CN110852374B - Data detection method, device, electronic equipment and storage medium - Google Patents
Data detection method, device, electronic equipment and storage medium Download PDFInfo
- Publication number
- CN110852374B CN110852374B CN201911090328.6A CN201911090328A CN110852374B CN 110852374 B CN110852374 B CN 110852374B CN 201911090328 A CN201911090328 A CN 201911090328A CN 110852374 B CN110852374 B CN 110852374B
- Authority
- CN
- China
- Prior art keywords
- data
- clustering
- range interval
- target
- cluster
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/23—Clustering techniques
- G06F18/232—Non-hierarchical techniques
- G06F18/2321—Non-hierarchical techniques using statistics or function optimisation, e.g. modelling of probability density functions
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F18/00—Pattern recognition
- G06F18/20—Analysing
- G06F18/24—Classification techniques
- G06F18/243—Classification techniques relating to the number of classes
- G06F18/2433—Single-class perspective, e.g. one-against-all classification; Novelty detection; Outlier detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/008—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption
Landscapes
- Engineering & Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Artificial Intelligence (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Life Sciences & Earth Sciences (AREA)
- Evolutionary Computation (AREA)
- Bioinformatics & Cheminformatics (AREA)
- Bioinformatics & Computational Biology (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Biology (AREA)
- Computer Networks & Wireless Communication (AREA)
- Probability & Statistics with Applications (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The embodiment of the invention discloses a data detection method, a device, electronic equipment and a storage medium, wherein the data detection method comprises the following steps: encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data, sending the encrypted data to a server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, receiving a first clustering result returned by the server, decrypting the first clustering result through the homomorphic encryption algorithm, determining a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, acquiring a range interval value corresponding to the target clustering center, and detecting the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected.
Description
Technical Field
The present invention relates to the field of computer technologies, and in particular, to a data detection method, a data detection device, an electronic device, and a storage medium.
Background
With the development of communication technology, data security is receiving more and more attention, taking enterprise data security as an example, in order to prevent lawbreakers from obtaining some data of enterprises to get profits, data will be generally detected, and currently, a common detection scheme may be based on a rule-based anomaly detection scheme and a traditional machine learning-based anomaly detection scheme.
In the above mentioned schemes, sufficient data is required as support to perform abnormality detection in a global scope, so as to find a real abnormality, however, the reason limited by the information island still uses an abnormality detection algorithm under the condition of insufficient data volume, which may cause inaccurate detection results.
Disclosure of Invention
The embodiment of the invention provides a data detection method, a data detection device, electronic equipment and a storage medium, which can improve the accuracy of data detection.
The embodiment of the invention provides a data detection method, which comprises the following steps:
encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data;
the encrypted data is sent to a server, so that the server clusters the encrypted data based on the data acquired from different terminals;
Receiving a first clustering result returned by the server, and decrypting the first clustering result by adopting the homomorphic encryption algorithm;
determining a target cluster center and a membership value of a cluster to which the data to be detected belong according to the decrypted first cluster result;
and obtaining a range interval value corresponding to the target cluster center, and detecting the data to be detected through the membership value, the range interval value and the target cluster center to obtain a detection result corresponding to the data to be detected.
Correspondingly, the embodiment of the invention also provides a data detection device, which comprises:
the encryption module is used for encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data;
the sending module is used for sending the encrypted data to the server so that the server can cluster the encrypted data based on the data acquired from different terminals;
the decryption module is used for receiving the first clustering result returned by the server and decrypting the first clustering result by adopting the homomorphic encryption algorithm;
the determining module is used for determining a target cluster center and a membership value of a cluster to which the data to be detected belong according to the decrypted first cluster result;
The acquisition module is used for acquiring a range interval value corresponding to the target clustering center;
the detection module is used for detecting the data to be detected through the membership value, the range interval value and the target clustering center, and obtaining a detection result corresponding to the data to be detected.
Optionally, in some embodiments of the present invention, the detection module includes:
the extraction unit is used for extracting all the clustering centers in the decrypted clustering result;
the calculating unit is used for calculating the distance between the target clustering center and each clustering center;
the detection unit is used for detecting the data to be detected based on the membership value, the range interval value and the distance to obtain a detection result corresponding to the data to be detected.
Optionally, in some embodiments of the present invention, the detection unit is specifically configured to:
and when the distance is smaller than or equal to a first threshold value, judging whether the target membership value is positioned in the range interval value of the target clustering center, and if the target membership value is positioned in the range interval value of the target clustering center, determining that the object to be detected is normal data.
Optionally, in some embodiments of the present invention, the detection unit is specifically further configured to:
When the distance between the target cluster center and other cluster centers is larger than a first threshold value, determining the object to be detected as abnormal data, or alternatively;
and when the distance between the target cluster center and other cluster centers is smaller than or equal to a first threshold value and the target membership value is not in the range interval value of the target cluster center, determining the object to be detected as abnormal data.
Optionally, in some embodiments of the present invention, the method further includes a training module, where the training module is specifically configured to:
acquiring a sample data set, wherein the sample data set comprises a plurality of sample data with normal data condition labels;
encrypting the sample data of the sample data set through a preset homomorphic encryption algorithm to obtain an encrypted data set;
the encrypted data set is sent to a server, so that the server clusters the data in the encrypted data set based on the data acquired from different terminals;
receiving a second aggregation result returned by the server, and decrypting the second aggregation result by adopting the homomorphic encryption algorithm;
determining a clustering center of a cluster to which the sample data belongs and a membership value corresponding to the sample data according to the decrypted second clustering result;
Calculating a range interval value of a clustering center of a cluster to which the sample data belongs according to a membership value corresponding to the sample data;
predicting the data condition of the sample data through the membership value corresponding to the sample data, the clustering center of the cluster to which the sample data belongs and the range interval value of the clustering center of the cluster to which the sample data belongs, so as to obtain the predicted data condition of the sample data;
according to the real data condition and the predicted data condition, the clustering centers of the clusters to which the sample data belong are adjusted until the clustering centers of the clusters to which the sample data belong meet the preset conditions;
storing range interval values corresponding to clustering centers meeting preset conditions;
the obtaining module is specifically configured to obtain a range interval value corresponding to the target cluster center from the saved range interval values.
Optionally, in some embodiments of the present invention, a building module is further included, where the building module is specifically configured to:
extracting attribute information of a clustering center corresponding to the sample data;
and constructing a mapping relation between the attribute information and the range interval value.
Optionally, in some embodiments of the present invention, the determining module is specifically configured to:
extracting attribute information corresponding to the target clustering center;
And acquiring a range interval value corresponding to the target cluster center from the stored range interval values based on a preset mapping relation.
