CN112149757A

CN112149757A - Abnormity detection method and device, electronic equipment and storage medium

Info

Publication number: CN112149757A
Application number: CN202011149579.XA
Authority: CN
Inventors: 史艳华
Original assignee: New H3C Big Data Technologies Co Ltd
Current assignee: New H3C Big Data Technologies Co Ltd
Priority date: 2020-10-23
Filing date: 2020-10-23
Publication date: 2020-12-29
Anticipated expiration: 2040-10-23
Also published as: CN112149757B

Abstract

The embodiment of the application provides an abnormality detection method and device, electronic equipment and a storage medium. The scheme is as follows: training a VAE model by using a plurality of sample data included in a preset training set; respectively inputting a plurality of sample data into the trained VAE model to obtain first output data corresponding to each sample data; determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and first output data corresponding to each sample data; determining a first reconstruction error corresponding to a target inflection point in a reconstruction error probability density distribution curve as an abnormal reconstruction error threshold; and carrying out anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model. According to the technical scheme provided by the embodiment of the application, the accuracy of the determined abnormal reconstruction error threshold value is improved, and therefore the accuracy of abnormal detection is improved.

Description

Abnormity detection method and device, electronic equipment and storage medium

Technical Field

The present disclosure relates to the field of internet technologies, and in particular, to an anomaly detection method and apparatus, an electronic device, and a storage medium.

Background

In the anomaly detection process, the use of supervised anomaly detection methods is limited due to the absence of anomalous sample data. Therefore, in the related art, an unsupervised abnormality detection method is often used for abnormality detection. For example, in the field of intelligent operation and maintenance, various operation and maintenance indexes are detected by an unsupervised abnormality detection method, so that abnormal data are determined.

At present, a Variational Auto-Encoder (VAE) anomaly detection method is one of the most promising unsupervised anomaly detection methods. Specifically, data to be detected is input into a trained VAE model, and an encoder in the VAE model extracts the distribution characteristics of the input data to be detected to obtain an implicit variable; and a decoder in the VAE model reconstructs the hidden variable to obtain reconstructed data, and the reconstructed data is output. And comparing the reconstruction error between the reconstruction data and the data to be detected with an abnormal reconstruction error threshold value, and determining the data to be detected with the reconstruction error larger than the abnormal reconstruction error threshold value as abnormal data.

However, the abnormal reconstruction error threshold is determined according to the preset quantiles set artificially, and the preset quantiles corresponding to different data cannot be determined artificially, so that the accuracy of the abnormal reconstruction error threshold determined according to the preset quantiles is poor, and the accuracy of abnormal detection is affected.

Disclosure of Invention

An object of the embodiments of the present application is to provide an anomaly detection method, an anomaly detection device, an electronic device, and a storage medium, so as to improve accuracy of a determined anomaly reconstruction error threshold, thereby improving accuracy of anomaly detection. The specific technical scheme is as follows:

the embodiment of the application provides an anomaly detection method, which comprises the following steps:

training a VAE model by using a plurality of sample data included in a preset training set, wherein the plurality of sample data include normal sample data and abnormal sample data;

respectively inputting the plurality of sample data into the trained VAE model to obtain first output data corresponding to each sample data;

determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and first output data corresponding to each sample data;

determining that a first reconstruction error corresponding to a target inflection point in the reconstruction error probability density distribution curve is an abnormal reconstruction error threshold, wherein the target inflection point is the leftmost point in points of the reconstruction error probability density distribution curve, the first-order difference of which is greater than or equal to 0, and the second-order difference of which is less than or equal to 0;

and carrying out anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model.

Optionally, the step of determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and the first output data corresponding to each sample data includes:

calculating the mean square error between the sample data and first output data corresponding to the sample data aiming at each sample data to obtain a first reconstruction error between the sample data and the first output data corresponding to the sample data;

determining a reconstruction error probability Density distribution curve by using a Kernel probability Density Estimation (KDE) algorithm based on a first reconstruction error between each sample data and first output data corresponding to each sample data; the KDE algorithm comprises a preset kernel function and a preset bandwidth.

Optionally, the preset kernel function is a uniform kernel function, a gaussian kernel function, an Epanechikov kernel function, or a Quartic (Quartic) kernel function;

the preset bandwidth is determined based on a scott bandwidth method or a silverman bandwidth method.

Optionally, the step of training the VAE model by using a plurality of sample data included in the preset training set includes:

acquiring the preset training set;

inputting a plurality of sample data included in the preset training set into a preset VAE model to obtain second output data corresponding to each sample data;

calculating a second reconstruction error between each sample data and second output data corresponding to each sample data;

when the difference value between the second reconstruction error of the training round and the second reconstruction error of the previous training round is larger than a preset difference value threshold value, adjusting the parameters of the preset VAE model, and returning to execute the step of inputting a plurality of sample data included in the preset training set into the preset VAE model to obtain second output data corresponding to each sample data;

and when the difference value between the second reconstruction error of the training round and the second reconstruction error of the previous training round is not larger than the preset difference value threshold, determining the current preset VAE model as the trained VAE model.

Optionally, the step of performing anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model includes:

inputting data to be detected into the trained VAE model to obtain third output data of the data to be detected;

calculating a third reconstruction error between the data to be detected and third output data of the data to be detected;

and when the third reconstruction error is larger than the abnormal reconstruction error threshold value, determining that the data to be detected is abnormal data.

