CN115577310A - Abnormal object identification method and device, electronic equipment and storage medium - Google Patents

Abnormal object identification method and device, electronic equipment and storage medium Download PDF

Info

Publication number
CN115577310A
CN115577310A CN202211190169.9A CN202211190169A CN115577310A CN 115577310 A CN115577310 A CN 115577310A CN 202211190169 A CN202211190169 A CN 202211190169A CN 115577310 A CN115577310 A CN 115577310A
Authority
CN
China
Prior art keywords
node
features
nodes
graph
feature
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
CN202211190169.9A
Other languages
Chinese (zh)
Inventor
许林丰
许海洋
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Beijing Baidu Netcom Science and Technology Co Ltd
Original Assignee
Beijing Baidu Netcom Science and Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Beijing Baidu Netcom Science and Technology Co Ltd filed Critical Beijing Baidu Netcom Science and Technology Co Ltd
Priority to CN202211190169.9A priority Critical patent/CN115577310A/en
Publication of CN115577310A publication Critical patent/CN115577310A/en
Pending legal-status Critical Current

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING OR COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/90Details of database functions independent of the retrieved data types
    • G06F16/901Indexing; Data structures therefor; Storage structures
    • G06F16/9024Graphs; Linked lists

Landscapes

  • Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Software Systems (AREA)
  • Data Mining & Analysis (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Image Analysis (AREA)

Abstract

The disclosure provides an abnormal object identification method, an abnormal object identification device, electronic equipment and a storage medium, and relates to the technical fields of data mining, data processing, knowledge graphs and the like. The specific implementation scheme is as follows: acquiring an object association graph among the candidate objects, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects; acquiring an object proximity characteristic and an object compactness characteristic of a node according to an object association graph; fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node; and performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object recognition result. According to the method and the device, the unknown object can be subjected to abnormal recognition through the incidence relation between the known abnormal object and the unknown object, and the recognition accuracy is improved.