Optionally, in some embodiments of the present invention, the decryption module is specifically configured to:
acquiring a decryption function corresponding to the data to be detected based on a preset homomorphic encryption algorithm;
and decrypting the first clustering result through a decryption function.
According to the embodiment of the invention, after the data to be detected is encrypted through a preset homomorphic encryption algorithm, the encrypted data is sent to a server, so that the server clusters the encrypted data based on the data acquired from different terminals, then a first clustering result returned by the server is received, the first clustering result is decrypted through the homomorphic encryption algorithm, then a target clustering center and a membership value of a cluster to which the data to be detected belongs are determined according to the decrypted first clustering result, finally a range interval value corresponding to the target clustering center is acquired, and the data to be detected is detected through the membership value, the range interval value and the target clustering center, so that a detection result corresponding to the data to be detected is obtained. Therefore, the scheme can effectively detect the accuracy of data.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings that are needed in the description of the embodiments will be briefly described below, it being obvious that the drawings in the following description are only some embodiments of the present invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.
Fig. 1a is a schematic view of a scenario of a data detection method according to an embodiment of the present invention;
FIG. 1b is a schematic flow chart of a data detection method according to an embodiment of the present invention;
FIG. 2a is a schematic diagram of another flow chart of a data detection method according to an embodiment of the present invention;
FIG. 2b is a schematic diagram of a mapping relationship provided by an embodiment of the present invention
Fig. 2c is a schematic diagram of another scenario of the data detection method according to the embodiment of the present invention;
FIG. 2d is an interface diagram of a detection result provided by an embodiment of the present invention;
fig. 3a is a schematic structural diagram of a first implementation of the data detection device according to the embodiment of the present invention;
FIG. 3b is a schematic diagram illustrating a second embodiment of a data detection device according to an embodiment of the present invention;
FIG. 3c is a schematic structural diagram of a third embodiment of a data detection device according to an embodiment of the present invention;
Fig. 4 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.
Detailed Description
The following description of the embodiments of the present invention will be made clearly and completely with reference to the accompanying drawings, in which it is apparent that the embodiments described are only some embodiments of the present invention, but not all embodiments. All other embodiments, which can be made by those skilled in the art based on the embodiments of the invention without making any inventive effort, are intended to fall within the scope of the invention.
The embodiment of the invention provides a data detection system, which is hereinafter referred to as a detection system.
The detection system may include a user, a terminal, and a server, and the data detection device may be specifically integrated in the terminal, and the terminal may include a mobile phone, a tablet computer, or a personal computer (PC, personal Computer).
For example, referring to fig. 1a, the data detection device is integrated on a personal computer, when the personal computer receives a data detection instruction triggered by a user, the computer may acquire data to be detected corresponding to the data detection instruction, encrypt the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data, and send the encrypted data to a server, so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, then the personal computer receives a first clustering result returned by the server, decrypts the first clustering result through the homomorphic encryption algorithm, then determines a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, finally acquires a range interval value corresponding to the target clustering center, and detects the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected.
According to the scheme, the data to be detected is encrypted through the homomorphic encryption algorithm, and the server cannot acquire the specific numerical value of the data to be detected, so that the safety of data detection is improved; in addition, the server can perform clustering processing on the encrypted data based on the data acquired from different terminals, so that the problem that the current data detection scheme is limited by the data island, so that false alarm caused by too small data volume is caused, and the accuracy of data detection is improved.
The following will describe in detail. It should be noted that the following description order of embodiments is not a limitation of the priority order of embodiments.
A data detection method, comprising: encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data, sending the encrypted data to a server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, receiving a first clustering result returned by the server, decrypting the first clustering result through the homomorphic encryption algorithm, determining a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, acquiring a range interval value corresponding to the target clustering center, and detecting the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected.
Referring to fig. 1b, fig. 1b is a flow chart of a data detection method according to an embodiment of the invention. The specific flow of the data detection method can be as follows:
101. and encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data.
Specifically, the data to be detected can be obtained from a local database, and then the data to be detected is encrypted through a preset homomorphic encryption algorithm to obtain encrypted data.
Among them, homomorphic encryption is an encryption method that allows mathematical operations to be performed on data, not on actual data itself. Ciphertext is an encrypted version of the input data, also known as plain text, which is manipulated and then decrypted to obtain the desired output. The key to homomorphic encryption is to obtain the same output from the ciphertext of the decryption operation, rather than simply manipulating the original plain text. That is, homomorphic encryption is a method that can perform computation without decrypting encrypted data in advance, and the use of homomorphic encryption techniques to encrypt the original data does not cause any significant change in the properties of the original data.
Alternatively, embodiments of the present invention may employ a lightweight homomorphic encryption algorithm. The lightweight homomorphic encryption algorithm comprises addition, subtraction and multiplication, and can ensure the privacy of each data source, enlarge the scale of data to be detected, reduce the memory of the occupied terminal and further improve the data detection efficiency.
102. The encrypted data is sent to the server so that the server performs clustering processing on the encrypted data based on the data acquired from the different terminals.
Because the encrypted data is the data to be detected encrypted by the preset homomorphic encryption algorithm, the server cannot acquire the true value of the data to be detected, the server can acquire the data of different terminals, the data can also be the encrypted data, and then the server performs clustering processing on the encrypted data based on the data, so that false alarm caused by insufficient data quantity of the terminals can be reduced, and the accuracy of data detection is improved.
In addition, the server may perform clustering on the encrypted data by using a Fuzzy C-Means (FCM), and of course, a K-Means clustering algorithm (K-Means Clustering algorithm) may also be used, where the concept of blurring is described, and the ambiguity refers to that the extension of the concept has uncertainty, or that the extension of the concept is unclear. Such as "young" which connotes our knowledge, but its extension, i.e. what age group of people fit younger, is difficult to clarify because there is no definite boundary between "young" and "not young", which is a vague concept. It is considered that the age of 20 is "young", and then 21 belongs to "not young" according to a deterministic schedule. However, it is also believed that both the age of 20 and 21 fall within the category of "young", and that the age of 21 is considered to be 0.9 minutes as young and 0.1 minutes as not young, where 0.9 and 0.1 refer to a similar degree. The degree to which such a sample belongs to the result is referred to as the membership of the sample and represents an indicator of the degree to which a sample resembles a different result.
103. And receiving a first clustering result returned by the server, and decrypting the first clustering result by adopting a homomorphic encryption algorithm.
Since the first clustering result returned by the server is a clustering result corresponding to the encrypted data, it is necessary to decrypt the first clustering result by using a homomorphic encryption algorithm, for example, a corresponding decryption function may be obtained according to the homomorphic encryption algorithm, and then, the first clustering result is decrypted by using the decryption function, that is, in some embodiments, the step of "decrypting the first clustering result by using the homomorphic encryption algorithm" includes:
(11) Acquiring a decryption function corresponding to the data to be detected based on a preset homomorphic encryption algorithm;
(12) And decrypting the first clustering result through a decryption key.