An embodiment of the present application further provides an anomaly detection device, including:

the training module is used for training the VAE model by utilizing a plurality of sample data included in a preset training set, wherein the plurality of sample data include normal sample data and abnormal sample data;

the first output module is used for respectively inputting the plurality of sample data into the trained VAE model to obtain first output data corresponding to each sample data;

the first determining module is used for determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and first output data corresponding to each sample data;

a second determining module, configured to determine that a first reconstruction error corresponding to a target inflection point in the reconstruction error probability density distribution curve is an abnormal reconstruction error threshold, where the target inflection point is a leftmost point of points in the reconstruction error probability density distribution curve where a first-order difference is greater than or equal to 0 and a second-order difference is less than or equal to 0;

and the detection module is used for carrying out anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model.

Optionally, the first determining module is specifically configured to, for each sample data, calculate a mean square error between the sample data and the first output data corresponding to the sample data, to obtain a first reconstruction error between the sample data and the first output data corresponding to the sample data;

determining a reconstruction error probability density distribution curve by using a KDE algorithm based on a first reconstruction error between each sample data and first output data corresponding to each sample data; the KDE algorithm comprises a preset kernel function and a preset bandwidth.

Optionally, the preset kernel function is a uniform kernel function, a gaussian kernel function, an Epanechikov kernel function, or a Quartic kernel function;

Optionally, the training module is specifically configured to obtain the preset training set;

Optionally, the detection module is specifically configured to input data to be detected into the trained VAE model, so as to obtain third output data of the data to be detected;

The embodiment of the application also provides electronic equipment which comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus;

a memory for storing a computer program;

a processor for implementing any of the above described method steps of the anomaly detection method when executing a program stored in the memory.

An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, and when the computer program is executed by a processor, the method for detecting an abnormality as described above is implemented.

Embodiments of the present application further provide a computer program product containing instructions, which when run on a computer, cause the computer to perform any one of the above-mentioned anomaly detection methods.

The embodiment of the application has the following beneficial effects:

according to the anomaly detection method, the anomaly detection device, the electronic equipment and the storage medium, a reconstruction error probability density distribution curve can be determined according to reconstruction errors between each sample data included in a preset training set and output data corresponding to each sample data output by a trained VAE model, so that the reconstruction error corresponding to a target inflection point in the reconstruction error probability density distribution curve is determined as an anomaly reconstruction error threshold, and anomaly detection is performed on data to be detected according to the anomaly reconstruction error threshold and the trained VAE model. Compared with the abnormal reconstruction error threshold value corresponding to the preset quantile determined manually in the related technology, the method has the advantages that the reconstruction error between each sample data and the output data corresponding to each sample data output by the trained VAE model is utilized, the deviation of the abnormal reconstruction error threshold value determined according to the preset quantile set manually can be well eliminated, the accuracy of the determined abnormal reconstruction error threshold value is effectively improved, and therefore the accuracy of abnormal detection is improved.

Of course, not all advantages described above need to be achieved at the same time in the practice of any one product or method of the present application.

Drawings

In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and it is obvious for those skilled in the art that other embodiments can be obtained by using the drawings without creative efforts.

FIG. 1-a is a schematic view of a first structure of a conventional VAE model;

FIG. 1-b is a schematic diagram of input data and output data of a prior art trained VAE model;

FIG. 1-c is a schematic diagram of a second structure of a prior art VAE model;

fig. 2 is a first flowchart of an anomaly detection method according to an embodiment of the present application;

fig. 3 is a schematic flowchart of a second method for detecting an anomaly according to an embodiment of the present application;

fig. 4 is a schematic flow chart of a third method for detecting an anomaly according to an embodiment of the present application;

FIG. 5 is a schematic illustration of a long tail distribution provided by an embodiment of the present application;

fig. 6 is a schematic flowchart of a VAE model training method according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram illustrating sample data acquisition according to an embodiment of the present application;

fig. 8 is a fourth flowchart illustrating an anomaly detection method according to an embodiment of the present application;

FIG. 9 is a schematic illustration of a probability density distribution curve provided in an embodiment of the present application;

fig. 10 is a schematic structural diagram of an abnormality detection apparatus according to an embodiment of the present application;

fig. 11 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

When the VAE anomaly detection method is used for anomaly detection in the related art, the accuracy of an anomaly reconstruction error threshold value is poor, so that the accuracy of anomaly detection is influenced. For the sake of understanding, the VAE anomaly detection process in the related art will be described below with reference to fig. 1-a, 1-b, and 1-c. Fig. 1-a is a first structural diagram of a conventional VAE model, fig. 1-b is a diagram of input data and output data of a conventional trained VAE model, and fig. 1-c is a second structural diagram of a conventional VAE model.

In fig. 1-a, for example, the training data is 1000 images of cats and 1 image of a dog (i.e., the abnormal data is an image of a dog), each piece of training data is input into a trained VAE model, an encoder in the trained VAE model extracts the distribution characteristics of the input training data to obtain hidden variables, and a decoder in the trained VAE model reconstructs the hidden variables to obtain reconstructed data.

The reconstructed data output for the trained VAE model may be the same as the training data or may have a certain difference from the training data, for example, the reconstructed data may include certain derivative data, as shown in fig. 1-b, and the training data including handwritten numbers 0 to 9 is input to the trained VAE model to obtain the output data. The pattern of the numbers 0-9 in the input training data is not exactly the same as the pattern of the numbers 0-9 in the output data output by the VAE model, and even patterns not included in the input training data, i.e., derivative data, appear in the output data.