Description

Abnormal object identification method and device, electronic equipment and storage medium
Technical Field
The present disclosure relates to the technical field of data mining, data processing, knowledge graph, and the like, and in particular, to a method and an apparatus for identifying an abnormal object, an electronic device, and a storage medium.
Background
In big data analysis, it is often necessary to identify abnormal objects. In the related art, the identification of the abnormal object only focuses on the characteristics of the object, and the abnormal identification is performed through the characteristics of the object, so that the identification accuracy is often poor when the abnormal identification is performed on the object with less characteristics, and therefore, how to improve the accuracy of identifying such objects becomes a problem to be considered.
Disclosure of Invention
The disclosure provides an abnormal object identification method and device, an electronic device and a storage medium.
Acquiring an object association graph among candidate objects, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects;
according to the object association graph, acquiring object proximity characteristics and object compactness characteristics of the nodes;
fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node;
and performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object recognition result.
According to the method and the device, the unknown object can be subjected to abnormal recognition through the incidence relation between the known abnormal object and the unknown object, and the recognition accuracy is improved.
According to another aspect of the present disclosure, there is provided an apparatus for identifying an abnormal object, including:
the first acquisition module is used for acquiring an object association graph among candidate objects, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects;
the second acquisition module is used for acquiring the object proximity characteristic and the object compactness characteristic of the node according to the object association graph;
the feature fusion module is used for fusing the object proximity feature and the object compactness feature to obtain a fusion feature of the node;
and the anomaly identification module is used for carrying out anomaly identification on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object identification result.
According to another aspect of the present disclosure, there is provided an electronic device comprising at least one processor, an
A memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of identifying an anomalous object in accordance with the first aspect of the disclosure.
According to another aspect of the present disclosure, there is provided a non-transitory computer readable storage medium storing computer instructions for causing a computer to perform the method for identifying an abnormal object according to the embodiment of the first aspect of the present disclosure.
According to another aspect of the present disclosure, there is provided a computer program product comprising a computer program which, when executed by a processor, performs the steps of the method for identifying an abnormal object of an embodiment of the first aspect of the present disclosure.
It should be understood that the statements in this section do not necessarily identify key or critical features of the embodiments of the present disclosure, nor do they limit the scope of the present disclosure. Other features of the present disclosure will become apparent from the following description.
Drawings
The drawings are included to provide a better understanding of the present solution and are not to be construed as limiting the present disclosure. Wherein:
FIG. 1 is a flow diagram of a method of identifying an abnormal object according to one embodiment of the present disclosure;
FIG. 2 is a schematic diagram of an object association map;
FIG. 3 is a flow chart of a method of identifying an abnormal object according to another embodiment of the present disclosure;
FIG. 4 is an exemplary diagram of an object association graph;
FIG. 5 is a schematic diagram of a method of identifying an abnormal object according to another embodiment of the present disclosure;
fig. 6 is a proximity distance diagram.
FIG. 7 is a flow chart of a method of identifying an abnormal object according to another embodiment of the present disclosure;
FIG. 8 is a schematic structural diagram of an abnormal object recognition model;
FIG. 9 is a flowchart of an identification method of an abnormal object according to another embodiment of the present disclosure
Fig. 10 is a structural diagram of an apparatus for identifying an abnormal object according to one embodiment of the present disclosure;
fig. 11 is a block diagram of an electronic device for implementing the method for identifying an abnormal object according to the embodiment of the present disclosure.
Detailed Description
Exemplary embodiments of the present disclosure are described below with reference to the accompanying drawings, in which various details of embodiments of the present disclosure are included to assist understanding, and which are to be considered as merely exemplary. Accordingly, those of ordinary skill in the art will recognize that various changes and modifications of the embodiments described herein can be made without departing from the scope and spirit of the present disclosure. Also, descriptions of well-known functions and constructions are omitted in the following description for clarity and conciseness.
Data processing, data is a form of expression of facts, concepts or instructions that can be processed by manual or automated means. Data becomes information after being interpreted and given a certain meaning. The data processing is the collection, storage, retrieval, processing, transformation and transmission of data.
The basic purpose of data processing is to extract and derive valuable, meaningful data for certain people from large, possibly chaotic, unintelligible amounts of data.
Data processing is the basic link of system engineering and automatic control. Data processing is throughout various fields of social production and social life. The development of data processing technology and the breadth and depth of its application have greatly influenced the progress of human society development.
Knowledge Graph (Knowledge Graph) is a series of different graphs displaying the relation between the Knowledge development process and the structure, and uses the visualization technology to describe the Knowledge resources and the carriers thereof, and excavates, analyzes, constructs, draws and displays the Knowledge and the mutual relation between the Knowledge resources and the carriers.
The knowledge graph is a modern theory which achieves the aim of multi-discipline fusion by combining theories and methods of applying subjects such as mathematics, graphics, information visualization technology, information science and the like with methods such as metrology introduction analysis, co-occurrence analysis and the like and utilizing a visualized graph to vividly display the core structure, development history, frontier field and overall knowledge framework of the subjects.
In the technical scheme of the disclosure, the acquisition, storage, application and the like of the personal information of the related object all accord with the regulations of related laws and regulations, and do not violate the good customs of the public order.
The identification method, apparatus, electronic device, and storage medium of the abnormal object of the present disclosure are described below with reference to the accompanying drawings.
Fig. 1 is a flowchart of an identification method of an abnormal object according to an embodiment of the present disclosure, as shown in fig. 1, including the following steps:
s101, obtaining an object association graph among the candidate objects, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects.
The object in the embodiment of the present disclosure may include a user, a thing, and the like, and accordingly, the object association map includes a person association map, a thing association map, and the like, which is not limited in any way herein. The object-related map is a person-related map if the object is a user, and is an object-related map if the object is an object.
The association relationship between the basic information of the candidate objects and the candidate objects can be obtained, and the object association map between the candidate objects is generated according to the association relationship between the basic information of the candidate objects and the candidate objects.
Taking the candidate object as the candidate user for illustration, as shown in fig. 2, personal information data and person relationship data of the candidate user are acquired, and a person association graph is generated according to the personal information data and the person relationship data of the user.