For example, the data a to be detected is encrypted by the encryption function F to obtain encrypted data a ', that is, F (a) =a', and thus the decryption function F corresponding to the encryption function F can be obtained -1 Then, it can pass through this decryption function F -1 And decrypting the first clustering result. It should be noted thatFor a general encryption function, if the encrypted data D ' and the encrypted data E ' are added to obtain superimposed encrypted data H ', at this time, the decryption function F is used -1 Decryption of H' results in a generally nonsensical scrambling code, but if the encryption function F is one that can be homomorphic, then the decryption function F is passed -1 And decrypting the H' to obtain a decryption result H, wherein at the moment, H=D+E, so that the data processing right and the data ownership can be separated, and for enterprises, the enterprises can process the self data by utilizing the computing capacity of the cloud service while preventing the self data from being leaked.
It should be noted that, the encryption function in the homomorphic encryption algorithm may be divided into an addition homomorphic and a multiplication homomorphic, and if F (a) +f (B) =f (a+b), such encryption function is called an addition homomorphic; if F (a) ×f (B) =f (a×b), such an encryption function is called a multiplication homomorphic; if an encryption function satisfies both an addition homomorphic and a multiplication homomorphic, it is called isomorphic encryption.
104. And determining a target cluster center and a membership value of the cluster to which the data to be detected belong according to the decrypted first cluster result.
The target cluster center of the cluster to which the data to be detected belongs may be extracted from the decrypted first cluster result, and the membership value of the target cluster center to which the data to be detected belongs may be extracted from the decrypted first cluster result.
Here, a concept of membership value is introduced, the membership belongs to the concept in the fuzzy evaluation function, and for any element x in the domain U, there is a number a (x) ∈ (0, 1) corresponding to it, so that a is called a fuzzy set on U, and a (x) is called a membership value of x to a. The closer the membership A (x) is to 1, the higher the degree that x belongs to A, and the closer A (x) is to 0, the lower the degree that x belongs to A. The degree of the degree that x belongs to A is represented by a membership function A (x) with a value in a range (0, 1).
105. And obtaining a range interval value corresponding to the target cluster center, and detecting the data to be detected through the membership value, the range interval value and the target cluster center to obtain a detection result corresponding to the data to be detected.
The step of obtaining the range interval value corresponding to the target cluster center may specifically include:
(21) Acquiring a sample data set, wherein the sample data set comprises a plurality of sample data with normal data condition labels;
(22) Encrypting sample data of the sample data set through a preset homomorphic encryption algorithm to obtain an encrypted data set;
(23) The encrypted data set is sent to a server, so that the server clusters the data in the encrypted data set based on the data acquired from different terminals;
(24) Receiving a second aggregation result returned by the server, and decrypting the second aggregation result by adopting a homomorphic encryption algorithm;
(25) Determining a clustering center of a cluster to which the sample data belongs and a membership value corresponding to the sample data according to the decrypted second clustering result;
(26) Calculating a range interval value of a clustering center of a cluster to which the sample data belongs according to a membership value corresponding to the sample data;
(27) Predicting the data condition of the sample data through the membership value corresponding to the sample data, the clustering center of the cluster to which the sample data belongs and the range interval value of the clustering center of the cluster to which the sample data belongs, so as to obtain the predicted data condition of the sample data;
(28) According to the real data condition and the predicted data condition, the clustering centers of the clusters to which the sample data belong are adjusted until the clustering centers of the clusters to which the sample data belong meet the preset conditions;
(29) Storing range interval values corresponding to clustering centers meeting preset conditions;
for example, a sample data set may be obtained, where the sample data set includes 10 sample data, and the data conditions of the 10 sample data are marked as normal, then the 10 sample data are encrypted by a homomorphic encryption algorithm to obtain an encrypted data set, and the encrypted data is sent to a server in a dense manner, so that the server may perform clustering processing on the data in the encrypted data set based on the data obtained from different terminals, then receive a second cluster result returned by the server, decrypt the second cluster result by the homomorphic encryption algorithm, where the decrypted second cluster result may include a cluster center of the cluster to which the sample data belongs and a membership value corresponding to the sample data, and then calculate a range interval value of the cluster center of the cluster to which the sample data belongs according to the membership value corresponding to the sample data, for example, may be calculated by the following formula
Wherein the membership value corresponding to the sample data is Xi, T (T 1 ，T 2 ) The range interval value representing the cluster center, n is the number of cluster centers, T1 represents the minimum value of the range interval value, and T2 represents the maximum value of the range interval value.
Then, predicting the data condition of the sample data according to the membership value corresponding to the sample data, the clustering center of the cluster to which the sample data belongs and the range interval value of the clustering center of the cluster to which the sample data belongs to obtain the predicted data condition of the sample data, and when the true data condition is consistent with the predicted data condition, considering that the clustering center of the cluster to which the sample data belongs meets the preset condition, and then, meeting the range interval value corresponding to the clustering center of the preset condition to the local; when the real data condition is inconsistent with the predicted data condition, the clustering centers of the clusters to which the sample data belong are adjusted until the clustering centers of the clusters to which the sample data belong meet the preset condition. That is, in some embodiments, the step of "obtaining the range interval value corresponding to the target cluster center" may specifically include: and acquiring a range interval value corresponding to the target cluster center from the stored range interval values.
Optionally, in some embodiments, the method specifically may further include:
(31) Extracting attribute information of a clustering center corresponding to the sample data;
(32) And constructing a mapping relation between the attribute information and the range interval value.
For example, the sample data set includes two sample data, where attribute information of a cluster center corresponding to one sample data is: finance, attribute information corresponding to a clustering center corresponding to another sample data is: in medical treatment, a mapping relationship between the attribute information and the range interval value may be constructed, so that subsequent use is facilitated, that is, in some embodiments, the step of "obtaining the range interval value corresponding to the cluster center" may specifically include:
(41) Extracting attribute information corresponding to a target clustering center;
(42) And acquiring a range interval value corresponding to the target cluster center from the stored range interval values based on a preset mapping relation.
For example, when it is determined that the attribute information corresponding to the target cluster center is "finance", the range interval value corresponding to "finance" may be obtained from the saved range interval values through a preset mapping relationship.
Optionally, in some embodiments, the step of detecting the data to be detected through the membership value, the range interval value and the target cluster center to obtain a detection result corresponding to the data to be detected may specifically include:
(51) Extracting all clustering centers in the decrypted clustering result;
(52) Calculating the distance between the target cluster center and each cluster center;
(53) And detecting the data to be detected based on the membership value, the range interval value and the distance to obtain a detection result corresponding to the data to be detected.