In the embodiment shown in fig. 1-a, the detailed description is made with reference to fig. 1-c, where the encoder in fig. 1-a is the mean variance calculation module in fig. 1-c, and the decoder in fig. 1-a is the generator in fig. 1-c. Assuming that the distribution characteristics of the training data satisfy normal distribution, the generation of the reconstruction data is specifically expressed as: when the input data for a trained VAE model is generated from each training data, such as an image of a cat, a matrix of pixel values representing the image may be used as input data (i.e., X in FIGS. 1-c)₁、X₂And X₃) Input to a mean variance calculation module to obtain corresponding means and variances, such as X₁Corresponding mean 1 and variance 1. Obtaining corresponding normal distribution according to the determined mean and variance, such as normal distribution 1 corresponding to mean 1 and variance 1, sampling distribution characteristics based on the determined normal distribution, thereby obtaining sampling variables, such as Z shown in FIG. 1-c₁、Z₂And Z₃I.e. the implicit variable mentioned above. Reconstructing the hidden variable by using a generator to obtain reconstructed data, namely Y shown in figure 1-c₁、Y₂And Y₃。

After the reconstruction data, that is, the output data of the trained VAE model, are obtained, the reconstruction error between each input data and the output data corresponding to the input data may be calculated, so that the reconstruction errors are arranged in the order from small to large, and the abnormal reconstruction error threshold corresponding to the preset quantile is determined. Taking the reconstruction errors between each input data and its corresponding output data obtained by calculation as the reconstruction errors 1 to 5 in sequence from small to large as an example, if the preset quantile is 80%, it may be determined that the abnormal reconstruction error threshold corresponding to the preset quantile is the reconstruction error 5 at this time. When the anomaly detection is performed, according to the method, a reconstruction error between the data to be detected and output data corresponding to the data to be detected output by the trained VAE model is determined, and when the reconstruction error is greater than or equal to a reconstruction error of 5, the data to be detected is determined to be anomalous data.

Since the preset quantiles are artificially determined, the accuracy of the abnormal reconstruction error threshold determined according to the preset quantiles is poor, and the accuracy of abnormal detection is affected.

In order to solve the problems that the accuracy of an abnormal reconstruction error threshold value is poor and the accuracy of abnormal detection is affected in the related art, the embodiment of the application provides an abnormal detection method. The method may be applied to any electronic device. In the method, a VAE model is trained by utilizing a plurality of sample data included in a preset training set, wherein the plurality of sample data include normal sample data and abnormal sample data; respectively inputting a plurality of sample data into the trained VAE model to obtain first output data corresponding to each sample data; determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and first output data corresponding to each sample data; determining a first reconstruction error corresponding to a target inflection point in a reconstruction error probability density distribution curve as an abnormal reconstruction error threshold, wherein the target inflection point is the leftmost point in points of which the first-order difference is greater than or equal to 0 and the second-order difference is less than or equal to 0 in the reconstruction error probability density distribution curve; and carrying out anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model.

According to the method provided by the embodiment of the application, the reconstruction error probability density distribution curve can be determined according to the reconstruction error between each sample data included in the preset training set and the output data corresponding to each sample data output by the trained VAE model, so that the reconstruction error corresponding to the target inflection point in the reconstruction error probability density distribution curve is determined as the abnormal reconstruction error threshold, and the abnormal detection is carried out on the data to be detected according to the abnormal reconstruction error threshold and the trained VAE model. Compared with the abnormal reconstruction error threshold value corresponding to the preset quantile determined manually in the related technology, the method has the advantages that the reconstruction error between each sample data and the output data corresponding to each sample data output by the trained VAE model is utilized, the deviation of the abnormal reconstruction error threshold value determined according to the preset quantile set manually can be well eliminated, the accuracy of the determined abnormal reconstruction error threshold value is effectively improved, and therefore the accuracy of abnormal detection is improved.

The following examples are given to illustrate the examples of the present application. For convenience of description, the following description will be made by taking an electronic device as an implementation subject, and does not have any limiting effect.

As shown in fig. 2, fig. 2 is a first flowchart of an abnormality detection method according to an embodiment of the present application. The method comprises the following steps.

Step S201, training the VAE model by using a plurality of sample data included in a preset training set, wherein the plurality of sample data include normal sample data and abnormal sample data.

The number of the above normal sample data is much larger than that of the abnormal sample data. In addition, according to different scenes to which the VAE anomaly detection method is applied, sample data included in the preset training set is different. For example, when the VAE anomaly detection method is applied to image detection, such as identifying an image of a dog included in an image of a cat, the sample data may be a data matrix generated from pixel values corresponding to respective pixel points in the image. For another example, when the VAE anomaly detection method is applied to anomaly detection in the intelligent operation and maintenance, the sample data may be a time sequence formed by operation and maintenance indicators corresponding to a plurality of time points. The operation and maintenance index includes, but is not limited to, CPU utilization, memory utilization, CPU temperature, traffic, bandwidth utilization, session number, delay, response time, and retransmission rate.

In this embodiment of the application, in order to facilitate distinguishing between normal sample data and abnormal sample data in the sample data, the electronic device may identify the abnormal sample data.

For the above-mentioned acquisition of the preset training set and the training of the VAE model, refer to the following description, which is not repeated herein.

Step S202, a plurality of sample data are respectively input into the trained VAE model, and first output data corresponding to each sample data are obtained.

In an optional embodiment, the electronic device may directly obtain the output reconstruction data corresponding to each sample data input in the last round of the trained VAE model training process, so as to obtain the first output data corresponding to each sample data.

In another optional embodiment, because the input data used in the training process of the VAE model may not include all sample data in the preset training set, in order to improve the accuracy of the determined abnormal reconstruction error threshold, after the trained VAE model is obtained through training, the electronic device may input each sample data in the preset training set into the trained VAE model, and use each reconstructed data output by the trained VAE model as the first output data corresponding to each sample data.

Step S203, determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and the first output data corresponding to each sample data.

In the embodiment of the present application, the horizontal direction of the reconstruction error probability density distribution curve represents a reconstruction error value, that is, the first reconstruction error, and the vertical direction represents a probability density.

