[0024] The forward diffusion of the diffusion model is used to add noise to the initial data information of each modality to remove the preset modal features in the initial data information of each modality, so as to obtain the corresponding similar modal information.

[0025] The preset modal features of each similar modal information are recovered by back diffusion of the diffusion model to obtain the corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0026] A preset key region for each aligned target data information is identified using an attention mechanism.

[0027] The residual values ​​of the target data information in each of the preset key areas are obtained by residual detection, and the abnormal data in the corresponding initial data information are determined based on the residual values.

[0028] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0029] Acquire initial data information in at least two modalities; the modality characterizes the type of the initial data information.

[0030] The forward diffusion of the diffusion model is used to add noise to the initial data information of each modality to remove the preset modal features in the initial data information of each modality, so as to obtain the corresponding similar modal information.

[0031] The preset modal features of each similar modal information are recovered by back diffusion of the diffusion model to obtain the corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0032] A preset key region for each aligned target data information is identified using an attention mechanism.

[0033] The residual values ​​of the target data information in each of the preset key areas are obtained by residual detection, and the abnormal data in the corresponding initial data information are determined based on the residual values.

[0034] Fifthly, this application also provides a computer program product, which includes a computer program that, when executed by a processor, performs the following steps:

[0035] Acquire initial data information in at least two modalities; the modality characterizes the type of the initial data information.

[0036] The forward diffusion of the diffusion model is used to add noise to the initial data information of each modality to remove the preset modal features in the initial data information of each modality, so as to obtain the corresponding similar modal information.

[0037] The preset modal features of each similar modal information are recovered by back diffusion of the diffusion model to obtain the corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0038] A preset key region for each aligned target data information is identified using an attention mechanism.

[0039] The residual values ​​of the target data information in each of the preset key areas are obtained by residual detection, and the abnormal data in the corresponding initial data information are determined based on the residual values.

[0040] The aforementioned data anomaly detection method, apparatus, computer equipment, storage medium, and computer program product, in the data anomaly detection process, first acquire initial data information of at least two modalities; the modality represents the type of the initial data information; then, noise is added to the initial data information of each modality using forward diffusion of a diffusion model to remove preset modal features from the initial data information of each modality, obtaining corresponding similar modal information; next, preset modal features of each similar modal information are recovered using backward diffusion of a diffusion model to obtain corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model; then, a preset key region of each target data information after alignment is identified using an attention mechanism; finally, the residual value of the target data information within each preset key region is obtained through residual detection, and the abnormal data in the corresponding initial data information is determined based on the residual value. In the above process, by adding noise to the initial data to remove preset modal features and restoring similar modal information, data alignment between different modalities can be achieved, improving the integration capability between modalities. After restoring the preset modal features using backdiffusion of the diffusion model, more realistic and expected target data can be generated. Furthermore, through residual detection, abnormal data can be identified. Therefore, the above process improves the detection efficiency of the data anomaly detection method. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 is a flowchart illustrating a data anomaly detection method in one embodiment;

[0043] Figure 2 is a system schematic diagram of a data anomaly detection method in one embodiment;

[0044] Figure 3 is a detailed flowchart of a data anomaly detection method in one embodiment;

[0045] Figure 4 is a flowchart illustrating the detection process of multimodal data poisoning attacks in one embodiment;

[0046] Figure 5 is a structural block diagram of a data anomaly detection device in one embodiment;

[0047] Figure 6 is an internal structure diagram of a computer device in one embodiment. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0049] In one embodiment, as shown in Figure 1, a data anomaly detection method is provided. This embodiment illustrates the method by applying it to a terminal. It is understood that this method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. In this embodiment, the method includes the following steps S102 to S110. Wherein:

[0050] Step S102: Obtain initial data information for at least two modes; the mode characterizes the type of initial data information.

[0051] Here, modality refers to different forms of information representation, such as text, images, and audio; initial data information refers to the unprocessed raw data corresponding to different modalities.

[0052] Optionally, each modality has different features and data representations; the image modality may include color, texture, and shape information, while the text modality may include vocabulary and grammatical structure.

[0053] Step S104: Use the forward diffusion of the diffusion model to add noise to the initial data information of each mode to remove the preset mode features in the initial data information of each mode and obtain the corresponding similar mode information.