Specifically, whether all data of the target cluster center are normal or not can be judged through the distance between the target cluster center and each cluster center, whether the data to be detected are normal or not is judged through the membership value and the range interval value, when the distance between the target cluster center and each cluster center is smaller than the maximum value of the range interval value, whether the target membership value is located in the range interval value of the target cluster center or not can be judged, if the target membership value is located in the range interval value of the target cluster center, the current processing object is determined to be normal data, that is, in some embodiments, the step of detecting the data to be detected based on the membership value, the range interval value and the distance to obtain a detection result corresponding to the data to be detected can specifically include:
and when the distance is smaller than or equal to a first threshold value, judging whether the target membership value is positioned in the range interval value of the target clustering center, and if the target membership value is positioned in the range interval value of the target clustering center, determining that the object to be detected is normal data.
For example, in some embodiments, when the distance between the target cluster center and each cluster center is greater than the maximum value of the range interval value, all the data corresponding to the target cluster center may be considered as abnormal data, or when the distance between the target cluster center and each cluster center is less than the maximum value of the range interval value, if the target membership value is not located in the range interval value of the target cluster center, the current processing object is determined to be abnormal data, that is, the step of detecting the data to be detected based on the membership value, the range interval value and the distance to obtain a detection result corresponding to the data to be detected may further include
(61) When the distance between the target cluster center and other cluster centers is greater than a first threshold value, determining the current processing object as abnormal data, or alternatively;
(62) And when the distance between the target cluster center and other cluster centers is smaller than or equal to a first threshold value and the target membership value is not in the range interval value of the target cluster center, determining the object to be detected as abnormal data.
The embodiment of the invention encrypts the data to be detected through a preset homomorphic encryption algorithm, and then sends the encrypted data to a server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, then receives a first clustering result returned by the server, decrypts the first clustering result through the homomorphic encryption algorithm, then determines a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, finally acquires a range interval value corresponding to the target clustering center, and detects the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected. Compared with the existing data detection scheme, the data detection method can encrypt the data to be detected through the homomorphic encryption algorithm, so that the server cannot acquire the specific numerical value of the data to be detected, and the safety of data detection is improved; in addition, the server can perform clustering processing on the encrypted data based on the data acquired from different terminals, so that the problem that the current data detection scheme is limited by the data island, so that false alarm is caused by too little data quantity is solved, and the accuracy of data detection is improved.
The method according to the embodiment will be described in further detail by way of example.
In this embodiment, a description will be given taking an example in which the data detection device is specifically integrated in a terminal.
Referring to fig. 2a, a specific flow of the data detection method may be as follows:
201. the terminal encrypts the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data.
Specifically, the terminal may generate a key according to the data to be detected, where the key may include a public key and a private key, if the data is encrypted by using the public key, the data can be decrypted only by using the corresponding private key, then the data to be detected is divided into a plurality of random values, a multidimensional vector corresponding to the data to be detected is constructed according to the plurality of random values, and then the multidimensional vector is encoded by using the private key to obtain encrypted data.
202. The terminal transmits the encrypted data to the server so that the server performs clustering processing on the encrypted data based on the data acquired from the different terminals.
For example, after the terminal sends the encrypted data to the server, the server may perform clustering processing on the encrypted data by using a fuzzy clustering algorithm based on the data acquired from the different terminals, and of course, a K-means clustering algorithm may also be used.
203. And the terminal receives a first clustering result returned by the server and decrypts the first clustering result by adopting a homomorphic encryption algorithm.
For example, specifically, the terminal may obtain the private key corresponding to the public key used in step 201, and decrypt the first clustering result.
204. And the terminal determines a target cluster center and a membership value of the cluster to which the data to be detected belong according to the decrypted first cluster result.
For example, the terminal may extract, from the decrypted first clustering result, a target clustering center of a cluster to which the data to be detected belongs, and extract, from the decrypted first clustering result, a membership value of the target clustering center to which the data to be detected belongs.
205. The terminal obtains a range interval value corresponding to the target clustering center, and detects the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected.
It should be noted that, the server may obtain different terminal data in advance to perform clustering processing to obtain multiple clustering sets, where each clustering set includes at least one data, and each set corresponds to one clustering center, where the data conditions corresponding to these data are marked as normal, then the server may calculate a range interval value corresponding to each clustering center, in the terminal of the embodiment of the present invention, first may obtain a sample data set including sample data marked as normal in multiple data conditions, then the terminal may encrypt sample data of the sample data set through a preset homomorphic encryption algorithm to obtain an encrypted data set, then the terminal sends the encrypted data set to the server so that the server performs clustering processing on data in the encrypted data set based on data obtained from different terminals, and receives a second clustering result returned by the server, decrypts the second clustering result by adopting a homomorphic encryption algorithm, then the terminal may determine a clustering center to which the sample data belongs and a membership value corresponding to the sample data according to the decrypted second clustering result, then the terminal may calculate a clustering center and a clustering membership value corresponding to the sample data range according to the decrypted second clustering result, and may further adjust the clustering center until the clustering condition of the terminal can satisfy the preset data range corresponds to the clustering center.
In order to improve the efficiency of data detection, the terminal may construct a mapping relationship between attribute information of a cluster center and a range interval value, for example, a sample data set includes two sample data, where attribute information of the cluster center corresponding to one sample data is: finance, attribute information corresponding to a clustering center corresponding to another sample data is: in medical treatment, the terminal may construct a mapping relationship between the attribute information and the range interval value, so as to facilitate subsequent use, as shown in fig. 2 b.
In the actual data detection process, the terminal can judge whether all data of the target cluster center are normal or not through the distance between the target cluster center and each cluster center, judge whether the data to be detected are normal or not through the membership value and the range interval value, judge whether the target membership value is positioned in the range interval value of the target cluster center or not when the distance between the target cluster center and each cluster center is smaller than the maximum value of the range interval value, determine that the current processing object is normal data if the target membership value is positioned in the range interval value of the target cluster center, and consider all data corresponding to the target cluster center to be abnormal data when the distance between the target cluster center and each cluster center is larger than the maximum value of the range interval value, or determine that the current processing object is abnormal data if the target membership value is not positioned in the range interval value of the target cluster center.
The terminal in the embodiment of the invention encrypts the data to be detected through a preset homomorphic encryption algorithm, and then sends the encrypted data to the server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, then receives a first clustering result returned by the server, decrypts the first clustering result through the homomorphic encryption algorithm, then determines a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, finally acquires a range interval value corresponding to the target clustering center, and detects the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected. Compared with the existing data detection scheme, the terminal can encrypt the data to be detected through the homomorphic encryption algorithm, so that the server cannot acquire the specific numerical value of the data to be detected, and the safety of data detection is improved; in addition, the server can perform clustering processing on the encrypted data based on the data acquired from different terminals, so that the problem that the current data detection scheme is limited by the data island, so that false alarm is caused by too little data quantity is solved, and the accuracy of data detection is improved.