For the calculation of the first reconstruction error and the determination of the reconstruction error probability density distribution curve, reference may be made to the following description, which is not repeated herein.

Step S204, determining that a first reconstruction error corresponding to a target inflection point in the reconstruction error probability density distribution curve is an abnormal reconstruction error threshold, wherein the target inflection point is the leftmost point in points of which the first-order difference is greater than or equal to 0 and the second-order difference is less than or equal to 0 in the reconstruction error probability density distribution curve.

In this step, the electronic device may determine a position of the target inflection point on the reconstruction error probability density distribution curve, so as to determine a first reconstruction error corresponding to the target inflection point in the horizontal direction as an abnormal reconstruction error threshold.

For the determination of the target inflection point, reference may be made to the following description, which is not repeated herein.

And S205, performing anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model.

In this step, the electronic device may determine, by using the trained VAE model, third output data corresponding to the data to be detected, so as to determine whether the data to be detected is abnormal data according to a reconstruction error between the data to be detected and the third output data corresponding to the data to be detected and the abnormal reconstruction error threshold.

For the data to be detected, the following description may be specifically referred to, and details are not repeated herein.

By using the method shown in fig. 1, a reconstruction error probability density distribution curve may be determined according to a reconstruction error between each sample data included in a preset training set and output data corresponding to each sample data output by a trained VAE model, so that a reconstruction error corresponding to a target inflection point in the reconstruction error probability density distribution curve is determined as an abnormal reconstruction error threshold, and abnormal detection is performed on data to be detected according to the abnormal reconstruction error threshold and the trained VAE model. Compared with the abnormal reconstruction error threshold value corresponding to the preset quantile determined manually in the related technology, the method has the advantages that the reconstruction error between each sample data and the output data corresponding to each sample data output by the trained VAE model is utilized, the deviation of the abnormal reconstruction error threshold value determined according to the preset quantile set manually can be well eliminated, the accuracy of the determined abnormal reconstruction error threshold value is effectively improved, and therefore the accuracy of abnormal detection is improved.

In an optional embodiment, according to the method shown in fig. 2, an anomaly detection method is further provided in the embodiment of the present application. As shown in fig. 3, fig. 3 is a second flowchart of the anomaly detection method according to the embodiment of the present application. In this method, the above-described step S203 is subdivided into the following step S2031 to step S2032.

Step S2031, for each sample data, calculating a mean square error between the sample data and the first output data corresponding to the sample data, and obtaining a first reconstruction error between the sample data and the first output data corresponding to the sample data.

In an alternative embodiment, the electronic device may calculate a mean square Error between each sample data and the first output data corresponding to each sample data by using the following formula, that is, the first reconstruction Error may be expressed as:

wherein m is the number of samples, | is the norm operation, X_outIs the first output data corresponding to the sample data, X_inIs the sample data.

In another alternative embodiment, the electronic device may calculate a relative reconstruction error between each sample data and the first output data corresponding to each sample data as the first reconstruction error. The method of calculating the relative reconstruction error will not be specifically described here.

In the embodiment of the present application, the first reconstruction error may be calculated by using a plurality of reconstruction error calculation methods, and the calculation method of the first reconstruction error is not particularly limited.

Step S2032, based on a first reconstruction error between each sample data and the first output data corresponding to each sample data, determining a probability density distribution curve of the reconstruction error by using a KDE algorithm; the KDE algorithm comprises a preset kernel function and a preset bandwidth.

In this step, the electronic device may use each of the first reconstruction errors as a data point, and generate a plurality of kernel functions according to the data point by using a preset kernel function and a preset bandwidth, so as to linearly superimpose the plurality of kernel functions to obtain an estimation function of kernel density. The electronic equipment normalizes the estimation function of the kernel density to obtain a corresponding kernel density probability density function. The curve corresponding to the kernel density probability density function is a reconstruction error probability density distribution curve.

In an alternative embodiment, the electronic device may determine the reconstruction error probability density distribution curve using the following equation:

wherein the content of the first and second substances,

is a probability density distribution function, n is the number of first reconstruction errors, h is a preset bandwidth, and the function

For a predetermined kernel function, x is all first reconstruction errors, x_iIs the ith first reconstruction error.

In an alternative embodiment, the predetermined kernel function may be a uniform kernel function, a gaussian kernel function, an Epanechikov kernel function, or a Quartic kernel function. Among them, the Epanechikov kernel function may be referred to as an Epinechikov kernel function.

In this embodiment of the application, according to different specific application scenarios of the VAE anomaly detection method, the first reconstruction error may be matched with different data distribution characteristics, such as gaussian distribution, uniform distribution, and the like. Therefore, in a case where the data distribution characteristic matched with the first reconstruction error is known, the electronic device may determine a function corresponding to the data distribution characteristic matched with the first reconstruction error as the preset kernel function. Under the condition that the data distribution characteristics matched with the first reconstruction error are unknown, considering the convenient mathematical property of a Gaussian kernel, the preset kernel function can select the Gaussian kernel function or select functions corresponding to other distribution characteristics, such as the Epanechov kernel function or the Quartic kernel function.

In the embodiment of the present application, the preset kernel function satisfies a feature that is symmetrical with respect to the origin and has an integral of 1. The selection of the predetermined kernel function is not particularly limited herein.

In an alternative embodiment, the preset bandwidth may be determined based on a scott bandwidth method or a silverman bandwidth method. Among them, the scott bandwidth method may also be called scott bandwidth method, and the silverman bandwidth method may also be called the sierfmann bandwidth method.