[0054] Among them, diffusion models are commonly used for image generation and data augmentation, which generate new samples by gradually adding noise; the forward diffusion process continuously adds noise to the data to be processed to blur the data information; noise is used to represent random interference; adding noise can help diffusion models remove overfitting; similar modal information refers to the data generated after processing by the diffusion model, which retains similarity.

[0055] As an example, the forward diffusion process continuously adds noise to the initial data information to blur the initial data information, thereby removing the preset modal features in the initial data information; similar modal information can refer to the fact that the processed text and images no longer contain their original detailed features.

[0056] Step S106: Use the back diffusion of the diffusion model to recover the preset modal features of each similar modal information to obtain the corresponding target data information, and align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0057] The backdiffusion process learns how to recover the original sample or a sample similar to the original sample from noise; the target data information is the final data with specific modal characteristics recovered after backdiffusion processing.

[0058] As an example, aligning target data information across modalities can be achieved by pairing images and text with the same annotations or frequencies to ensure correct correspondence between them.

[0059] Step S108: Use an attention mechanism to identify the preset key regions of the aligned target data information.

[0060] Among them, the attention mechanism is a neural network mechanism that can dynamically focus on specific regions of input data to enhance key information.

[0061] As an example, among multiple target data, the attention mechanism can identify different modal features corresponding to different modalities.

[0062] Step S110: Obtain the residual value of the target data information in each preset key area through residual detection, and determine the abnormal data in the corresponding initial data information based on the residual value.

[0063] Among them, residual detection refers to assessing the difference between actual data and predicted data in order to identify potential anomalies; the calculation of residual values ​​can be used to identify data points with abnormal patterns, that is, the abnormal data needs to be re-evaluated or cleaned.

[0064] In the above-mentioned data anomaly detection method, during the data anomaly detection process, at least two modalities of initial data information are first acquired; the modality represents the type of the initial data information; then, noise is added to the initial data information of each modality using forward diffusion of the diffusion model to remove the preset modal features in the initial data information of each modality, thereby obtaining the corresponding similar modal information; next, the preset modal features of each similar modal information are recovered using backward diffusion of the diffusion model to obtain the corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model; then, the preset key regions of each aligned target data information are identified using an attention mechanism; finally, the residual values ​​of the target data information within each preset key region are obtained through residual detection, and the abnormal data in the corresponding initial data information is determined based on the residual values. In the above process, by adding noise to the initial data to remove preset modal features and restoring similar modal information, data alignment between different modalities can be achieved, improving the integration capability between modalities. After restoring the preset modal features using backdiffusion of the diffusion model, more realistic and expected target data can be generated. Furthermore, through residual detection, abnormal data can be identified. Therefore, the above process improves the detection efficiency of the data anomaly detection method.

[0065] In an exemplary embodiment, step S104 uses the forward diffusion of the diffusion model to add noise to the initial data information of each modality, including: for the initial data information of each modality, based on preset noise addition rules and preset number of steps, gradually adding noise to the corresponding initial data information.

[0066] Each mode corresponds to a different type of noise, and different noises correspond to different noise addition rules. Noise addition rules refer to the specific methods and standards for introducing noise into the data during data processing. The preset number of steps refers to the number of steps for adding noise as specified by the rules during the noise addition process, that is, noise is added at certain intervals to simulate the fluctuations and possible interferences of the data in actual applications. Gradual addition of noise indicates that the addition of noise is a gradual process, which can better simulate the interference in real-world scenarios.

[0067] As an example, when the initial data information is image data, the gradual addition of noise can be used to gradually introduce effects such as blurring and interfering pixels into the image data.

[0068] In this embodiment, by gradually adding noise to the initial data, the process of noise that may be encountered in real-world applications can be simulated, which helps to learn how to handle and resist noise, thereby improving the performance of the diffusion model on unknown datasets. Furthermore, adding noise with corresponding rules and steps to the initial data for different modalities can ensure the rationality of data processing.

[0069] In one embodiment, step S106 uses the back diffusion of the diffusion model to recover the preset modal features of each similar modal information, including: for the initial data information of each modality after adding noise, based on preset noise removal rules and preset number of steps, gradually removing noise from the similar modal information to recover the preset modal features of each similar modal information.

[0070] Among them, noise removal rules refer to the methods for extracting or recovering data from noisy data during the processing. Rules may include filtering, signal averaging, waveform restoration, etc. Similar to the above-mentioned noise addition, preset steps refer to the number of steps to remove noise during the noise removal process. Gradual removal indicates that the removal of noise is a gradual process. Similar modal information refers to other modal data similar to the current processing modality. During noise removal, preset modal features can help recover the target modal information. Preset modal features refer to the ideal state or features recovered from the original data.

