39results about How to "Improve anomaly detection performance" patented technology

The invention relates to a large-scale data abnormity detection method comprising the steps that A. data preprocessing and feature extraction are performed; B. hyperplane calculation based on twin support vector machines is performed, and a hyperplane standard function of partition data space is constructed; C. an isolation tree is formed: the isolation tree is established through the partition criterion of the hyperplane of the twin support vector machines; D. an isolation forest is formed: the step C is repeated, and multiple isolation trees are constructed so as to form the isolation forest; and E. the isolation forest is traversed and the abnormity score is calculated: the isolation forest is traversed through the data under abnormity detection and the abnormity score is calculated to act as the standard for judging the degree of abnormity score, and existence of the abnormal data in the original data is judged according to the standard. The detection data volume can be effectively reduced so that the calculation workload can be reduced, the abnormity detection accuracy can be enhanced without significant increasing of time consumption and the abnormity detection performance for the high dimensional data can be greatly enhanced.

The invention discloses a multi-region variable-scale 3D-HOF based surveillance video anomaly detection method, which comprises the steps of firstly acquiring surveillance video to serve as input, performing partition processing on the video, then extracting variable-scale 3D-HOF features and optical flow direction information entropy in each sub-region, combining the variable-scale 3D-HOF features and the optical flow direction information entropy into final detection features, finally learning an initial sparse combination set in each sub-region by using a sparse combination learning algorithm, judging whether the new data is abnormal or not through a reconstruction error, and updating the sparse combination set online by using normal data. The application of the invention not only solves a problem of perspective distortion existing in the surveillance video, but also makes full use of the difference of motion information in different optical flow amplitude intervals, and can acquiremore accurate moving speed information. The method disclosed by the invention is applicable to anomaly detection for the surveillance video, low in calculation complexity, accurate in detection result and good in algorithm robustness. The method has extensive applications in the technical field of video analysis.

An anomaly detection method of industrial control network signal based on depth learning structure relates to the technical field of outlier detection in industrial control network data. The present invention aims at solving the problem that it is difficult to detect a small amount of abnormal values because the normal data and the abnormal values need to be defined artificially in the existing method. The normalized calibrated data are obtained by data normalization and the normalized calibrated data are formed by adding some false sample values to the normalized calibrated data with the dataenhancement algorithm. The normal data and the detected data are input into a self-encoder compression network for training, and the trained data are obtained respectively; the distance between the normal data and the detected data is calculated by the depth neural network, and the classifier is used to judge the abnormal value of the detected data according to the distance. It is used for signalanomaly detection.

The invention is applicable to the technical field of water quality detection, and provides a water quality abnormity detection method and device and terminal equipment. The method comprises the following steps of acquiring time sequence measurement data within a first duration of a to-be-detected water area monitoring node, and inputting the time sequence measurement data into a UV254 predictionmodel based on a recurrent neural network (RNN) to obtain UV254 prediction data in the first duration of the to-be-detected water area monitoring node; computing a difference by using the UV254 measurement data and the UV254 prediction data, obtaining a residual error, and generating a confidence interval according to the residual error distribution; if the residual error is within the confidenceinterval, determining as a normal point; if the residual error is not within the confidence interval, determining as an abnormal point; and representing a cumulative probability of the water quality abnormity probabilities in a second time window for all measurement moments in the second time window in the first duration, and if the cumulative probability is larger than a preset probability threshold value, judging that a water quality abnormality event occurs in the second time window. According to the method, the device and the terminal equipment, the water quality abnormity detection effectis greatly reduced.

The invention relates to a real-time anomaly detection method based on a generative adversarial network, and the method comprises the steps: offline training and real-time detection; the offline training comprises the following steps: inputting batch historical normal data acquired from production equipment into a generative adversarial network model after data cleaning, the adversarial network model generating abnormal data and performing identification detection, and deploying the adversarial network model to a real-time detection environment after training is completed; the real-time detection comprises the following steps: collecting real-time data from production equipment, synchronously storing the data into a historical database, and inputting the real-time data into a generative adversarial network model for anomaly detection after data cleaning; when the detection result is normal, marking the real-time data as normal data, and inputting the normal data into the adversarial network model in a backflow manner for incremental training; and when the detection result is abnormal, triggering an abnormal alarm, waiting for manual processing, marking the real-time data as abnormal data when the detection result is confirmed as an abnormal result, and returning the abnormal data to the identification network part of the model for incremental training.