In the embodiment of the present application, the selection of the preset bandwidth has a great influence on the probability density function. When the preset bandwidth is small, the density estimation is biased to limit the probability density distribution too close to the data point, so that the probability density distribution function obtained by estimation has many wrong peaks; however, when the preset bandwidth is large, the density estimation spreads the probability density distribution too far apart, which may cause some important features in the probability density distribution function to be lost. Therefore, the appropriate preset bandwidth can be accurately determined by adopting the scott bandwidth method or the silverman bandwidth method, so that the accuracy of the determined preset bandwidth is ensured.

In an alternative embodiment, the electronic device may invoke the gaussion _ kde method in the scipy toolkit of python software to generate the above-described reconstructed error probability density distribution curve. The kernel function used in the gaussion _ kde method is the gaussian kernel function described above, and the preset bandwidth is the bandwidth determined by selecting the scott bandwidth method by default.

In the embodiment of the present application, the determination process of the above reconstruction error probability density distribution curve is not specifically described.

In an optional embodiment, according to the method shown in fig. 2, an anomaly detection method is further provided in the embodiment of the present application. As shown in fig. 4, fig. 4 is a third schematic flow chart of the abnormality detection method according to the embodiment of the present application. The method refines the above step S204 into the following steps S2041 to S2044.

Step S2041, calculating a first order difference between every two adjacent first reconstruction errors in the reconstruction error probability density distribution curve.

Step S2042, a second order difference between every two adjacent first order differences is calculated.

The specific calculation process of the first order difference and the second order difference is not specifically described here.

Step S2043, a leftmost point of points where the first order difference in the reconstructed error probability density distribution curve is greater than or equal to 0 and the second order difference is less than or equal to 0 is determined as a target inflection point.

In the embodiment of the present application, in the reconstruction error probability density distribution curve, the number of points satisfying that the first order difference is equal to or greater than 0 and the second order difference is equal to or less than 0 may be one or more. When the number of points satisfying that the first order difference is equal to or greater than 0 and the second order difference is equal to or less than 0 is plural, the electronic device may determine a leftmost point among the plural points as the target inflection point.

Step S2044, a first reconstruction error corresponding to the target inflection point is determined as an abnormal reconstruction error threshold.

In the embodiment of the present application, since most of the normal sample data in the sample data included in the preset training set is included, the trained VAE model fits the normal sample data well, that is, the first reconstruction error of the normal sample data is small and the number of the normal sample data is relatively large. And the sample data included in the preset training set has less abnormal sample data, so that the trained VAE model has poor fitting on the abnormal sample data, namely the first reconstruction error of the abnormal sample data is larger and the quantity of the abnormal sample data is relatively less. Therefore, the first reconstruction errors corresponding to the sample data included in the preset training set are substantially distributed in a long tail. Specifically, as shown in fig. 5, fig. 5 is a schematic diagram of a long tail distribution provided in the embodiment of the present application.

In the long-tailed distribution shown in fig. 5, the first reconstruction error of normal sample data in the sample data is small, and the specific gravity is large and concentrated, and is distributed at the head of the curve 501, i.e., at the left part of the point a on the curve 501. The first reconstruction error of the abnormal sample data in the sample data is large, small in percentage, and relatively dispersed, and is distributed at the tail of the curve, i.e., the right side portion of the point a on the curve 501. Therefore, the electronic device may use a boundary point (i.e., the target inflection point) on the curve of the reconstruction error probability density distribution curve that gradually becomes stable on the curve matched with the long-tail distribution as a boundary point between the first reconstruction error of the normal sample data and the first reconstruction error of the abnormal sample data, i.e., a reconstruction error value corresponding to the boundary point is the abnormal reconstruction error threshold.

In the embodiment of the present application, the first reconstruction error satisfies a long-tailed distribution, that is, the distribution characteristic of the first reconstruction error shows that the first reconstruction error rapidly decreases at the beginning, and the later decreasing trend becomes more gradual, even slightly increases, so that there is an inflection point. Therefore, when the first order difference is equal to or greater than 0, the probability density distribution indicating the long-tailed distribution is not already in a region of a large drop, but since the long-tailed distribution does not completely drop smoothly, a slight oscillation may occur at the inflection point. In order to reduce the reconstruction error of the target inflection point determined only according to the first-order difference under the condition that the inflection point is slightly vibrated, the electronic equipment can further determine the second-order difference under the condition that the first-order difference is greater than or equal to 0, and the point with the second-order difference less than or equal to 0 is determined as the target inflection point, so that the determined target inflection point falls in the region with stable descending trend, and the accuracy of determining the target inflection point is effectively improved.

In an optional embodiment, with respect to the step 201, a VAE model is trained by using a plurality of sample data included in a preset training set. As shown in fig. 6, fig. 6 is a schematic flowchart of a VAE model training method provided in the embodiment of the present application. The method comprises the following steps.

Step S601, a preset training set is obtained.

The preset training set comprises a plurality of sample data, and the plurality of sample data comprise normal sample data and abnormal sample data.

For convenience of understanding, taking the application of the VAE anomaly detection method to anomaly detection in an intelligent operation and maintenance scene as an example, the acquisition of the preset training set is described. The electronic equipment can obtain operation and maintenance indexes of a plurality of time periods in a preset time period to obtain a time sequence. The electronic equipment divides the time sequence by using a preset sliding window to obtain a plurality of time subsequences, and standardizes each time subsequence to obtain sample data in a preset training set. The time sequence in the preset time period comprises abnormal sample data and normal sample data, and the number of the normal sample data is far larger than that of the abnormal sample data.

For convenience of understanding, the operation and maintenance index is taken as the CPU utilization, and the obtaining of the preset training set is described with reference to fig. 7, where fig. 7 is a schematic diagram of sample data obtaining provided in the embodiment of the present application.