S102, according to the object association graph, the object proximity characteristic and the object compactness characteristic of the node are obtained.
The object association graph comprises known nodes and unknown nodes, correspondingly, the candidate objects comprise known objects and unknown objects, in the embodiment of the disclosure, the unknown nodes are focus nodes, that is, the nodes in the embodiment of the disclosure are unknown nodes, and the object proximity features and the object compactness features of the unknown nodes can be obtained according to the object association graph.
The object proximity feature is a vector expression of proximity relations among the candidate objects and is used for representing the proximity relations among the candidate objects, and the object association graph can reflect the proximity relations among the nodes, so that the proximity relations between the nodes and other nodes can be determined according to the object association graph, and the object proximity feature of the nodes can be obtained according to the proximity relations and the node features of other nodes. Wherein the node features are vector expressions of basic information characterizing the candidate objects.
The object compactness characteristic is a vector expression of the compactness among the candidate objects and is used for representing the compactness among the candidate objects.
The object association graph is taken as a person association graph for exemplary explanation: the object proximity feature may be a user proximity feature, the object closeness feature may be a user closeness feature, the user proximity feature is a vector expression of a proximity relationship between candidate users and is used for characterizing the proximity relationship between the candidate users, and the node feature is a vector expression of candidate user data and may characterize basic information of the candidate users.
S103, fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node.
Optionally, the object proximity feature and the object closeness feature are subjected to weighted summation to obtain a fusion feature of the node.
In some embodiments, the object proximity feature and the object closeness feature are input into a fusion network, the object proximity feature and the object closeness feature are fused by the fusion network, and the fusion feature of the node is output.
And S104, performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object recognition result.
In some embodiments, the fusion features of the nodes are input into a classifier, the classifier classifies the fusion features to identify the abnormality of the target candidate object, and the identification result is output. Alternatively, the recognition result may include an abnormality probability of the target candidate.
According to the method, an object association graph among candidate objects is obtained, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects; acquiring an object proximity characteristic and an object compactness characteristic of a node according to an object association graph; fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node; and performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object recognition result. In the embodiment of the disclosure, the object proximity feature and the object closeness feature are fused, and the proximity relation and the close relation between the objects are concerned, so that the unknown object can be identified through the known abnormal object, and the accuracy of identifying the abnormal object is improved.
Fig. 3 is a flowchart of an identification method of an abnormal object according to an embodiment of the present disclosure, as shown in fig. 3, including the following steps:
s301, acquiring an object association map among the candidate objects.
For the description of step S301, reference may be made to the relevant contents of the above embodiments, and details are not described here.
S302, acquiring an adjacency matrix of the object association map.
Wherein the adjacency matrix may characterize the graph structure of the object association graph.
For example, assuming that the object association map is shown in fig. 4, the corresponding adjacency matrix a is:
Figure BDA0003868992850000051
s303, acquiring the object proximity characteristic and the object compactness characteristic of the node according to the adjacency matrix.
Optionally, according to the adjacency matrix, a neighboring node of the node is determined, and the first node feature of the node and the second node feature of the neighboring node are subjected to feature aggregation to obtain an object proximity feature of the node.
It should be noted that, in the embodiment of the present disclosure, the object proximity feature of the neighboring node may be obtained in the same manner, so as to further obtain the object compactness feature of the node according to the object proximity feature of the neighboring node.
Further, optionally, according to the adjacency matrix, a neighboring node of the node is determined, according to the object proximity feature of the node and the object proximity feature of the neighboring node, the association between the node and the neighboring node of the node is obtained, and according to the association, feature aggregation is performed on the object proximity feature of the neighboring node, so as to obtain the object compactness feature of the node.
Wherein the degree of association characterizes the degree of closeness between the nodes.
The association degree between the node and different adjacent nodes can be used as the weight of the object proximity characteristic of the adjacent node, and the object proximity characteristic of the adjacent node is subjected to characteristic aggregation according to the weight to obtain the object compactness characteristic of the node.
S304, fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node.
S305, performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node, and acquiring an object recognition result.
For the description of steps S304 to S305, reference may be made to the relevant contents of the above embodiments, and details are not repeated here.
In the embodiment of the disclosure, an object association graph among candidate objects is obtained, an adjacency matrix of the object association graph is obtained, object proximity features and object compactness features of nodes are obtained according to the adjacency matrix, the object proximity features and the object compactness features are fused to obtain fusion features of the nodes, and abnormal recognition is performed on target candidate objects represented by the nodes based on the fusion features of the nodes to obtain object recognition results. In the embodiment of the disclosure, the graph structure of the object association graph is represented by the adjacency matrix, so that the acquisition of the object proximity feature and the object compactness feature is facilitated, and the proximity relation and the association relation among nodes in the object association graph can be fully mined.
Fig. 5 is a flowchart of an identification method of an abnormal object according to an embodiment of the present disclosure, as shown in fig. 5, including the following steps:
s501, acquiring an object association map among the candidate objects.
S502, acquiring an adjacency matrix of the object association map.
For the description of steps S501 to S502, reference may be made to the relevant contents of the above embodiments, and details are not repeated here.
S503, carrying out matrix conversion processing on the adjacent matrix to obtain a degree matrix.
For example, after the object association map shown in fig. 4 is converted into the adjacent matrix a, the adjacent matrix a may be subjected to matrix conversion processing by the following formula (1) to obtain a corresponding degree matrix.
D ii =∑ j A ij (1)
Wherein i represents a central node, j represents a neighboring node, D ii A matrix of degrees of representation, A ij Representing an adjacency matrix.
And S504, performing matrix conversion processing on the adjacent matrix and the degree matrix to obtain a target matrix.
Alternatively, the target matrix may be a laplacian matrix.
In some embodiments, the adjacency matrix and the degree matrix may be converted into the target matrix by the following equation (2).
Figure BDA0003868992850000061
Wherein B represents the target matrix, D represents the degree matrix, and A represents the adjacency matrix.
And S505, inputting the target matrix and the node characteristics into a graph convolution network in the abnormal object identification model, and obtaining the object proximity characteristics of the nodes by the graph convolution network according to the target matrix and the node characteristics.
Optionally, after the target matrix and the node features are input into a graph convolution network in the abnormal object recognition model, the graph convolution neural network may determine the nodes and the nodes adjacent to the nodes according to the target matrix.
