Building method and device of anomaly detection training set

Abstract

The invention discloses a building method and device of an anomaly detection training set. The method comprises the steps as follows: an acquired sampled data set is determined as a current data set; labelled data is acquired in the current data set according to each received current labelling instruction, the labelled data is added into a first data set, and unlabelled data forms a second data set; and whether the number of outlier data reaches a preset value is determined, if yes, a training set is generated according to the labelled data and the unlabelled data, otherwise, the outlier probability of the unlabelled data is computed according to the first data set, the unlabelled data is ordered according to the outlier probability and determined as the current data set, and each current labelling instruction is acquired by returning for execution. Compared with the single computation of the outlier probability in the prior art, the method utilizes the labelled data to recalculate the outlier probability of the unlabeled data; and on the basis that the outlier ordering shifts forwards after the outlier probability ordering, labelling times can be reduced, and building efficiency of the training set is improved.

Description

technical field [0001] The present application relates to the technical field of anomaly detection, in particular to a method and device for constructing an anomaly detection training set. Background technique [0002] Anomaly detection is to detect a large amount of data generated in a certain transaction activity to determine abnormal data therein, and the abnormal data is called an abnormal point. Abnormal points have distribution characteristics or performance patterns that do not conform to normal data. By analyzing abnormal points, the security status of transaction activities can be known. For example, abnormal points in credit transactions may represent a credit fraud, and abnormal points in network communications may represent hackers. Attack on computer. The main method of anomaly detection is to use a pre-built training set to detect the large amount of data using an anomaly detection algorithm. Therefore, the training set is the basis of the described anomaly d...

AI Technical Summary

Problems solved by technology

[0005] In view of this, the present application provides a method and device for constructing an anomaly detection training set to solve the problem of calculating the outlier probability of sample data in a single calculation in the existing construction method. The number of times of labeling is large, which leads to the problem of low construction efficiency of the training set

Images