Now suppose that t is obtained from a preset time period₁、t₂、t₃、t₄And t₅The CPU utilization at these 5 time points results in the sequence shown as sequence A in FIG. 7, where t₃The CPU utilization rate corresponding to the time point is abnormal sample data. The electronic device may divide sequence a into sequence 1, sequence 2, and sequence 3 as shown in fig. 7 by a sliding step 1 using a preset sliding window having a width of 3. The electronic device can respectively perform standardization processing on the sequence 1, the sequence 2 and the sequence 3 to obtain sample data in a preset training set. The abnormal template data, i.e. t, can be included in the preset training set₃And identifying the time subsequence of the CPU utilization rate corresponding to the time point as an abnormal sequence.

In an alternative embodiment, the normalization of the plurality of time subsequences may be performed using a Z-score (also referred to as Z-score) algorithm. That is, for each time subsequence, the quotient of the standard deviation and the difference between the index value and the average value of the time subsequence is calculated to obtain the standardized sample data.

In the embodiment of the present application, the number of the preset training sets may also be different according to different application scenarios of the VAE anomaly detection method. Still taking the above-mentioned abnormal detection in the intelligent operation and maintenance scene as an example, since the operation and maintenance index may include a plurality of data, such as CPU usage rate, memory usage rate, etc., the electronic device may obtain a preset training set for each operation and maintenance index when obtaining the preset training set, that is, the preset training set corresponding to the CPU usage rate and the preset training set corresponding to the memory usage rate, etc. In this case, there are a plurality of VAE models obtained by training, and a plurality of abnormal reconstruction error thresholds determined by the method shown in fig. 2.

In an optional embodiment, the electronic device may further obtain a preset test set while obtaining the preset training set. The preset test set may be used to test the anomaly detection effect of the trained VAE model.

Taking the time sequence as an example, after the electronic device standardizes the plurality of time subsequences, the standardized data may be divided into sample data in a preset training set and test data in a preset test set according to a preset ratio, where the test data includes normal test data and abnormal test data.

Step S602, inputting a plurality of sample data included in a preset training set into a preset VAE model, and obtaining second output data corresponding to each sample data.

Step S603, a second reconstruction error between each sample data and the second output data corresponding to each sample data is calculated.

The calculation method of the second reconstruction error may refer to the calculation method of the first reconstruction error, which is not described herein again.

Step S604, when the difference between the second reconstruction error of the current round of training and the second reconstruction error of the previous round of training is greater than the preset difference threshold, adjusting the parameter of the preset VAE model, and returning to execute step S602.

In this step, the training of the preset VAE model includes at least two training passes. The electronic device may compare a difference between the second reconstruction error obtained from the current round of training and the second reconstruction error obtained from the previous round of training with a preset difference. When the difference between the second reconstruction error of the current round of training and the second reconstruction error of the previous round of training is greater than the preset difference, the electronic device may determine that the preset VAE model still needs to be trained. At this time, the electronic device may adjust parameters of a preset VAE model, and return to perform step S602, that is, return to perform the step of inputting a plurality of sample data included in the preset training set into the preset VAE model to obtain second output data corresponding to each sample data. The method for adjusting the parameters of the preset VAE model is not particularly limited.

Step S605, when the difference between the second reconstruction error of the current round of training and the second reconstruction error of the previous round of training is not greater than the preset difference threshold, determining the current preset VAE model as the trained VAE model.

In this step, when the difference between the second reconstruction error of the current round of training and the second reconstruction error of the previous round of training is not greater than the preset difference, the electronic device may determine that the training is completed. At this time, the electronic device may determine the current preset VAE model as the trained VAE model, that is, the VAE model trained in step S202.

In this embodiment of the application, the training data used for each round of training of the preset VAE model may be all sample data in the preset training set, or may be part of sample data in the preset training set. For example, the electronic device may group sample data in the preset training set to obtain a plurality of training subsets, input sample data in one training subset to the preset VAE model in each training round according to a preset sequence of each training subset, and train the preset VAE model until the training is completed.

In an optional embodiment, according to the method shown in fig. 2, an anomaly detection method is further provided in the embodiment of the present application. As shown in fig. 8, fig. 8 is a fourth flowchart illustrating an abnormality detection method according to an embodiment of the present application. Specifically, the above step S205 is subdivided into the following steps S2051 to S2053.

Step S2051, inputting the data to be detected into the trained VAE model to obtain third output data of the data to be detected.

Step S2052 calculates a third reconstruction error between the data to be detected and third output data of the data to be detected.

The calculation method of the third reconstruction error may refer to the calculation method of the first reconstruction error, which is not described herein again.

And step S2053, when the third reconstruction error is larger than the abnormal reconstruction error threshold value, determining that the data to be detected is abnormal data.

In the embodiment of the application, after the abnormal reconstruction error threshold is determined, the electronic device can accurately determine the abnormal data in the data to be detected by comparing the third reconstruction error between each data to be detected and the corresponding third output data with the abnormal reconstruction error threshold, so that the accuracy of the abnormal detection is effectively improved.

For ease of understanding, the anomaly reconstruction error thresholds determined by the different methods are compared below in conjunction with FIG. 9. Fig. 9 is a schematic diagram of a probability density distribution curve provided in an embodiment of the present application.

In fig. 9, the horizontal direction is the reconstruction error value, i.e., the first reconstruction error described above, and the vertical direction is the probability density. Wherein the curve 901 is the reconstruction error probability density distribution curve determined in the step S203. Since the number of abnormal sample data included in the preset training set is relatively small, the reconstruction error between the output data and the input data output by the trained VAE is mostly concentrated between 0 and 0.01, and the right side of the peak point of the curve 901 is matched with the long-tail distribution.