The invention relates to an electric power Internet-of-things equipment anomaly detection method based on a graph neural network. The method comprises the following steps of: S1, collecting the flow data and business data of different electric power Internet-of-things equipment through a data collection tool; S2, carrying out Koopman analysis on the collected data; S3, constructing a graph structure of an electric power Internet of things; S4, constructing a graph neural network model by taking a graph model as input, and updating the feature state of a node by utilizing graph convolution and a graph attention network; and S5, performing anomaly detection on the node at a certain moment by using K-Means clustering. According to the method, through introducing Koopman analysis, nonlinear dynamic characteristics of data of the electric power Internet of things are captured; and a graph convolutional neural network is introduced to extract the spatial features of the electric power Internet of things, the attributes of the device nodes and the information of the neighborhood device nodes in the topological structure of the electric power Internet of things are fused to achieve anomaly detection of the electric power Internet of things, and the accuracy and stability of detection are effectively improved.

The invention relates to a network abnormal traffic automatic detection method based on time sequence mining. The method belongs to the technical field of data mining, big data analysis and pattern recognition. The method comprises the steps of importing data, forming an initial time sequence model, segmenting the data to obtain data sub-sequences, obtaining optimal front and back relaxation spaces of the to-be-detected data sub-sequences by utilizing a rapid learning method, calculating distances among the data sub-sequences, obtaining a data sub-sequence similarity matrix, calculating abnormal degree scores, performing comparing and determining and the like. By a standard data access interface, a data import module reads the data value of the standard network traffic data so that data import and data standardization are conveniently realized, and the data is converted into a time sequence model and a data acquisition mode is simplified. The abnormal traffic sequence is researched andanalyzed from a plurality of data dimensions by utilizing the provided time sequence abnormal data detection method, so that the complexity of the data is reduced, and meanwhile, the time correlationcharacteristic of the original data of the network traffic is reserved.

The invention discloses a BERT anomaly detection method and equipment based on a template sequence or a word sequence. The method comprises the steps: firstly converting an original log message into the template sequence or the word sequence, taking the template sequence or the word sequence as the input of a BERT model, and achieving the training of the BERT model, and finally, anomaly detection on the to-be-detected template sequence or word sequence is realized by utilizing the trained BERT model, a good anomaly detection effect can be realized by only needing fewer training labels, and compared with the prior art, the training cost is greatly reduced, and the anomaly detection effect is improved.

The invention discloses a drilling process abnormity early warning model based on dynamic principal component analysis. The method comprises the steps of obtaining original data;, performing standardized preprocessing on the original data; forming an augmented matrix according to the standardized and preprocessed original data; forming an initial model according to a dynamic principal component analysis method and the augmented matrix, using the initial model to monitor abnormal data; if the detected data is normal, updating the initial modelaccording to the moving window principle, and if thedetected data is abnormal, analyzing and judging the fault cause according to the residual contribution rate. According to the technical scheme provided by the invention, the accuracy of abnormity detection is improved, and the early warning time delay is reduced, so that the problem of low abnormity early warning precision in the drilling process in the prior art is solved, and the effective early warning of abnormity in the drilling process is realized. Moreover, according to the technical scheme provided by the invention, real dynamic detection is realized, the method has adaptability, andthe abnormal detection effect is improved.

The invention provides a software anomaly detection method and device and electronic equipment. The method comprises the following steps: waking up a target thread every preset time unit; determining a timeout event of a to-be-tested function in the software based on the time wheel through the target thread; executing the event processing function corresponding to the to-be-tested function. In the mode, the function anomaly detection is realized based on the time wheel algorithm, the software anomaly detection performance can be improved, the software anomaly detection time precision can be increased, the detected performance loss is irrelevant to the number of tasks to be detected, and the detection of a large number of to-be-tested functions can be supported.

The invention belongs to the technical field of wireless communication networks, and discloses a data clustering method for an abnormal detection system, and a wireless communication network terminal.The method comprises the steps of uniformly calculating the similarity between classification attributes and numerical attributes; randomly selecting k clustering centers, distributing each point tothe nearest cluster according to similarity measurement, and updating the clustering center after each point is distributed; recalculating the distance between each point and each clustering center until no point is changed; calculating two entropy indexes; measuring the importance degree of each attribute according to the two entropy indexes, and calculating and updating the weight of each attribute; and recalculating the distance between each point and the clustering center according to the similarity measurement after the weight is updated, and allocating each point to the cluster closest to the point. The method has the advantages of high accuracy, low overhead and the like, can be used for data clustering in an anomaly detection system, realizes mixed data clustering containing classification attributes and numerical attributes, and considers the importance degree of each attribute.

Disclosed is a method for training an anomaly detection model of an unmanned moving object utilizing a message ID sequence, which includes: collecting packet data generated from the unmanned moving object; pre-processing the collected packet data; generating converted data for a message ID sequence of the packet data by inputting the preprocessed packet data into a language model; generating similar data similar to the message ID sequence of the packet data by inputting the preprocessed packet data into a first neural network model; training and evaluating the first neural network model by inputting the converted data of the language model and the similar data of the first neural network model into a training model; and predicting and training a symptom of the unmanned moving object by inputting the preprocessed packet data and the similar data of the first neural network model into a second neural network model.