The graph volume network comprises M first hidden layers.
In the embodiment of the disclosure, the first hidden layer of the graph convolution network performs feature weighted aggregation on the first node features of the nodes and the second node features of the neighboring nodes respectively according to the maximum neighboring distance, outputs weighted first node features and weighted second node features, inputs the weighted first node features and the weighted second node features into the (l + 1) th first hidden layer, and performs weighted aggregation on the weighted first node features and the weighted second node features by the (l + 1) th first hidden layer until the object proximity features are output by the (M) th first hidden layer.
Wherein, the calculation formula (3) of each first hidden layer of the graph convolution network is as follows:
Figure BDA0003868992850000071
wherein l is a positive integer greater than 0 and less than M, K represents a maximum proximity distance, K is a proximity distance (hop), B l Representing the degree matrix corresponding to the first hidden layer,
Figure BDA0003868992850000072
a second node characteristic representing the output of the l-1 st first hidden layer from the neighboring node whose node i is k,
Figure BDA0003868992850000073
l-1 th first hidden layer representing node iA node characteristic, i.e. the first node characteristic of the node of interest, a represents the attenuation coefficient, a =1/K,
Figure BDA0003868992850000074
is the object proximity feature of node i output by the ith first hidden layer.
The following explains k (hop) with reference to FIG. 6: as shown in fig. 6, k =0 denotes a center node, i.e., a point of interest, k =1 denotes a neighboring node at a distance of 1 from the center node, k =2 denotes a neighboring node at a distance of 2 from the center node, and k =3 denotes a neighboring node at a distance of 3 from the center node.
The graph convolution network can perform iterative computation from the first hidden layer to the Mth first hidden layer according to the formula (3) until the Mth first hidden layer is computed, and then the object proximity feature is obtained. Wherein, the specific iteration process is as follows: the output of the first hidden layer is used as the input of the second first hidden layer for calculation, the output of the second first hidden layer is used as the input of the third first hidden layer for calculation, … …, the output of the M-1 th first hidden layer is used as the input of the Mth first hidden layer for calculation, and finally the Mth first hidden layer calculates and outputs the object proximity feature.
S506, performing self-attention processing on the object proximity feature of the adjacent node through a graph attention network in the abnormal object identification model to obtain the object compactness feature of the node.
In the embodiment of the disclosure, the attention network acquires the association degree between the nodes and the adjacent nodes according to the object proximity feature, and performs layer-by-layer feature aggregation on the object proximity feature of the adjacent nodes according to the association degree through a plurality of second hidden layers in the attention network to output the object compactness feature of the nodes.
In some implementations, the graph attention network may calculate the association between a node and a neighboring node by the following equation (4).
Figure BDA0003868992850000081
Wherein alpha is i,j Is the degree of association between node i and node j, node i is the point of interest, node j is the neighboring node, σ is the activation function, Θ is the projection matrix, | | | represents the stitching operation,
Figure BDA0003868992850000088
is the transpose of the attention vector, N i Is an exponential function based on the natural constant e of exp () of the set of neighboring nodes of node i, H i Is an object proximity feature of node i, H j Object proximity feature of node j, H k Is an object proximity feature of node k at a proximity distance k from node i.
Wherein the graph attention network comprises M second hidden layers.
Further, performing feature weighted aggregation on the object proximity features by the ith second hidden layer of the graph attention network, outputting weighted object proximity features, inputting the weighted object proximity features into the (l + 1) th second hidden layer, and performing weighted aggregation on the object proximity features by the (l + 1) th second hidden layer until the object compactness features are output by the Mth second hidden layer.
Wherein, the calculation formula (5) of each second hidden layer of the graph attention network is as follows:
Figure BDA0003868992850000082
where V is the number of multiple heads (multi-head), V is a positive integer less than V,
Figure BDA0003868992850000083
is the object proximity feature output by the l-1 th second hidden layer of the node j, W is a shared parameter,
Figure BDA0003868992850000084
is the object compactness characteristic of node i output by the ith second hidden layer.
The graph attention network can perform iterative computation from the first second hidden layer to the Mth second hidden layer according to the formula (5) until the Mth second hidden layer is computed, and the object compactness characteristic is obtained. Wherein, the specific iteration process is as follows: the output of the first second hidden layer is used as the input of the second hidden layer for calculation, the output of the second hidden layer is used as the input of the third second hidden layer for calculation, … …, the output of the M-1 th second hidden layer is used as the input of the Mth second hidden layer for calculation, and finally the Mth second hidden layer calculates and outputs the object compactness characteristic.
And S507, fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node.
In some implementations, the object proximity feature and the object closeness feature may be fused by the following equation (6) to obtain a fused feature of the node.
Figure BDA0003868992850000085
Wherein H i Is a fusion feature of node i, w 1 And w 2 Is the weight coefficient of the weight of the image,
Figure BDA0003868992850000086
is the object compactness characteristic of the node i output by the mth second hidden layer of the graph attention network,
Figure BDA0003868992850000087
the object proximity feature of the node i output by the Mth first hidden layer of the graph convolution network.
And S508, performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object recognition result.
For the description of step S508, reference may be made to the relevant contents of the above embodiments, and details are not repeated here.
In the embodiment of the disclosure, an object association graph among candidate objects is obtained, an adjacency matrix of the object association graph is obtained, matrix conversion processing is performed on the adjacency matrix to obtain a degree matrix, matrix conversion processing is performed on the adjacency matrix and the degree matrix to obtain a target matrix, the target matrix and node characteristics are input into a graph convolution network in an abnormal object identification model, object proximity characteristics of nodes are obtained through the graph convolution network according to the target matrix and the node characteristics, self-attention processing is performed on the object proximity characteristics of the adjacent nodes through a graph attention network in the abnormal object identification model to obtain object compactness characteristics of the nodes, the object proximity characteristics and the object compactness characteristics are fused to obtain fusion characteristics of the nodes, and abnormal identification is performed on target candidate objects represented by the nodes based on the fusion characteristics of the nodes to obtain an object identification result. In the embodiment of the disclosure, the features output by the graph convolution network and the graph attention network are fused, and the abnormal recognition is performed through the fused features, and meanwhile, the proximity relation and the association relation between the objects are concerned, so that the abnormal recognition can be performed on the unknown object through the proximity relation and the association relation between the unknown object and the known abnormal object, and the recognition accuracy is improved.
Fig. 7 is a schematic flowchart of a method for identifying an abnormal object according to an embodiment of the present disclosure, and on the basis of the above embodiment, the training process of the abnormal object identification model is further explained with reference to fig. 7, which includes the following steps:
s701, training the initial abnormal object recognition model based on the sample object association graph to obtain a first loss function of the graph convolution network and a second loss function of the graph self-attention network.