In order to facilitate understanding of the data detection method provided by the embodiment of the present invention, please refer to fig. 2c, describing a scenario of data detection by a data detection platform, firstly, a user logs in the data detection platform through a terminal, after user identification of the user passes verification, the user can upload data to be detected to a server through the terminal, the terminal can obtain the data to be detected, then, the terminal encrypts the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data, and sends the encrypted data to the server, so that the server performs clustering processing on the encrypted data based on the data obtained from different terminals, then, the terminal receives a first clustering result returned by the server, decrypts the first clustering result by adopting a homomorphic encryption algorithm, then, the terminal determines a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, and then, the terminal obtains a range interval value corresponding to the target clustering center, and detects the data to be detected through the membership value, the range interval value and the target clustering center, finally, the terminal obtains the data to be detected, and finally, the terminal and the data to be detected corresponds to the interface, such as shown by the attack interface, the attack interface can be shown by the figure 2, and the attack data can be seen from the interface.
In order to facilitate better implementation of the data detection method according to the embodiment of the present invention, the embodiment of the present invention further provides a data detection device (abbreviated as a detection device) based on the foregoing data detection device. The meaning of the nouns is the same as that of the data detection method, and specific implementation details can be referred to in the description of the method embodiment.
Referring to fig. 3a, fig. 3a is a schematic structural diagram of a data detection device according to an embodiment of the present invention, where the detection device may include an encryption module 301, a sending module 302, a decryption module 303, a determining module 304, an obtaining module 305, and a detection module 306, and may specifically be as follows:
the encryption module 301 is configured to encrypt data to be detected by using a preset homomorphic encryption algorithm, so as to obtain encrypted data.
The encryption module 301 may obtain the data to be detected from the local database, and then encrypt the data to be detected by a preset homomorphic encryption algorithm to obtain encrypted data.
And a sending module 302, configured to send the encrypted data to the server, so that the server performs clustering processing on the encrypted data based on the data acquired from the different terminals.
Because the encrypted data is the data to be detected encrypted by the preset homomorphic encryption algorithm, the server cannot acquire the true value of the data to be detected, the server can acquire the data of different terminals, the data can also be the encrypted data, and then the server performs clustering processing on the encrypted data based on the data, so that false alarm caused by insufficient data quantity of the terminals can be reduced, and the accuracy of data detection is improved.
And the decryption module 303 is configured to receive the first clustering result returned by the server, and decrypt the first clustering result by adopting a homomorphic encryption algorithm.
Optionally, in some embodiments, the decryption module 303 is specifically configured to: based on a preset homomorphic encryption algorithm, a decryption function corresponding to the data to be detected is obtained, and the first clustering result is decrypted through the decryption function.
Since the first clustering result returned by the server is a clustering result corresponding to the encrypted data, the first clustering result needs to be decrypted by adopting a homomorphic encryption algorithm, for example, the decryption module 303 may obtain a corresponding decryption function according to the homomorphic encryption algorithm, and then decrypt the first clustering result through the decryption function.
And the determining module 304 is configured to determine, according to the decrypted first clustering result, a target cluster center and a membership value of a cluster to which the data to be detected belongs.
The determining module 304 may extract, from the decrypted first clustering result, a target clustering center of a cluster to which the data to be detected belongs, and extract, from the decrypted first clustering result, a membership value of the target clustering center to which the data to be detected belongs.
The obtaining module 305 is configured to obtain a range interval value corresponding to the target cluster center.
Optionally, in some embodiments, referring to fig. 3b, the detection device may further include a training module 307, where the training module is specifically configured to: obtaining a sample data set, wherein the sample data set comprises a plurality of sample data with normal data condition labels, encrypting the sample data of the sample data set through a preset homomorphic encryption algorithm to obtain an encrypted data set, sending the encrypted data set to a server so that the server carries out clustering processing on the data in the encrypted data set based on the data obtained from different terminals, receiving a second clustering result returned by the server, decrypting the second clustering result through the homomorphic encryption algorithm, determining a clustering center of a cluster to which the sample data belongs and a membership value corresponding to the sample data according to the decrypted second clustering result, calculating a range interval value of the clustering center of the cluster to which the sample data belongs according to the membership value corresponding to the sample data, predicting the data condition of the sample data through the membership value corresponding to the sample data, the clustering center of the cluster to which the sample data belongs and the range interval value of the clustering center of the sample data, and adjusting the clustering center of the cluster to which the sample data belongs according to the real data condition and the predicted data condition until the clustering center of the sample data meets the preset condition, and storing the corresponding range value of the clustering center of the cluster to which the sample data belongs;
Optionally, in some embodiments, the obtaining module 305 is specifically configured to: and acquiring a range interval value corresponding to the target cluster center from the stored range interval values.
Optionally, in some embodiments, referring to fig. 3c, the detection apparatus further includes a construction module 308, where the construction module 308 is specifically configured to: and extracting attribute information of a clustering center corresponding to the sample data, and constructing a mapping relation between the attribute information and the range interval value.
Optionally, in some embodiments, the determining module 304 is specifically configured to: and extracting attribute information corresponding to the target cluster center, and acquiring a range interval value corresponding to the target cluster center from the stored range interval values based on a preset mapping relation.
The detection module 306 is configured to detect data to be detected through the membership value, the range interval value and the target cluster center, and obtain a detection result corresponding to the data to be detected.
Specifically, the detection module 306 may determine whether all data of the target cluster center is normal through a distance between the target cluster center and each cluster center, and determine whether the data to be detected is normal through a membership value and a range interval value.
Alternatively, in some embodiments, the detection module 306 may be specifically configured to: and when the distance is smaller than or equal to a first threshold value, judging whether the target membership value is positioned in the range interval value of the target clustering center, and if the target membership value is positioned in the range interval value of the target clustering center, determining that the object to be detected is normal data.
Optionally, in some embodiments, the detection module 306 may be further specifically configured to: and when the distance between the target cluster center and other cluster centers is larger than a first threshold value, determining the object to be detected as abnormal data, or when the distance between the target cluster center and other cluster centers is smaller than or equal to the first threshold value and the target membership value is not in the range interval value of the target cluster center, determining the object to be detected as abnormal data.
