42results about How to "Accurate Anomaly Detection" patented technology

The invention discloses a real-time network flow anomaly detection method based on big data, which comprises the following steps: S1, obtaining collected and analyzed historical flow data with attacktags stored in a database to obtain attack types; S2, performing data feature preprocessing on the historical traffic data in the S1, and constructing a first class of feature vectors; S3, constructing a clustering model based on the first class of feature vectors in the S2, and obtaining a target model meeting a preset condition by utilizing model evaluation and optimization; S4, storing the target model obtained in S3 and deploying the target model online; S5, capturing and collecting real-time network data flow packet information transmitted in a local area network; S6, performing data feature preprocessing on the real-time network data traffic packet in S5, and constructing a second type of feature vectors; and S7, according to the target model in the S3 and the second type of featurevectors in the S6, performing real-time online analysis and detection, and judging whether the current real-time network data traffic is abnormal traffic or normal traffic.

The invention discloses a mixed model multivariate time sequence anomaly detection method based on a graph neural network, and the method comprises the steps: dividing a multivariate time sequence into a feature matrix based on a sliding window, an adjacent matrix, and an adjacent matrix based on a fixed window, and carrying out the preprocessing of a first feature matrix, a first adjacent matrix, and a second adjacent matrix; constructing a graph convolutional neural network prediction model, and inputting the first feature matrix and the first adjacent matrix to obtain a prediction value; comparing the real value with the abnormal time stamp to judge an abnormal time stamp; constructing a convolutional neural network and attention long-short-term memory network hybrid reconstruction model, and inputting the second adjacent matrix to obtain a reconstructed adjacent matrix; comparing to obtain a reconstruction error matrix, and judging an abnormal time sequence according to the sizes of the elements in the reconstruction error matrix and the number of the elements exceeding a threshold value; and determining an abnormal point according to the abnormal timestamp and the abnormal time sequence. Compared with the prior art, the abnormal time stamp and the abnormal time sequence in the multivariate time sequence can be detected, and the abnormal detection granularity, efficiency and detection accuracy of the multivariate time sequence are improved.

The invention relates to an electric energy metering device abnormality detecting method based on a long and short term memory model. The method comprises the steps of (1) acquiring original collecteddata, (2) carrying out data preprocessing, (3) setting model hyperparameters, (4) training the model with a training sample, (5) testing the model with a test sample, and (6) output an electric energy metering device abnormality detecting result. According to the electric energy metering device abnormality detecting method based on the long and short term memory model, the deep learning theory isapplied to digital electric energy meter abnormality detection, and the change characteristics of each piece of collected data under various faults are automatically learned in case of a large amountof data and easy missing, at the same time, the method has good fault tolerance, and the improvement of the accuracy and timeliness of the abnormality detection of an electric energy metering deviceis helped.

The invention provides a data exception detection system and method, and the method comprises the following steps: carrying out the preprocessing of original data, removing an interference value in the original data, and carrying out the filling of the data with the interference value removed; performing normalization processing on the filled data; shaping the normalized data to obtain superviseddata; analyzing the supervised data by using an LSTM network to obtain prediction data; and comparing the prediction data with the real data to judge whether the original data is abnormal or not. According to the data exception detection method disclosed by the invention, rapid and accurate exception detection can be carried out on the data, and exception can be immediately processed when an aircraft and the like are exceptional, so that the absolute safety of aircraft flight is ensured; the data exception detection system has the advantages of high speed, high accuracy and the like when usedfor carrying out exception detection on the data.

The invention discloses a pre-warning model and method for vehicle speed abnormity and based on car networking and a model building method. The model building method comprises a step of screening speed data, a step of abstracting speed components, a step of calculating speed difference components, a step of grouping the speed difference components and a step of calculating safe sections using a quartile method and building the pre-warning model. The pre-warning method for the vehicle speed abnormity comprises a step of obtaining the speed data of a to-be-detected vehicle, a step of calculatingthe speed difference components and a step of using the referred pre-warning model for pre-warning detecting the speed difference components. According to the pre-warning model and method for the vehicle speed abnormity and based on the car networking and the model building method, continuous and all-round vehicle speed abnormity detecting can be carried out aiming at vehicle speed grades, the detecting effect is more comprehensive, and the pre-warning effect is more precise.

The invention provides a multi-time-series data abnormity detection method and device, and the method comprises the following steps: obtaining to-be-processed data, and segmenting the to-be-processeddata into multi-time-series segment data; calculating a reconstruction value of each piece of time series fragment data of the multiple pieces of time series fragment data through an offline trainingmodel; calculating the reconstruction probability of each piece of time series fragment data based on the reconstruction value of each piece of time series fragment data; and comparing the reconstruction probability of the time series fragment data corresponding to the abnormal moment with an abnormal threshold to obtain an abnormal result, and analyzing the abnormal result. Therefore, on the premise of considering the randomness and time dependence of the multi-time series, the historical normal mode of the multi-time series is learned, so that the multi-time series data exception detection of the multi-time series data is more accurate, and the output result of the model has interpretability.