Alternatively, the first loss function of the graph convolution network may be a Dice loss function and the second loss function of the graph self-attention network may be a cross entropy loss function.
The method comprises the steps of obtaining a sample adjacency matrix of a sample object association graph, converting the sample adjacency matrix into a sample degree matrix, converting the sample adjacency matrix and the sample degree matrix into a sample target matrix, inputting the sample target matrix and sample node characteristics into a graph convolution network of an initial anomaly identification model, obtaining predicted object proximity characteristics of unknown nodes through the graph convolution network according to the sample target matrix and the sample node characteristics, and then carrying out self-attention processing on the predicted object proximity characteristics of the adjacent nodes of the unknown nodes through the graph attention network to obtain the predicted object compactness characteristics of the unknown nodes. Then, a first loss function of the graph convolution network can be obtained through the prediction object proximity characteristic and the real object proximity characteristic, and a second loss function of the graph self-attention network can be obtained through the prediction object compactness characteristic and the real object compactness characteristic.
S702, weighting the first loss function and the second loss function to obtain a target loss function.
Alternatively, the target loss function may be calculated by the following formula.
L CDL =w Dice exp(L Dice )+w Cross L Cross
Wherein L is CDL Is an objective loss function, L Dice Is a Dice loss function, L Cross Is a cross entropy loss function, w Dice Is the weight coefficient, w, of the Dice loss function Cross Are the weight coefficients of the cross entropy loss function.
In some embodiments, the first loss function and the second loss function may be weighted according to the number of sample classes of the training samples, that is, the weight coefficient of the Dice loss function and the weight coefficient of the cross entropy loss function are adjusted according to the number of sample classes of the training samples.
The Dice loss function can enable the model to pay more attention to samples with small sample occupation ratio, but the stability is poor, the appearance of a small number of abnormal results can cause the Dice loss function to generate large fluctuation, the cross entropy loss function has high stability, the Dice loss function and the cross entropy loss function are integrated, and a better training effect can be achieved on the model.
And S703, adjusting the initial abnormal object recognition model based on the target loss function and continuing training until the abnormal object recognition model is obtained after the training is finished.
After the target loss function is obtained, the initial abnormal object recognition model can be adjusted according to the target loss function, the target loss function is obtained again after adjustment, and the model continues to be trained through the obtained target loss function until the abnormal object recognition model is obtained after training is finished.
In the embodiment of the disclosure, an initial abnormal object recognition model is trained based on a sample object association graph to obtain a first loss function of a graph convolution network and a second loss function of a graph self-attention network, the first loss function and the second loss function are weighted to obtain a target loss function, and the initial abnormal object recognition model is adjusted and trained continuously based on the target loss function until the abnormal object recognition model is obtained after training is finished. In the embodiment of the disclosure, model training is performed through the loss function of the graph convolution network and the loss function weighted by the loss function of the graph attention network, so that the problem of unbalanced training samples can be solved, a better training effect is achieved, and the accuracy of identifying the abnormal object identification model is improved.
Fig. 8 is a schematic structural diagram of an abnormal object identification model, and as shown in fig. 8, the abnormal object identification model includes a graph convolution network, a graph attention network and a classifier. Inputting the target matrix and the node characteristics into a graph convolution network of which the abnormal object is an identification model, processing the graph convolution network and outputting object proximity characteristics, inputting the object proximity characteristics into a graph attention network, processing the graph attention network and outputting object compactness characteristics, fusing the object proximity characteristics and the object compactness characteristics to obtain fusion characteristics, inputting the fusion characteristics into a classifier, performing abnormal identification on the unknown object by the classifier according to the fusion characteristics, and outputting an identification result.
Fig. 9 is a schematic flow diagram of an identification method of an abnormal object, and as shown in fig. 9, an object association map is obtained, an adjacency matrix is generated according to the object association map, the adjacency matrix is converted into a degree matrix, the adjacency matrix and the degree matrix are converted into a target matrix, the target matrix and node characteristics are input into an abnormal object identification model, an abnormal object identification model is used for performing abnormal identification on an unknown abnormal object according to a known abnormal object, and an identification result is output.
Fig. 10 is a block diagram of an apparatus for recognizing an abnormal object according to an embodiment of the present disclosure, and as shown in fig. 10, an apparatus 1000 for recognizing an abnormal object includes:
a first obtaining module 1010, configured to obtain an object association graph between candidate objects, where the object association graph includes multiple nodes, and different nodes represent different candidate objects;
a second obtaining module 1020, configured to obtain an object proximity feature and an object closeness feature of a node according to the object association graph;
the feature fusion module 1030 is configured to fuse the object proximity feature and the object closeness feature to obtain a fusion feature of the node;
and the anomaly identification module 1040 is configured to perform anomaly identification on the target candidate object represented by the node based on the fusion feature of the node, and obtain an object identification result.
In some implementations, the second obtaining module 1020 is further configured to:
acquiring an adjacency matrix of the object relation map;
and acquiring the object proximity characteristic and the object compactness characteristic of the node according to the adjacency matrix.
In some implementations, the second obtaining module 1020 is further configured to:
determining adjacent nodes of the nodes according to the adjacency matrix;
and performing feature aggregation on the first node features of the nodes and the second node features of the adjacent nodes to obtain object proximity features of the nodes.
In some implementations, the second obtaining module 1020 is further configured to:
determining adjacent nodes of the nodes according to the adjacency matrix;
acquiring the association degree between the node and the adjacent node of the node according to the object proximity characteristic of the node and the object proximity characteristic of the adjacent node;
and according to the relevance, carrying out feature aggregation on the object proximity features of the adjacent nodes to obtain the object compactness features of the nodes.
In some implementations, the second obtaining module 1020 is further configured to:
performing matrix conversion processing on the adjacent matrix to obtain a degree matrix;
performing matrix conversion processing on the adjacent matrix and the degree matrix to obtain a target matrix;
inputting the target matrix and the node characteristics into a graph convolution network in the abnormal object identification model, and obtaining object proximity characteristics of the nodes by the graph convolution network according to the target matrix and the node characteristics;
and carrying out self-attention processing on the object proximity characteristic of the adjacent node by a graph attention network in the abnormal object identification model to obtain the object compactness characteristic of the node.
In some implementations, the second obtaining module 1020 is further configured to:
determining nodes and adjacent nodes of the nodes by the graph convolution network according to the target matrix;