[0071] As an example, in image processing, methods such as bilateral filtering can be used to gradually remove image noise while preserving edge information; in audio signal processing, frequency analysis techniques can be used to remove background noise layer by layer until a clear audio waveform is restored.

[0072] In this embodiment, noise removal can be performed step by step to avoid damage to signal features and improve the accuracy of restoring preset modal features of similar modal information. By combining data features of different modalities, similarity can be used to make up for the deficiencies in the denoising process of a certain modality, thereby achieving more accurate feature recovery.

[0073] Furthermore, in one embodiment, step S110 obtains the residual value of the target data information in each preset key area through residual detection, including: obtaining the residual value based on the preset modal features of the target data information in each preset key area and the features of the target data information in each preset key area at each preset number of steps.

[0074] Among them, the preset key region refers to the important region defined in advance in data processing, which may contain key features or important parameters of the target data information, and is usually used for centralized analysis and processing; the preset modal features refer to the ideal features or indicators predefined for a specific modality in the initial stage of data analysis, and are usually used to guide the direction and goal of data processing; each preset step refers to the segmentation in the feature extraction or processing process, used to analyze the performance of the target data information under different processing conditions or parameter configurations in stages; features refer to the descriptive information extracted from the target data information, used to characterize the main attributes of the target data, which can be numerical or categorical, etc.; the residual value is the difference between the actual features of the target data information and the preset modal features. Calculating the residual value helps to assess whether the initial modal data input at the beginning has been maliciously modified.

[0075] In this embodiment, by conducting in-depth analysis and processing of target data information within a preset key area, the differences between the original features of the initial modal data and the features obtained through noise removal or other processing methods can be effectively identified, thereby helping to determine whether the initial modal data is abnormal.

[0076] More specifically, in one embodiment, step S110, which determines the abnormal data in the corresponding initial data information based on the residual values, includes: comparing each residual value with a preset residual threshold, and determining the abnormal data in the corresponding initial data information based on the comparison results.

[0077] The preset residual threshold can be set according to the initial data information of different modalities. It is used to compare with the residual value to identify abnormal data in the initial data information, which can ensure the quality of the initial data information and improve the reliability and effectiveness of the data anomaly detection process.

[0078] In an exemplary embodiment, determining abnormal data in the corresponding initial data information based on the comparison result includes: if the comparison result shows that the residual value is greater than a preset residual threshold, determining that the initial data information corresponding to the residual value is abnormal data.

[0079] Abnormal data refers to data points that deviate from the normal pattern.

[0080] More often, when the comparison result shows that the residual value is less than or equal to the preset residual threshold, it can be determined that the initial data information corresponding to the residual value is normal data. Accordingly, normal data refers to data points that conform to the expected pattern.

[0081] In this embodiment, by comparing the residual value with the residual threshold, abnormal data can be efficiently identified, which helps to improve the accuracy and reliability of data analysis.

[0082] Furthermore, as shown in Figure 2, a system diagram of a data anomaly detection method is provided, comprising five steps. The diffusion model noise-adding alignment, diffusion model denoising alignment, and attention mechanism are all within the same system. To better understand the process of the above data anomaly detection method, and in conjunction with Figure 3, the specific flow of a data anomaly detection method of this application is described in detail below, including the following steps:

[0083] Step S302: Receive initial data information from different modes.

[0084] The initial data information for different modalities may include image data, text data, traffic information, etc. This data is an important part of the training of artificial intelligence models. Attackers usually choose to inject backdoors by adding abnormal data to the dataset in order to interfere with the model output.

[0085] Step S304: Add noise to the initial data information for each mode using forward diffusion.

[0086] In the forward diffusion process, noise is gradually added to the initial data information of each modality. This process gradually removes the specific modal information of the data, so that the initial data information of all modalities tends to a similar potential distribution space. That is, the diffusion model "blurs" the detailed features of each modality by adding noise.

[0087] As an example, suppose the data of different modalities is X, and its corresponding modal features are Z. Noise is gradually added to the data. For each time step t, the expression for forward diffusion is as follows:

[0088]

[0089] Where Z0 represents the initial input features, Z t This represents the feature at time step t. It is the noise attenuation coefficient in forward diffusion, gradually reducing the original information in the features. N represents a normal distribution, and q(Z) t |Z0) represents the probability distribution or correlation under given initial conditions, and I represents the identity matrix.