The invention discloses an anomaly detection method and device. According to the invention, comprehensive log data are comprehensively obtained; features are extracted from the acquired log data; thefeature is processed, and an anomaly detection model is trained and generated through an SVM algorithm based on the processed feature; the abnormal behavior is automatically detected through the anomaly detection model; meanwhile, the detection result is used for further training an anomaly detection model and a more accurate model is obtained; finally, the abnormal behaviors are detected. Therefore, the network anomaly detection method is based on comprehensive log data, anomaly detection is carried out on the network through the anomaly detection model after continuous evolution learning, sothat the abnormal behaviors are accurately detected, and the problem that anomaly detection cannot be effectively carried out on the network in the prior art is effectively solved.

The invention discloses an abnormal network information detection method based on a knowledge graph, and the method comprises the steps: polling an enterprise switch to capture related information in an industrial internet through employing an SNMP network protocol, thereby constructing a model, and achieving a data cleaning effect; secondly, abnormal and non-abnormal information is filtered through a probability statistics anomaly detection algorithm based on normal distribution, the screened non-abnormal information is filtered through a time dimension detection algorithm, and time points and other related data of IPv6 address number amplification anomaly under the time dimension are found out; and finally, establishing a dynamic knowledge graph to find out association information and association degrees among the abnormal information, and generating a downloadable text document which is displayed in a graph manner. According to the method provided by the invention, more valuable information can be analyzed from an industrial IPv6 network environment, and the accuracy and speed of abnormal condition detection are remarkably improved.

The invention provides a method and system for detecting the abnormity of the cylinder temperature of a diesel generator set. The method includes the following steps: collecting data of multiple parameters related to the generator set cylinder temperature; introducing the collected data of the multiple parameters into corresponding abnormality detection models to calculate the abnormity probability of each parameter; and conducting combination operation on the abnormity probabilities of the parameters to generate an abnormity probability reflecting the generator set cylinder temperature. By detecting the abnormal conditions of the cylinder temperature and other parameters related to the cylinder temperature, the abnormity probability reflecting the cylinder temperature can be generated, and thus accurate detection and analysis of the abnormal conditions of the cylinder temperature are realized to facilitate timely early warning and ensure the safe operation of the generator set.

The invention relates to a one-dimensional time sequence anomaly detection method and device and computer equipment. The method comprises the following steps: extracting a to-be-predicted point from a one-dimensional time sequence, and extracting to-be-predicted context information of the to-be-predicted point through a sliding window; carrying out dimensionality reduction on the context information to be predicted by adopting an encoder to obtain low-dimensional embedded data to be predicted; querying a plurality of neighbor data of the to-be-predicted low-dimensional embedded data in the detection set; according to the sample performance vector of the neighbor data, obtaining the probability that the base detector sequence correctly detects the one-dimensional time sequence; obtaining a base detector with the highest detection performance according to the probability of correctly detecting the one-dimensional time sequence by the base detector sequence; and performing anomaly detection on the one-dimensional time sequence according to the base detector with the highest detection performance. By adopting the method, the time sequence anomaly detection performance can be improved.

The invention discloses a device exception handling method and device based on a rule base, and a storage medium. The method comprises the steps: periodically obtaining an input quantity and an electrical quantity sent by each device in a power system; performing data matching on the input quantity and the electrical quantity which are uploaded and a pre-constructed exception handling rule base, and performing device exception detection; and when it is detected that the device is abnormal, issuing an exception handling suggestion to the device according to the exception handling rule base and displaying the exception handling suggestion. The device comprises an exception handling rule base, a signal acquisition module, an exception detection module, an exception handling module, an alarm module and a rule base updating module. According to the method, the abnormal state of a safety control device can be quickly and effectively identified, a reasonable abnormality handling suggestion is provided, and the working efficiency and the operation safety and reliability of a power grid safety and stability control system are improved.

A computer-implemented method for detecting anomalies in sensor recordings of a technical system. The method including: ascertaining a first anomalous value which, with regard to all sensor recordings, characterizes whether or not an anomaly is present; ascertaining a plurality of second anomalous values, a second anomalous value from the second anomalous values corresponding to a sensor recording, and the second anomalous value, with regard to the sensor recording and under the condition of the occurrence of the other sensor recordings, characterizing whether or not an anomaly is present in the sensor recording; detecting an anomaly in a sensor recording of the sensor recordings if the first anomalous value characterizes the presence of an anomaly, and the second anomalous value corresponding to the sensor recording characterizes an anomaly, and the second anomalous value differs beyond a predefined extent from other second anomalous values of the second anomalous values.