the graph convolution network comprises M first hidden layers, the first hidden layer of the graph convolution network carries out feature weighted aggregation on the first node features and the second node features respectively according to the maximum adjacent distance, and the weighted first node features and the weighted second node features are output;
and inputting the weighted first node characteristics and the weighted second node characteristics into the (l + 1) th first hidden layer, and performing weighted aggregation on the weighted first node characteristics and the weighted second node characteristics by the (l + 1) th first hidden layer until the object proximity characteristics are output by the Mth first hidden layer.
In some implementations, the second obtaining module 1020 is further configured to:
acquiring the association degree between the nodes and the adjacent nodes according to the object proximity characteristic by the graph attention network;
and performing layer-by-layer feature aggregation on the object proximity features of the adjacent nodes according to the association degree through a plurality of second hidden layers in the graph attention network to output the object compactness features of the nodes.
In some implementations, the second obtaining module 1020 is further configured to:
the graph attention network comprises M second hidden layers, and the first +1 second hidden layers of the graph attention network perform feature weighted aggregation on the object proximity features and output weighted object proximity features;
and inputting the weighted object proximity features into the (l + 1) th second hidden layer, and performing weighted aggregation on the object proximity features by the (l + 1) th second hidden layer until the object compactness features are output by the Mth second hidden layer.
In some implementations, the abnormal object recognition apparatus 1000 further includes a training model 1050, and the training module 1050 is configured to:
training an initial abnormal object recognition model based on a sample object relation graph to obtain a first loss function of a graph convolution network and a second loss function of a graph self-attention network;
weighting the first loss function and the second function to obtain a target loss function;
and adjusting the initial abnormal object recognition model based on the target loss function and continuing training until the abnormal object recognition model is obtained after the training is finished.
In the embodiment of the disclosure, the object proximity feature and the object closeness feature are fused, and the proximity relation and the close relation between the objects are concerned, so that the unknown object can be identified through the known abnormal object, and the accuracy of identifying the abnormal object is improved.
The present disclosure also provides an electronic device, a readable storage medium, and a computer program product according to embodiments of the present disclosure.
FIG. 11 shows a schematic block diagram of an example electronic device 1100 that may be used to implement embodiments of the present disclosure. Electronic devices are intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions, are meant to be examples only, and are not meant to limit implementations of the disclosure described and/or claimed herein.
As shown in fig. 11, the device 1100 comprises a computing unit 1101, which may perform various appropriate actions and processes according to a computer program stored in a Read Only Memory (ROM) 1102 or a computer program loaded from a storage unit 1108 into a Random Access Memory (RAM) 1103. In the RAM 1103, various programs and data necessary for the operation of the device 1100 may also be stored. The calculation unit 1101, the ROM 1102, and the RAM 1103 are connected to each other by a bus 1104. An input/output (I/O) interface 1105 is also connected to bus 1104.
A number of components in device 1100 connect to I/O interface 1105, including: an input unit 1106 such as a keyboard, a mouse, and the like; an output unit 1107 such as various types of displays, speakers, and the like; a storage unit 1108 such as a magnetic disk, optical disk, or the like; and a communication unit 1109 such as a network card, a modem, a wireless communication transceiver, and the like. The communication unit 1109 allows the device 1100 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.
The computing unit 1101 can be a variety of general purpose and/or special purpose processing components having processing and computing capabilities. Some examples of the computing unit 1101 include, but are not limited to, a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), various dedicated Artificial Intelligence (AI) computing chips, various computing units running machine learning model algorithms, a Digital Signal Processor (DSP), and any suitable processor, controller, microcontroller, and the like. The calculation unit 1101 performs the respective methods and processes described above, such as the identification method of an abnormal object. For example, in some embodiments, the method of identifying an anomalous object may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 1108. In some embodiments, part or all of the computer program may be loaded and/or installed onto device 1100 via ROM 1102 and/or communication unit 1109. When the computer program is loaded into the RAM 1103 and executed by the computing unit 1101, one or more steps of the above-described identification method of an abnormal object may be performed. Alternatively, in other embodiments, the computing unit 1101 may be configured to perform the identification method of the abnormal object by any other suitable means (e.g., by means of firmware).
Various implementations of the systems and techniques described here above may be implemented in digital electronic circuitry, integrated circuitry, field Programmable Gate Arrays (FPGAs), application Specific Integrated Circuits (ASICs), application Specific Standard Products (ASSPs), system on a chip (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and/or combinations thereof. These various embodiments may include: implemented in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, receiving data and instructions from, and transmitting data and instructions to, a storage system, at least one input device, and at least one output device.
Program code for implementing the methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowchart and/or block diagram to be performed. The program code may execute entirely on the machine, partly on the machine, as a stand-alone software package partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of this disclosure, a machine-readable medium may be a tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device. The machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of a machine-readable storage medium would include an electrical connection based on one or more wires, a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
To provide for interaction with an object, the systems and techniques described here can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to an object; and a keyboard and a pointing device (e.g., a mouse or a trackball) by which objects can provide input to the computer. Other kinds of devices may also be used to provide for interaction with an object; for example, feedback provided to the subject can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the object may be received in any form, including acoustic, speech, or tactile input.
The systems and techniques described here can be implemented in a computing system that includes a back-end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front-end component (e.g., an object computer having a graphical object interface or a web browser through which objects can interact with an implementation of the systems and techniques described here), or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local Area Networks (LANs), wide Area Networks (WANs), and the Internet.
The computer system may include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server may be a cloud server, a server of a distributed system, or a server with a combined blockchain.
It should be understood that various forms of the flows shown above may be used, with steps reordered, added, or deleted. For example, the steps described in the present disclosure may be executed in parallel, sequentially, or in different orders, as long as the desired results of the technical solutions disclosed in the present disclosure can be achieved, and the present disclosure is not limited herein.
The above detailed description should not be construed as limiting the scope of the disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may be made in accordance with design requirements and other factors. Any modification, equivalent replacement, and improvement made within the spirit and principle of the present disclosure should be included in the scope of protection of the present disclosure.