[0090] Step S306: Align the target data information using backdiffusion recovery modal features.

[0091] Backdiffusion utilizes the initial data information of all modalities within the same latent space to recover the corresponding modal features, ensuring that the initial data information of different modalities can be aligned after passing through the diffusion model. Through this alignment process, the initial data information of different modalities maintains consistency across multiple modalities, making cross-modal comparison and fusion easier. The process of gradually recovering the initial data information from noisy features in backdiffusion can be represented by the following expression:

[0092] p(Z -1 |Z t )=N(Z t-1 μ θ (Z t ,t),∑ θ (Z t ,t))

[0093] Where μ θ (Z t ,t) is from the noise state Z t The estimated mean of the original features, ∑ θ (z t ,t) is the covariance matrix of the features. Through back diffusion, we can learn how to generate the alignment representation of the current modality based on the alignment information of other modalities, ensuring that different modalities are aligned in the shared latent space.

[0094] Step S308: Use an attention mechanism to identify key parts of the target data information.

[0095] Among them, the attention mechanism helps to focus on the potential poisoning areas in the target data information and identify potential anomalies or poisoning areas in the target data information.

[0096] Step S310: Detect abnormal data and locate the poisoning point.

[0097] Based on the results of steps S306 and S308, anomalies in the alignment of target data information can be identified through residual detection. If certain features cannot be accurately recovered after backdiffusion and attention recognition, resulting in large residuals, it can be inferred that these areas may have been poisoned. The mathematical expression for the residuals is as follows:

[0098] Residual(Z0,Z t )=||Z0-Z t ||

[0099] If the residual value is too large, it indicates that the characteristics of the modality may have been maliciously modified or poisoned.

[0100] More specifically, the flowchart for multimodal data poisoning attack detection is shown in Figure 4. After inputting the initial multimodal data information, forward diffusion noise is added. If the number of steps reaches the maximum number of steps T, reverse diffusion noise reduction is performed. Conversely, if the number of steps does not reach the maximum number of steps T, forward diffusion noise is added again. When reverse diffusion noise reduction reduces the number of steps to zero, the attention mechanism recognition function is activated to restore the features of the initial data information. Conversely, if reverse diffusion noise reduction does not reduce the number of steps to zero, noise reduction operation continues. Furthermore, if the residual value obtained after recognition by the attention mechanism is less than the threshold, it indicates that the data is normal, and the process ends. Conversely, if the residual value is greater than the threshold, it indicates that the data is abnormal. Through the above process, the data detection is completed, and the data detection result is obtained.

[0101] Through the above embodiments, based on the diffusion model, the initial data information of different modalities is aligned by using forward diffusion for noise addition and backward diffusion for denoising. This can cope with data of different modalities, cope with the infiltration of different malicious information, and defend against data poisoning attacks in complex scenarios. By using the attention mechanism to focus on specific areas, the waste of resources is reduced while ensuring the availability and security of the dataset. Furthermore, by using residual detection, the dataset containing malicious data is located while identifying the existence of malicious data.

[0102] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0103] Based on the same inventive concept, this application also provides a data anomaly detection device for implementing the data anomaly detection method described above. The solution provided by this device is similar to the implementation described in the above method; therefore, the specific limitations in one or more data anomaly detection device embodiments provided below can be found in the limitations of the data anomaly detection method described above, and will not be repeated here.

[0104] In an exemplary embodiment, as shown in FIG5, a data anomaly detection device is provided, comprising: an information acquisition module 501, a noise addition module 502, a feature recovery module 503, an information recognition module 504, and a result determination module 505, wherein:

[0105] The information acquisition module 501 is used to acquire initial data information of at least two modalities; the modality represents the type of the initial data information.

[0106] The noise addition module 502 is used to add noise to the initial data information of each mode using the forward diffusion of the diffusion model, so as to remove the preset mode features in the initial data information of each mode and obtain the corresponding similar mode information.

[0107] The feature recovery module 503 is used to recover the preset modal features of each similar modal information using the back diffusion of the diffusion model, so as to obtain the corresponding target data information, and to align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model.

[0108] Information recognition module 504 is used to identify preset key areas of aligned target data information using an attention mechanism;

[0109] The result determination module 505 is used to obtain the residual value of the target data information in each preset key area through residual detection, and to determine the abnormal data in the corresponding initial data information based on the residual value.