A straight line 902 represents an abnormal reconstruction error threshold determined using a preset quantile, and a straight line 903 represents an abnormal reconstruction error threshold determined using the method shown in fig. 2. As can be seen from fig. 9, there is a certain fluctuation in the reconstructed error probability density distribution curve after the straight line 902, and the preset probability density distribution curve after the straight line 903 is relatively stable. Therefore, the accuracy of the abnormal reconstruction error threshold determined by the method provided by the embodiment of the application is obviously higher than that of the abnormal reconstruction error threshold determined by using the preset quantile in the related art.

Further, the abnormality detection method provided by the embodiment of the application is compared with an abnormality detection method based on an abnormality reconstruction error threshold in the related art by using an F1-Score (also called F1 Score) index. Wherein, F1-Score is an index for comprehensively measuring the model effect, and the specific index is as follows:

taking two classifications as an example, in the actual anomaly detection process, P may be used to represent the predicted Positive class, N may be used to represent the predicted Negative class, T may be used to represent the actual Positive class, and F may be used to represent the actual Negative class, so that the actual class and the predicted class of the sample data may be classified into True Positive (TP), False Positive (FP), True Negative (TN) and False Negative (FN), as shown in table 1.

TABLE 1

According to the abnormal data and the normal data identified by the abnormal detection and the normal test data and the abnormal test data included in the preset test set, TP, FP, FN and TN obtained by performing the abnormal detection by the method provided by the embodiment of the application and performing the abnormal detection by the abnormal reconstruction error threshold determined by the preset quantile in the related technology can be determined.

The Precision ratio Precision and Recall of abnormality detection are calculated separately using the following formulas, wherein the Precision ratio is expressed as a proportion of data judged to be abnormal that is actually abnormal. The recall ratio is expressed as a proportion of the data that is actually abnormal, which is determined to be abnormal.

Based on the above accuracy and recall, the F1-Score value can be calculated using the following formula:

specifically, taking test data corresponding to 9 operation and maintenance indexes in a preset test set as an example, the abnormal reconstruction error threshold determined in the embodiment of the present application and the abnormal reconstruction error threshold corresponding to 95% of a preset quantile determined by a related technology are respectively adopted to perform an abnormal test on the test data in the preset test set, so as to obtain an F1-Score value shown in table 2.

TABLE 2

In table 2, the scheme 1 is F1-Score corresponding to the abnormal reconstruction error threshold determined by the preset quantiles in the related art, and the scheme 2 is F1-Score corresponding to the abnormal reconstruction error threshold determined by the method provided in the embodiment of the present application.

By comparison, the F1-Score value corresponding to the scheme 1 is smaller than the F1-Score value corresponding to the scheme 2 as a whole, that is, the accuracy and/or recall ratio of the abnormal detection result determined by the scheme 1 is lower than the accuracy and/or recall ratio of the abnormal detection result determined by the scheme 2. Therefore, the accuracy of the abnormal reconstruction error threshold determined by the embodiment of the application for abnormal detection is obviously higher than the accuracy of the abnormal reconstruction error threshold determined by the preset quantile in the related technology for abnormal detection.

Based on the same concept, according to the abnormality detection method provided by the embodiment of the application, the embodiment of the application also provides an abnormality detection device. As shown in fig. 10, fig. 10 is a schematic structural diagram of an abnormality detection apparatus according to an embodiment of the present application. The apparatus includes the following modules.

A training module 1001, configured to train a VAE model using a plurality of sample data included in a preset training set, where the plurality of sample data includes normal sample data and abnormal sample data;

a first output module 1002, configured to input a plurality of sample data into the trained VAE model respectively, to obtain first output data corresponding to each sample data;

a first determining module 1003, configured to determine a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and the first output data corresponding to each sample data;

a second determining module 1004, configured to determine that a first reconstruction error corresponding to a target inflection point in the reconstruction error probability density distribution curve is an abnormal reconstruction error threshold, where the target inflection point is a leftmost point of points in the reconstruction error probability density distribution curve where a first-order difference is greater than or equal to 0 and a second-order difference is less than or equal to 0;

the detecting module 1005 is configured to perform anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model.

Optionally, the first determining module 1003 may be specifically configured to, for each sample data, calculate a mean square error between the sample data and the first output data corresponding to the sample data, to obtain a first reconstruction error between the sample data and the first output data corresponding to the sample data;

Optionally, the training module 1001 may be specifically configured to obtain a preset training set;

inputting a plurality of sample data included in a preset training set into a preset VAE model to obtain second output data corresponding to each sample data;

when the difference value between the second reconstruction error of the training round and the second reconstruction error of the previous training round is larger than the preset difference value threshold value, adjusting the parameters of the preset VAE model, and returning to execute the step of inputting a plurality of sample data included in the preset training set into the preset VAE model to obtain second output data corresponding to each sample data;

and when the difference value between the second reconstruction error of the training round and the second reconstruction error of the previous training round is not larger than a preset difference value threshold value, determining the current preset VAE model as the trained VAE model.

Optionally, the detection module 1005 may be specifically configured to input the data to be detected into the trained VAE model, so as to obtain third output data of the data to be detected;

and when the third reconstruction error is larger than the abnormal reconstruction error threshold value, determining the data to be detected as abnormal data.

By the aid of the device, the reconstruction error probability density distribution curve can be determined according to reconstruction errors between each sample data included in the preset training set and output data corresponding to each sample data output by the trained VAE model, so that the reconstruction errors corresponding to the target inflection points in the reconstruction error probability density distribution curve are determined as the abnormal reconstruction error threshold, and abnormal detection is conducted on data to be detected according to the abnormal reconstruction error threshold and the trained VAE model. Compared with the abnormal reconstruction error threshold value corresponding to the preset quantile determined manually in the related technology, the method has the advantages that the reconstruction error between each sample data and the output data corresponding to each sample data output by the trained VAE model is utilized, the deviation of the abnormal reconstruction error threshold value determined according to the preset quantile set manually can be well eliminated, the accuracy of the determined abnormal reconstruction error threshold value is effectively improved, and therefore the accuracy of abnormal detection is improved.