In the embodiment of the present invention, after encrypting data to be detected by a preset homomorphic encryption algorithm, a sending module 302 sends the encrypted data to a server, so that the server performs clustering processing on the encrypted data based on data acquired from different terminals, then a decryption module 303 receives a first clustering result returned by the server, decrypts the first clustering result by adopting the homomorphic encryption algorithm, then a determining module 304 determines a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, and finally an acquiring module 305 acquires a range interval value corresponding to the target clustering center, and a detecting module 306 detects the data to be detected by the membership value, the range interval value and the target clustering center, thereby obtaining a detection result corresponding to the data to be detected. Compared with the existing data detection scheme, the encryption module 301 of the invention can encrypt the data to be detected through the homomorphic encryption algorithm, so that the server cannot acquire the specific numerical value of the data to be detected, thereby improving the security of data detection; in addition, the server can perform clustering processing on the encrypted data based on the data acquired from different terminals, so that the problem that the current data detection scheme is limited by the data island, so that false alarm is caused by too little data quantity is solved, and the accuracy of data detection is improved.
In addition, the embodiment of the invention further provides an electronic device, as shown in fig. 4, which shows a schematic structural diagram of the electronic device according to the embodiment of the invention, specifically:
the electronic device may include one or more processing cores 'processors 401, one or more computer-readable storage media's memory 402, power supply 403, and input unit 404, among other components. Those skilled in the art will appreciate that the electronic device structure shown in fig. 4 is not limiting of the electronic device and may include more or fewer components than shown, or may combine certain components, or may be arranged in different components. Wherein:
the processor 401 is a control center of the electronic device, connects various parts of the entire electronic device using various interfaces and lines, and performs various functions of the electronic device and processes data by running or executing software programs and/or modules stored in the memory 402, and calling data stored in the memory 402, thereby performing overall monitoring of the electronic device. Optionally, processor 401 may include one or more processing cores; preferably, the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly processes an operating system, a user interface, an application program, etc., and the modem processor mainly processes wireless communication. It will be appreciated that the modem processor described above may not be integrated into the processor 401.
The memory 402 may be used to store software programs and modules, and the processor 401 executes various functional applications and data processing by executing the software programs and modules stored in the memory 402. The memory 402 may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program (such as a sound playing function, an image playing function, etc.) required for at least one function, and the like; the storage data area may store data created according to the use of the electronic device, etc. In addition, memory 402 may include high-speed random access memory, and may also include non-volatile memory, such as at least one magnetic disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.
The electronic device further comprises a power supply 403 for supplying power to the various components, preferably the power supply 403 may be logically connected to the processor 401 by a power management system, so that functions of managing charging, discharging, and power consumption are performed by the power management system. The power supply 403 may also include one or more of any of a direct current or alternating current power supply, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and the like.
The electronic device may further comprise an input unit 404, which input unit 404 may be used for receiving input digital or character information and generating keyboard, mouse, joystick, optical or trackball signal inputs in connection with user settings and function control.
Although not shown, the electronic device may further include a display unit or the like, which is not described herein. In particular, in this embodiment, the processor 401 in the electronic device loads executable files corresponding to the processes of one or more application programs into the memory 402 according to the following instructions, and the processor 401 executes the application programs stored in the memory 402, so as to implement various functions as follows:
encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data, sending the encrypted data to a server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, receiving a first clustering result returned by the server, decrypting the first clustering result through the homomorphic encryption algorithm, determining a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, acquiring a range interval value corresponding to the target clustering center, and detecting the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected.
The specific implementation of each operation above may be referred to the previous embodiments, and will not be described herein.
The embodiment of the invention encrypts the data to be detected through a preset homomorphic encryption algorithm, and then sends the encrypted data to a server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, then receives a first clustering result returned by the server, decrypts the first clustering result through the homomorphic encryption algorithm, then determines a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, finally acquires a range interval value corresponding to the target clustering center, and detects the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected. Compared with the existing data detection scheme, the data detection method can encrypt the data to be detected through the homomorphic encryption algorithm, so that the server cannot acquire the specific numerical value of the data to be detected, and the safety of data detection is improved; in addition, the server can perform clustering processing on the encrypted data based on the data acquired from different terminals, so that the problem that the current data detection scheme is limited by the data island, so that false alarm is caused by too little data quantity is solved, and the accuracy of data detection is improved.
Those of ordinary skill in the art will appreciate that all or a portion of the steps of the various methods of the above embodiments may be performed by instructions, or by instructions controlling associated hardware, which may be stored in a computer-readable storage medium and loaded and executed by a processor.
To this end, an embodiment of the present invention provides a storage medium having stored therein a plurality of instructions capable of being loaded by a processor to perform the steps of any of the data detection methods provided by the embodiments of the present invention. For example, the instructions may perform the steps of:
encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data, sending the encrypted data to a server so that the server performs clustering processing on the encrypted data based on the data acquired from different terminals, receiving a first clustering result returned by the server, decrypting the first clustering result through the homomorphic encryption algorithm, determining a target clustering center and a membership value of a cluster to which the data to be detected belongs according to the decrypted first clustering result, acquiring a range interval value corresponding to the target clustering center, and detecting the data to be detected through the membership value, the range interval value and the target clustering center to obtain a detection result corresponding to the data to be detected.
The specific implementation of each operation above may be referred to the previous embodiments, and will not be described herein.
Wherein the storage medium may include: read Only Memory (ROM), random access Memory (RAM, random Access Memory), magnetic or optical disk, and the like.
The instructions stored in the storage medium may perform steps in any data detection method provided by the embodiments of the present invention, so that the beneficial effects that any data detection method provided by the embodiments of the present invention can be achieved are detailed in the previous embodiments, and are not repeated herein.
The foregoing describes in detail a data detection method, apparatus, electronic device and storage medium provided in the embodiments of the present invention, and specific examples are applied to illustrate the principles and embodiments of the present invention, where the foregoing examples are only used to help understand the method and core idea of the present invention; meanwhile, as those skilled in the art will have variations in the specific embodiments and application scope in light of the ideas of the present invention, the present description should not be construed as limiting the present invention.
Claims (15)
1. A data detection method, comprising:
encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data;
the encrypted data is sent to a server, so that the server clusters the encrypted data based on the data acquired from different terminals;
receiving a first clustering result returned by the server, and decrypting the first clustering result by adopting the homomorphic encryption algorithm;
determining a target cluster center and a membership value of a cluster to which the data to be detected belong according to the decrypted first cluster result;
obtaining a range interval value corresponding to the target clustering center from a preset range interval value, detecting data to be detected based on a membership value, the range interval value and a distance, and obtaining a detection result corresponding to the data to be detected, wherein the preset range interval value is determined by a server through a preset homomorphic encryption algorithm based on data obtained from different terminals for detecting the sample data, and the distance represents the distance between the target clustering center and each clustering center in the decrypted clustering result.