[0110] Furthermore, in one embodiment, the noise addition module 502 is also used to gradually add noise to the corresponding initial data information based on preset noise addition rules and preset number of steps for each modality's initial data information.

[0111] Furthermore, in one embodiment, the feature recovery module 503 is also used to gradually remove noise from the similar modal information based on preset noise removal rules and preset number of steps for the initial data information of each modality after noise has been added, so as to recover the preset modal features of each similar modal information.

[0112] Furthermore, in one embodiment, the result determination module 505 is also used to obtain residual values ​​based on the preset modal features of target data information in each preset key area and the features of target data information in each preset key area at each preset number of steps.

[0113] Furthermore, in one embodiment, the result determination module 505 is also used to compare the magnitude of each residual value with a preset residual threshold, and determine the abnormal data in the corresponding initial data information based on the comparison result.

[0114] Furthermore, in one embodiment, the result determination module 505 is also used to determine that the initial data information corresponding to the residual value is abnormal data when the comparison result is that the residual value is greater than a preset residual threshold.

[0115] Each module in the aforementioned data anomaly detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0116] In an exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram is shown in Figure 6. The computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is connected to the system bus via the I / O interfaces. The processor of the computer device provides computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database of the computer device stores data anomaly detection data. The I / O interfaces of the computer device are used for exchanging information between the processor and external devices. The communication interface of the computer device is used for communicating with external terminals via a network connection. When the computer program is executed by the processor, it implements a data anomaly detection method.

[0117] Those skilled in the art will understand that the structure shown in Figure 6 is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0118] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above-described method embodiments.

[0119] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0120] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0121] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0122] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0123] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0124] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting data anomalies, characterized in that, The method includes: Acquire initial data information in at least two modalities; the modality characterizes the type of the initial data information. The forward diffusion of the diffusion model is used to add noise to the initial data information of each modality to remove the preset modal features in the initial data information of each modality, so as to obtain the corresponding similar modal information. The preset modal features of each similar modal information are recovered by back diffusion of the diffusion model to obtain the corresponding target data information, and the target data information of each modality is aligned based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model. A preset key region for each aligned target data information is identified using an attention mechanism. The residual values ​​of the target data information in each of the preset key areas are obtained by residual detection, and the abnormal data in the corresponding initial data information are determined based on the residual values.

2. The method according to claim 1, characterized in that, The forward diffusion using the diffusion model adds noise to the initial data information for each modality, including: For each modality's initial data information, based on preset noise addition rules and preset number of steps, the noise is gradually added to the corresponding initial data information.

3. The method according to claim 2, characterized in that, The method of recovering the preset modal features of each similar modal information using the backdiffusion of the diffusion model includes: For the initial data information of each modality after the noise is added, the noise in the similar modality information is gradually removed based on the preset noise removal rules and the preset number of steps, so as to restore the preset modality features of each similar modality information.

4. The method according to claim 3, characterized in that, The step of obtaining the residual values ​​of the target data information within each of the preset key regions through residual detection includes: The residual value is obtained based on the preset modal features of the target data information in each preset key region and the features of the target data information in each preset key region at each preset number of steps.

5. The method according to claim 4, characterized in that, The step of determining the abnormal data in the corresponding initial data information based on the residual value includes: Compare each residual value with a preset residual threshold, and determine the abnormal data in the corresponding initial data information based on the comparison results.

6. The method according to claim 5, characterized in that, The step of determining the abnormal data in the corresponding initial data information based on the comparison results includes: If the comparison result shows that the residual value is greater than the preset residual threshold, the initial data information corresponding to the residual value is determined to be the abnormal data.

7. A data anomaly detection device, characterized in that, The device includes: An information acquisition module is used to acquire initial data information in at least two modalities; the modality represents the type of the initial data information. The noise addition module is used to add noise to the initial data information of each modality using the forward diffusion of the diffusion model, so as to remove the preset modal features in the initial data information of each modality and obtain the corresponding similar modal information. The feature recovery module is used to recover the preset modal features of each similar modal information using the back diffusion of the diffusion model, so as to obtain the corresponding target data information, and to align the target data information of each modality based on the modal data corresponding to the preset modal features; the modal data is updated in real time based on the diffusion model; The information recognition module is used to identify preset key regions of each aligned target data information using an attention mechanism; The result determination module is used to obtain the residual value of the target data information in each of the preset key areas through residual detection, and to determine the abnormal data in the corresponding initial data information based on the residual value.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images