Based on the same concept, according to the abnormality detection method provided by the embodiment of the present application, an embodiment of the present application further provides an electronic device, as shown in fig. 11, including a processor 1101, a communication interface 1102, a memory 1103 and a communication bus 1104, where the processor 1101, the communication interface 1102 and the memory 1103 complete communication with each other through the communication bus 1104;

a memory 1103 for storing a computer program;

the processor 1101 is configured to implement the following steps when executing the program stored in the memory 1103:

respectively inputting a plurality of sample data into the trained VAE model to obtain first output data corresponding to each sample data;

determining a first reconstruction error corresponding to a target inflection point in a reconstruction error probability density distribution curve as an abnormal reconstruction error threshold, wherein the target inflection point is the leftmost point in points of which the first-order difference is greater than or equal to 0 and the second-order difference is less than or equal to 0 in the reconstruction error probability density distribution curve;

Through the electronic device provided by the embodiment of the application, the reconstruction error probability density distribution curve can be determined according to the reconstruction error between each sample data included in the preset training set and the output data corresponding to each sample data output by the trained VAE model, so that the reconstruction error corresponding to the target inflection point in the reconstruction error probability density distribution curve is determined as the abnormal reconstruction error threshold, and the abnormal detection is performed on the data to be detected according to the abnormal reconstruction error threshold and the trained VAE model. Compared with the abnormal reconstruction error threshold value corresponding to the preset quantile determined manually in the related technology, the method has the advantages that the reconstruction error between each sample data and the output data corresponding to each sample data output by the trained VAE model is utilized, the deviation of the abnormal reconstruction error threshold value determined according to the preset quantile set manually can be well eliminated, the accuracy of the determined abnormal reconstruction error threshold value is effectively improved, and therefore the accuracy of abnormal detection is improved.

The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.

The communication interface is used for communication between the electronic equipment and other equipment.

The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.

The Processor may be a general-purpose Processor including a Central Processing Unit (CPU), or may be a special-purpose Processor including a Network Processor (NP), a Digital Signal Processor (DSP), and the like.

Based on the same concept, according to the abnormality detection method provided by the embodiment of the present application, the embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, and the computer program, when executed by a processor, implements the steps of any of the abnormality detection methods described above.

Based on the same concept, according to the abnormality detection method provided in the embodiments of the present application, the embodiments of the present application also provide a computer program containing instructions that, when run on a computer, cause the computer to perform any of the abnormality detection methods in the embodiments.

In the above embodiments, the implementation may be wholly or partially realized by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program. The computer program includes one or more computer instructions. When loaded and executed on a computer, cause the processes or functions described in accordance with the embodiments of the application to occur, in whole or in part. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., Solid State Disk (SSD)), among others.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising an … …" does not exclude the presence of other identical elements in a process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, for embodiments such as the apparatus, the electronic device, the computer-readable storage medium, and the computer program, since they are substantially similar to the method embodiments, the description is relatively simple, and for the relevant points, reference may be made to the partial description of the method embodiments.

The above description is only for the preferred embodiment of the present application and is not intended to limit the scope of the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application are included in the protection scope of the present application.

Claims

1. An anomaly detection method, characterized in that it comprises:

training a variational self-coding VAE model by using a plurality of sample data included in a preset training set, wherein the plurality of sample data include normal sample data and abnormal sample data;

2. The method of claim 1, wherein the step of determining a reconstruction error probability density distribution curve according to a first reconstruction error between each sample data and the first output data corresponding to each sample data comprises:

determining a reconstruction error probability density distribution curve by utilizing a kernel probability density estimation KDE algorithm based on a first reconstruction error between each sample data and first output data corresponding to each sample data; the KDE algorithm comprises a preset kernel function and a preset bandwidth.

3. The method of claim 2, wherein the predetermined kernel function is a uniform kernel function, a gaussian kernel function, an Epanechikov kernel function, or a Quartic kernel function;

the preset bandwidth is determined based on a Scott bandwidth method or a Sierfman silverman bandwidth method.

4. The method according to claim 1, wherein the step of training the VAE model using a plurality of sample data included in the preset training set comprises:

acquiring the preset training set;

5. The method according to claim 1, wherein the step of performing anomaly detection on the data to be detected according to the anomaly reconstruction error threshold and the trained VAE model comprises:

6. An abnormality detection apparatus, characterized in that the apparatus comprises:

the training module is used for training a variational self-coding VAE model by utilizing a plurality of sample data included in a preset training set, wherein the sample data include normal sample data and abnormal sample data;

7. The apparatus of claim 6, wherein the first determining module is specifically configured to, for each sample data, calculate a mean square error between the sample data and the first output data corresponding to the sample data, and obtain a first reconstruction error between the sample data and the first output data corresponding to the sample data;

8. The apparatus of claim 7, wherein the predetermined kernel function is a uniform kernel function, a gaussian kernel function, an Epanechikov kernel function, or a Quartic kernel function;

9. The apparatus according to claim 6, wherein the training module is specifically configured to obtain the preset training set;

10. The apparatus according to claim 6, wherein the detection module is specifically configured to input data to be detected into the trained VAE model, to obtain third output data of the data to be detected;

11. An electronic device is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor and the communication interface are used for realizing mutual communication by the memory through the communication bus;

a memory for storing a computer program;

a processor for implementing the method steps of any one of claims 1 to 5 when executing a program stored in the memory.

12. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, which computer program, when being executed by a processor, carries out the method steps of any one of the claims 1-5.