Claims (21)

1. A method for identifying an abnormal object comprises the following steps:
acquiring an object association graph among the candidate objects, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects;
according to the object association graph, acquiring object proximity characteristics and object compactness characteristics of the nodes;
fusing the object proximity characteristic and the object compactness characteristic to obtain a fusion characteristic of the node;
and performing abnormal recognition on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object recognition result.
2. The method according to claim 1, wherein the obtaining of the object proximity feature and the object closeness feature of the node according to the object association graph comprises:
acquiring an adjacency matrix of the object association map;
and acquiring the object proximity characteristic and the object compactness characteristic of the node according to the adjacency matrix.
3. The method of claim 2, wherein the process of obtaining object proximity characteristics of the nodes comprises:
determining adjacent nodes of the nodes according to the adjacency matrix;
and performing feature aggregation on the first node feature of the node and the second node feature of the adjacent node to obtain the object proximity feature of the node.
4. The method of claim 2, wherein the process of obtaining object closeness characteristics of the nodes comprises:
determining adjacent nodes of the nodes according to the adjacency matrix;
acquiring the association degree between the node and the adjacent node of the node according to the object proximity characteristic of the node and the object proximity characteristic of the adjacent node;
and according to the relevance, carrying out feature aggregation on the object proximity features of the adjacent nodes to obtain the object compactness features of the nodes.
5. The method according to any one of claims 2-4, wherein said obtaining object proximity features and object closeness features of said nodes according to said adjacency matrix comprises:
performing matrix conversion processing on the adjacent matrix to obtain a degree matrix;
performing matrix conversion processing on the adjacent matrix and the degree matrix to obtain a target matrix;
inputting the target matrix and the node characteristics into a graph convolution network in an abnormal object identification model, and obtaining object proximity characteristics of the nodes by the graph convolution network according to the target matrix and the node characteristics;
and carrying out self-attention processing on the object proximity characteristic of the adjacent node by a graph attention network in the abnormal object identification model to obtain the object compactness characteristic of the node.
6. The method of claim 5, wherein the method further comprises:
determining, by the graph convolution network, the node and neighboring nodes of the node according to the target matrix;
the graph convolution network comprises M first hidden layers, the first hidden layer of the graph convolution network carries out feature weighted aggregation on the first node features and the second node features respectively according to the maximum adjacent distance, and weighted first node features and weighted second node features are output;
and inputting the weighted first node features and the weighted second node features into the (l + 1) th first hidden layer, and performing weighted aggregation on the weighted first node features and the weighted second node features by the (l + 1) th first hidden layer until the object proximity features are output by the Mth first hidden layer.
7. The method of claim 5, wherein the method further comprises:
acquiring the association degree between the node and the adjacent node according to the object proximity characteristic by the graph attention network;
and performing layer-by-layer feature aggregation on the object proximity features of the adjacent nodes according to the association degree through a plurality of second hidden layers in the graph attention network to output the object compactness features of the nodes.
8. The method of claim 7, wherein said layer-by-layer feature aggregation of object proximity features of said neighboring nodes according to said relevance to output an object compactness feature of said nodes comprises:
the graph attention network comprises M second hidden layers, and feature weighted aggregation is carried out on the object proximity features by the ith second hidden layer of the graph attention network to output weighted object proximity features;
and inputting the weighted object proximity features into the (l + 1) th second hidden layer, and performing weighted aggregation on the object proximity features by the (l + 1) th second hidden layer until the object compactness features are output by the Mth second hidden layer.
9. The method of claim 5, wherein the training process of the abnormal object recognition model comprises:
training an initial abnormal object recognition model based on a sample object association graph to obtain a first loss function of the graph convolution network and a second loss function of the graph self-attention network;
weighting the first loss function and the second function to obtain a target loss function;
and adjusting the initial abnormal object recognition model and continuing training based on the target loss function until the abnormal object recognition model is obtained after the training is finished.
10. An apparatus for identifying an abnormal object, comprising:
the first acquisition module is used for acquiring an object association graph among candidate objects, wherein the object association graph comprises a plurality of nodes, and different nodes represent different candidate objects;
the second acquisition module is used for acquiring the object proximity characteristic and the object compactness characteristic of the node according to the object association graph;
the feature fusion module is used for fusing the object proximity feature and the object compactness feature to obtain a fusion feature of the node;
and the anomaly identification module is used for carrying out anomaly identification on the target candidate object represented by the node based on the fusion characteristics of the node to obtain an object identification result.
11. The apparatus of claim 10, wherein the second obtaining means is further configured to:
acquiring an adjacency matrix of the object relation map;
and acquiring the object proximity characteristic and the object compactness characteristic of the node according to the adjacency matrix.
12. The apparatus of claim 11, wherein the second obtaining means is further configured to:
determining adjacent nodes of the nodes according to the adjacency matrix;
and performing feature aggregation on the first node feature of the node and the second node feature of the adjacent node to obtain the object proximity feature of the node.
13. The apparatus of claim 11, wherein the second obtaining means is further configured to:
determining adjacent nodes of the nodes according to the adjacency matrix;
acquiring the association degree between the node and the adjacent node of the node according to the object proximity characteristic of the node and the object proximity characteristic of the adjacent node;
and according to the relevance, carrying out feature aggregation on the object proximity features of the adjacent nodes to obtain the object compactness features of the nodes.
14. The apparatus of any of claims 11-13, wherein the second obtaining means is further configured to:
performing matrix conversion processing on the adjacent matrix to obtain a degree matrix;
performing matrix conversion processing on the adjacent matrix and the degree matrix to obtain a target matrix;
inputting the target matrix and the node characteristics into a graph convolution network in an abnormal object identification model, and obtaining object proximity characteristics of the nodes by the graph convolution network according to the target matrix and the node characteristics;
and carrying out self-attention processing on the object proximity characteristic of the adjacent node by a graph attention network in the abnormal object identification model to obtain the object compactness characteristic of the node.
15. The apparatus of claim 14, wherein the second obtaining means is further configured to:
determining, by the graph convolution network, the node and neighboring nodes of the node according to the target matrix;
the graph convolution network comprises M first hidden layers, the first hidden layer of the graph convolution network carries out feature weighted aggregation on the first node features and the second node features respectively according to the maximum adjacent distance, and weighted first node features and weighted second node features are output;
and inputting the weighted first node features and the weighted second node features into the (l + 1) th first hidden layer, and performing weighted aggregation on the weighted first node features and the weighted second node features by the (l + 1) th first hidden layer until the object proximity features are output by the Mth first hidden layer.
16. The apparatus of claim 15, wherein the second obtaining means is further configured to:
acquiring the association degree between the node and the adjacent node according to the object proximity characteristic by the graph attention network;
and performing layer-by-layer feature aggregation on the object proximity features of the adjacent nodes according to the relevance through a plurality of second hidden layers in the graph attention network to output the object compactness features of the nodes.
17. The apparatus of claim 16, wherein the second obtaining means is further configured to:
the graph attention network comprises M second hidden layers, and feature weighted aggregation is carried out on the object proximity features by the ith second hidden layer of the graph attention network to output weighted object proximity features;
and inputting the weighted object proximity features into the (l + 1) th second hidden layer, and performing weighted aggregation on the object proximity features by the (l + 1) th second hidden layer until the object compactness features are output by the Mth second hidden layer.
18. The apparatus of claim 14, wherein the apparatus further comprises a training module to:
training an initial abnormal object recognition model based on a sample object relation graph to obtain a first loss function of the graph volume network and a second loss function of the graph self-attention network;
weighting the first loss function and the second function to obtain a target loss function;
and adjusting the initial abnormal object recognition model and continuing training based on the target loss function until the abnormal object recognition model is obtained after the training is finished.
19. An electronic device, comprising:
at least one processor; and
a memory communicatively coupled to the at least one processor; wherein,
the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-9.
20. A non-transitory computer readable storage medium having stored thereon computer instructions for causing the computer to perform the method of any one of claims 1-9.
21. A computer program product comprising a computer program which, when executed by a processor, carries out the steps of the method according to any one of claims 1-9.
CN202211190169.9A 2022-09-28 2022-09-28 Abnormal object identification method and device, electronic equipment and storage medium Pending CN115577310A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211190169.9A CN115577310A (en) 2022-09-28 2022-09-28 Abnormal object identification method and device, electronic equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211190169.9A CN115577310A (en) 2022-09-28 2022-09-28 Abnormal object identification method and device, electronic equipment and storage medium