2. The method according to claim 1, wherein the detecting the data to be detected based on the membership value, the range interval value, and the distance, to obtain a detection result corresponding to the data to be detected, the distance representing a distance between the target cluster center and each cluster center in the decrypted cluster result, includes:
Extracting all clustering centers in the decrypted clustering result;
calculating the distance between the target cluster center and each cluster center;
and detecting the data to be detected based on the membership value, the range interval value and the distance to obtain a detection result corresponding to the data to be detected.
3. The method according to claim 2, wherein the detecting the data to be detected based on the membership value, the range interval value and the distance to obtain the detection result corresponding to the data to be detected includes:
and when the distance is smaller than or equal to a first threshold value, judging whether the target membership value is positioned in the range interval value of the target clustering center, and if the target membership value is positioned in the range interval value of the target clustering center, determining that the object to be detected is normal data.
4. A method according to claim 3, further comprising:
when the distance between the target cluster center and other cluster centers is greater than a first threshold value, determining the current processing object as abnormal data, or alternatively;
and when the distance between the target cluster center and other cluster centers is smaller than or equal to a first threshold value and the target membership value is not in the range interval value of the target cluster center, determining the object to be detected as abnormal data.
5. The method according to any one of claims 1 to 4, wherein before the obtaining the range interval value corresponding to the cluster center from the preset range interval value, the method further includes:
acquiring a sample data set, wherein the sample data set comprises a plurality of sample data with normal data condition labels;
encrypting the sample data of the sample data set through a preset homomorphic encryption algorithm to obtain an encrypted data set;
the encrypted data set is sent to a server, so that the server clusters the data in the encrypted data set based on the data acquired from different terminals;
receiving a second aggregation result returned by the server, and decrypting the second aggregation result by adopting the homomorphic encryption algorithm;
determining a clustering center of a cluster to which the sample data belongs and a membership value corresponding to the sample data according to the decrypted second clustering result;
calculating a range interval value of a clustering center of a cluster to which the sample data belongs according to a membership value corresponding to the sample data;
predicting the data condition of the sample data through the membership value corresponding to the sample data, the clustering center of the cluster to which the sample data belongs and the range interval value of the clustering center of the cluster to which the sample data belongs, so as to obtain the predicted data condition of the sample data;
According to the real data condition and the predicted data condition, the clustering centers of the clusters to which the sample data belong are adjusted until the clustering centers of the clusters to which the sample data belong meet the preset conditions;
storing range interval values corresponding to clustering centers meeting preset conditions;
the obtaining the range interval value corresponding to the target cluster center from the preset range interval value comprises the following steps: and acquiring a range interval value corresponding to the target cluster center from the stored range interval value.
6. The method as recited in claim 5, further comprising:
extracting attribute information of a clustering center corresponding to the sample data;
and constructing a mapping relation between the attribute information and the range interval value.
7. The method of claim 6, wherein the obtaining the range interval value corresponding to the cluster center comprises:
extracting attribute information corresponding to the target clustering center;
and acquiring a range interval value corresponding to the target cluster center from the stored range interval values based on a preset mapping relation.
8. The method according to any one of claims 1 to 4, wherein decrypting the first clustering result using the homomorphic encryption algorithm comprises:
Acquiring a decryption function corresponding to the data to be detected based on a preset homomorphic encryption algorithm;
and decrypting the first clustering result through a decryption function.
9. A data detection apparatus, comprising:
the encryption module is used for encrypting the data to be detected through a preset homomorphic encryption algorithm to obtain encrypted data;
the sending module is used for sending the encrypted data to the server so that the server can cluster the encrypted data based on the data acquired from different terminals;
the decryption module is used for receiving the first clustering result returned by the server and decrypting the first clustering result by adopting the homomorphic encryption algorithm;
the determining module is used for determining a target cluster center and a membership value of a cluster to which the data to be detected belong according to the decrypted first cluster result;
the acquisition module is used for acquiring a range interval value corresponding to the target clustering center from a preset range interval value, wherein the preset range interval value is determined by a server through a preset homomorphic encryption algorithm based on data acquired from different terminals;
the detection module is used for detecting the data to be detected based on the membership value, the range interval value and the distance, so as to obtain a detection result corresponding to the data to be detected, and the distance represents the distance between the target clustering center and each clustering center in the decrypted clustering result.
10. The apparatus of claim 9, wherein the detection module comprises:
the extraction unit is used for extracting all the clustering centers in the decrypted clustering result;
the calculating unit is used for calculating the distance between the target clustering center and each clustering center;
the detection unit is used for detecting the data to be detected based on the membership value, the range interval value and the distance to obtain a detection result corresponding to the data to be detected.
11. The device according to claim 10, wherein the detection unit is specifically configured to:
and when the distance is smaller than or equal to a first threshold value, judging whether the target membership value is positioned in the range interval value of the target clustering center, and if the target membership value is positioned in the range interval value of the target clustering center, determining that the object to be detected is normal data.
12. The device according to claim 10, wherein the detection unit is further specifically configured to:
when the distance between the target cluster center and other cluster centers is greater than a first threshold value, determining the current processing object as abnormal data, or alternatively;
and when the distance between the target cluster center and other cluster centers is smaller than or equal to a first threshold value and the target membership value is not in the range interval value of the target cluster center, determining the object to be detected as abnormal data.
13. The apparatus according to any one of claims 9 to 12, further comprising a training module, in particular for:
acquiring a sample data set, wherein the sample data set comprises a plurality of sample data with normal data condition labels;
encrypting the sample data of the sample data set through a preset homomorphic encryption algorithm to obtain an encrypted data set;
the encrypted data set is sent to a server, so that the server clusters the data in the encrypted data set based on the data acquired from different terminals;
receiving a second aggregation result returned by the server, and decrypting the second aggregation result by adopting the homomorphic encryption algorithm;
determining a clustering center of a cluster to which the sample data belongs and a membership value corresponding to the sample data according to the decrypted second clustering result;
calculating a range interval value of a clustering center of a cluster to which the sample data belongs according to a membership value corresponding to the sample data;
predicting the data condition of the sample data through the membership value corresponding to the sample data, the clustering center of the cluster to which the sample data belongs and the range interval value of the clustering center of the cluster to which the sample data belongs, so as to obtain the predicted data condition of the sample data;
According to the real data condition and the predicted data condition, the clustering centers of the clusters to which the sample data belong are adjusted until the clustering centers of the clusters to which the sample data belong meet the preset conditions;
storing range interval values corresponding to clustering centers meeting preset conditions;
the obtaining module from the preset range interval value is specifically configured to obtain a range interval value corresponding to the target cluster center from the stored range interval values.
14. An electronic device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor implements the steps of the data detection method according to any one of claims 1-8 when the program is executed by the processor.
15. A computer readable storage medium, having stored thereon a computer program, wherein the computer program when executed by a processor implements the steps of the data detection method according to any of claims 1-8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911090328.6A CN110852374B (en) | 2019-11-08 | 2019-11-08 | Data detection method, device, electronic equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911090328.6A CN110852374B (en) | 2019-11-08 | 2019-11-08 | Data detection method, device, electronic equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110852374A CN110852374A (en) | 2020-02-28 |
| CN110852374B true CN110852374B (en) | 2023-05-02 |
Family
ID=69600140
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911090328.6A Active CN110852374B (en) | 2019-11-08 | 2019-11-08 | Data detection method, device, electronic equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110852374B (en) |
Families Citing this family (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111931221B (en) * | 2020-09-25 | 2021-01-01 | 支付宝(杭州)信息技术有限公司 | Data processing method and device and server |
| CN114362973B (en) * | 2020-09-27 | 2023-02-28 | 中国科学院软件研究所 | K-means and FCM clustering combined flow detection method and electronic device |
| CN112035671B (en) * | 2020-11-05 | 2021-02-26 | 腾讯科技（深圳）有限公司 | State detection method and device, computer equipment and storage medium |
| CN112468452B (en) * | 2020-11-10 | 2023-06-02 | 深圳市欢太科技有限公司 | Flow detection method and device, electronic equipment and computer readable storage medium |
| CN113063461B (en) * | 2021-03-17 | 2021-11-30 | 中旭京坤（北京）科技有限公司 | Detection method based on intelligent sensor |
| CN113436027B (en) * | 2021-06-30 | 2022-11-22 | 山大地纬软件股份有限公司 | Medical insurance reimbursement abnormal data detection method and system |
| CN113810493A (en) * | 2021-09-16 | 2021-12-17 | 中国电信股份有限公司 | Translation method, system, device and storage medium |
| CN117688502B (en) * | 2024-02-04 | 2024-04-30 | 山东大学 | Safe outsourcing calculation method and system for detecting local abnormal factors |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105069469A (en) * | 2015-07-30 | 2015-11-18 | 天津师范大学 | Data flow detection method based on fuzzy C-means clustering algorithm and entropy theory |
| CN108985361A (en) * | 2018-07-02 | 2018-12-11 | 北京金睛云华科技有限公司 | A kind of malicious traffic stream detection implementation method and device based on deep learning |
| CN109347834A (en) * | 2018-10-24 | 2019-02-15 | 广东工业大学 | Detection method, device and the equipment of abnormal data in Internet of Things edge calculations environment |
| CN109615021A (en) * | 2018-12-20 | 2019-04-12 | 暨南大学 | A kind of method for protecting privacy based on k mean cluster |
| CN109684118A (en) * | 2018-12-10 | 2019-04-26 | 深圳前海微众银行股份有限公司 | Detection method, device, equipment and the computer readable storage medium of abnormal data |
Family Cites Families (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US6950833B2 (en) * | 2001-06-05 | 2005-09-27 | Silicon Graphics, Inc. | Clustered filesystem |
-
2019
- 2019-11-08 CN CN201911090328.6A patent/CN110852374B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105069469A (en) * | 2015-07-30 | 2015-11-18 | 天津师范大学 | Data flow detection method based on fuzzy C-means clustering algorithm and entropy theory |
| CN108985361A (en) * | 2018-07-02 | 2018-12-11 | 北京金睛云华科技有限公司 | A kind of malicious traffic stream detection implementation method and device based on deep learning |
| CN109347834A (en) * | 2018-10-24 | 2019-02-15 | 广东工业大学 | Detection method, device and the equipment of abnormal data in Internet of Things edge calculations environment |
| CN109684118A (en) * | 2018-12-10 | 2019-04-26 | 深圳前海微众银行股份有限公司 | Detection method, device, equipment and the computer readable storage medium of abnormal data |
| CN109615021A (en) * | 2018-12-20 | 2019-04-12 | 暨南大学 | A kind of method for protecting privacy based on k mean cluster |
Non-Patent Citations (2)
| Title |
|---|
| EECDH to prevent MITM attack in cloud computing;Shajina Anand et al;《Digital Communications and Networks》;20191024;第5卷(第4期);276-287 * |
| 基于粒子滤波的网络入侵相频特征提取算法;陈利军等;《科技通报》;20160331;第32卷(第3期);101-104 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110852374A (en) | 2020-02-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110852374B (en) | Data detection method, device, electronic equipment and storage medium | |
| CN108681966B (en) | Information supervision method and device based on block chain | |
| WO2021189904A1 (en) | Data anomaly detection method and apparatus, and electronic device and storage medium | |
| CN111698088B (en) | Key alternation method, key alternation device, electronic equipment and medium | |
| WO2021208701A1 (en) | Method, apparatus, electronic device, and storage medium for generating annotation for code change | |
| CN109948320B (en) | Block chain-based identity recognition management method, device, medium and electronic equipment | |
| CN110197707B (en) | Block chain-based medical record information processing method, device, medium and electronic equipment | |
| CN114389889B (en) | File full life cycle management method and device based on block chain technology | |
| CN114826553A (en) | Cloud storage data security protection method and device based on group signature and homomorphic encryption | |
| CN106464502A (en) | Methods and systems for authentication of a communication device | |
| CN111950621A (en) | Target data detection method, device, equipment and medium based on artificial intelligence | |
| CN115758399A (en) | Intelligent medical information management method, device, equipment and medium based on medical networking | |
| KR102276669B1 (en) | Fish-shoal ecosystem monitoring system apparatus for detecting the abnormality of fish-shoal ecosystem and the operating method thereof | |
| CN114254360A (en) | Model training method, device, storage medium, system and block link point | |
| US20130117245A1 (en) | Method and system for identification of asset records in a version managed datastore | |
| CN114598556B (en) | IT infrastructure configuration integrity protection method and protection system | |
| CN115643090A (en) | Longitudinal federal analysis method, device, equipment and medium based on privacy retrieval | |
| CN113987206A (en) | Abnormal user identification method, device, equipment and storage medium | |
| CN115700887A (en) | Electronic medical record processing method and device, storage medium and electronic equipment | |
| JP2021149235A (en) | Information processing system, information processing method, information processing program, secret sharing system, secret sharing method, and secret sharing program | |
| CN115150196B (en) | Ciphertext data-based anomaly detection method, device and equipment under normal distribution | |
| CN116707835B (en) | Method and system for realizing patient information interaction based on blockchain | |
| CN116684077B (en) | Carbon emission monitoring method and device based on carbon platform | |
| CN114844810B (en) | Heartbeat data processing method, device, equipment and medium | |
| CN117688502B (en) | Safe outsourcing calculation method and system for detecting local abnormal factors |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| REG | Reference to a national code |
Ref country code: HK Ref legal event code: DE Ref document number: 40021717 Country of ref document: HK |
|
| GR01 | Patent grant | ||
| GR01 | Patent grant |