Publications (1)

Publication Number Publication Date
CN115577310A true CN115577310A (en) 2023-01-06

Family

ID=84583007

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211190169.9A Pending CN115577310A (en) 2022-09-28 2022-09-28 Abnormal object identification method and device, electronic equipment and storage medium

Country Status (1)

Country Link
CN (1) CN115577310A (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117574308A (en) * 2024-01-17 2024-02-20 江西金格信安云技术有限公司 Metering chip abnormality detection method and system based on artificial intelligence

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117574308A (en) * 2024-01-17 2024-02-20 江西金格信安云技术有限公司 Metering chip abnormality detection method and system based on artificial intelligence
CN117574308B (en) * 2024-01-17 2024-03-26 江西金格信安云技术有限公司 Metering chip abnormality detection method and system based on artificial intelligence

Similar Documents

Publication Publication Date Title
CN113033622B (en) Training method, device, equipment and storage medium for cross-modal retrieval model
CN113657465A (en) Pre-training model generation method and device, electronic equipment and storage medium
CN114494784A (en) Deep learning model training method, image processing method and object recognition method
CN112580733B (en) Classification model training method, device, equipment and storage medium
US20230186607A1 (en) Multi-task identification method, training method, electronic device, and storage medium
CN115063875A (en) Model training method, image processing method, device and electronic equipment
US20220414689A1 (en) Method and apparatus for training path representation model
CN112818686A (en) Domain phrase mining method and device and electronic equipment
CN113221104A (en) User abnormal behavior detection method and user behavior reconstruction model training method
CN113902010A (en) Training method of classification model, image classification method, device, equipment and medium
CN115496970A (en) Training method of image task model, image recognition method and related device
CN115577310A (en) Abnormal object identification method and device, electronic equipment and storage medium
CN113449778A (en) Model training method for quantum data classification and quantum data classification method
CN113468857A (en) Method and device for training style conversion model, electronic equipment and storage medium
CN115982654B (en) Node classification method and device based on self-supervision graph neural network
CN114419327B (en) Image detection method and training method and device of image detection model
CN113989569B (en) Image processing method, device, electronic equipment and storage medium
CN113222414B (en) Model stability evaluation method and device, electronic equipment and storage medium
CN114817476A (en) Language model training method and device, electronic equipment and storage medium
CN114548307A (en) Classification model training method and device, and classification method and device
CN114943995A (en) Training method of face recognition model, face recognition method and device
CN114078274A (en) Face image detection method and device, electronic equipment and storage medium
CN114490965A (en) Question processing method and device, electronic equipment and storage medium
CN114117248A (en) Data processing method and device and electronic equipment
CN114066278B (en) Method, apparatus, medium, and program product for evaluating article recall

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination