Search

CN-121980457-A - Abnormality detection method, abnormality detection device, electronic device, and storage medium

CN121980457ACN 121980457 ACN121980457 ACN 121980457ACN-121980457-A

Abstract

The disclosure provides an anomaly detection method, an anomaly detection device, electronic equipment and a storage medium, relates to the technical field of data processing, and particularly relates to the fields of big data, knowledge maps, intelligent search and the like. The method comprises the steps of performing at least one round of super-step processing on graph data to obtain target information, wherein the graph data comprises vertexes representing entities and edges representing links between the two entities, determining path information according to the target information, and determining at least one piece of abnormal entity information and at least one piece of abnormal link information according to the path information. The super-step processing of each round comprises the steps of determining the current vertex of the current round, updating information by utilizing the point information of the current vertex and taking the point information as a target message if the current vertex meets the preset termination condition, updating the information by utilizing the point information of the current vertex and the edge information of the edge when the current vertex does not meet the preset termination condition and the edge of the current vertex meets the edge propagation condition, and sending the updated information to the target vertex connected with the edge.

Inventors

  • ZHANG ZHIKUAN
  • LI YULIN

Assignees

  • 北京百度网讯科技有限公司

Dates

Publication Date
20260505
Application Date
20260122

Claims (17)

  1. 1. An anomaly detection method, comprising: Performing at least one round of super-step processing on graph data to obtain a target message, wherein the graph data comprises vertexes representing entities and edges representing links between the two entities, and the target message comprises point information and edge information recorded in the process of the at least one round of super-step processing; Determining the searched path information according to the target message, and Determining at least one abnormal entity information and at least one abnormal link information according to the path information; wherein each of the at least one round of superstep processing comprises: determining a current vertex in an active state in the current round from the graph data; in response to detecting that the current vertex satisfies the predetermined termination condition, updating the message with the point information of the current vertex, determining the updated message as a target message, and And in response to detecting that the current vertex does not meet the preset termination condition and the outgoing edge of the current vertex meets the edge propagation condition, updating the message by utilizing the point information of the current vertex and the edge information of the outgoing edge, and sending the updated message to the target vertex connected with the outgoing edge.
  2. 2. The method of claim 1, wherein the updating the message with the point information of the current vertex in response to detecting that the current vertex satisfies a predetermined termination condition comprises: In response to detecting that the current vertex satisfies a point termination condition in the predetermined termination conditions, or in response to detecting that the outgoing edge of the current vertex satisfies an edge termination condition in the predetermined termination conditions, adding the point information of the current vertex to a point information set in the message.
  3. 3. The method of claim 2, wherein in response to detecting that the current vertex satisfies a predetermined termination condition, updating the message with the point information for the current vertex further comprises at least one of: in response to detecting that an outgoing edge of a current vertex meets the edge termination condition, adding edge information of the outgoing edge to an edge information set in the message; And in response to detecting that the outgoing edge of the current vertex meets the edge termination condition, adding the point information of the target vertex connected by the outgoing edge to a point information set in the message.
  4. 4. The method of claim 2, wherein the edge termination condition comprises at least one of: the type of the outgoing edge of the current vertex is consistent with the type of the preset edge; at least one side attribute information of the current vertex out side is consistent with the first out side attribute sub-condition; the side attribute information of the outgoing side of the current vertex meets a second outgoing side attribute sub-condition, and the side attribute information of the incoming side of the current vertex meets a preset incoming side attribute sub-condition; The access edge relationship of the current vertex is consistent with the preset relationship, wherein the access edge relationship of the current vertex is the relationship between the edge attribute information of the outgoing edge of the current vertex and the edge attribute information of the incoming edge of the current vertex.
  5. 5. The method of claim 1, wherein the updating the message with the point information of the current vertex and the edge information of the outgoing edge comprises: Adding the point information of the current vertex to a point information set in the message; and adding the edge information of the outgoing edge to an edge information set in the message.
  6. 6. The method of claim 1, wherein the determining, from the graph data, a current vertex in an active state in a current round comprises: under the condition that the current round is the first round, taking a starting vertex meeting a starting point condition in the graph data as a current vertex; and under the condition that the current round is the other rounds after the first round, taking the target vertex which receives the updated message in the super-step processing process of the previous round as the current vertex.
  7. 7. The method of any of claims 1 to 6, wherein updating the message comprises: reading target information from a local preset storage area, wherein the target information comprises point information of a current vertex or comprises point information of the current vertex and side information of an outgoing side of the current vertex; Adding the target information to the message; Wherein the information in the predetermined storage area is obtained by reading information for each vertex and information for each side in the graph data from a database and writing the information read from the database into the predetermined storage area.
  8. 8. The method of claim 7, wherein the reading information for each vertex and information for each edge in the graph data from a database comprises: information related to a path propagation rule is read from the database for each vertex and each edge in the graph data, wherein the path propagation rule comprises a starting point condition, the preset termination condition and the edge propagation condition.
  9. 9. The method of claim 1, wherein the point information of the current vertex includes a point identification, a point type, and at least one point attribute information designated in advance, and the side information of the outgoing side of the current vertex includes a side identification, a side type, and at least one side attribute information designated in advance.
  10. 10. The method of claim 1, wherein the determining the searched path information from the target message comprises: Determining the path information according to the target message in response to detecting that the at least one round of superstep processing satisfies a termination processing condition; The termination processing condition comprises that the number of the current vertexes in the active state in the current round is 0.
  11. 11. The method of claim 1, wherein the determining the updated message as the target message comprises: And assigning the temporary attribute of the current vertex according to the updated message, wherein the temporary attribute comprises a point information set for recording point information and a side information set for recording side information.
  12. 12. The method of claim 11, wherein the determining the searched path information from the target message comprises: Reading the temporary attribute of each vertex in the graph data; respectively reading point information and side information from a point information set and a side information set in the temporary attribute; And arranging the point information and the side information read from the temporary attribute to obtain the path information.
  13. 13. The method of claim 1, wherein the link between the two entities comprises one of: A physical route between two entities; a data transmission link between the two entities; object flow path between two entities.
  14. 14. An abnormality detection apparatus comprising: The processing module is used for carrying out at least one round of super-step processing on the graph data to obtain a target message, wherein the graph data comprises vertexes representing entities and edges representing links between the two entities, and the target message comprises point information and edge information recorded in the process of the at least one round of super-step processing; the path determining module is used for determining the searched path information according to the target message; the anomaly determination module is used for determining at least one piece of anomaly entity information and at least one piece of anomaly link information according to the path information; wherein each of the at least one round of superstep processing comprises: determining a current vertex in an active state in the current round from the graph data; In response to detecting that the current vertex satisfies a predetermined termination condition, updating the message with point information of the current vertex, and determining the updated message as a target message; And in response to detecting that the current vertex does not meet the preset termination condition and the outgoing edge of the current vertex meets the edge propagation condition, updating the message by utilizing the point information of the current vertex and the edge information of the outgoing edge, and sending the updated message to the target vertex connected with the outgoing edge.
  15. 15. An electronic device, comprising: at least one processor, and A memory communicatively coupled to the at least one processor, wherein, The memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 13.
  16. 16. A non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the method of any one of claims 1 to 13.
  17. 17. A computer program product comprising a computer program which, when executed by a processor, implements the method according to any one of claims 1 to 13.

Description

Abnormality detection method, abnormality detection device, electronic device, and storage medium Technical Field The present disclosure relates to the field of data processing technologies, and in particular, to the fields of big data, knowledge maps, intelligent searching, and the like, and more particularly, to an anomaly detection method, an anomaly detection device, an electronic device, a storage medium, and a computer program product. Background In the scenes of finance, communication network fault diagnosis, traffic system fault investigation and the like, the relationship between the entities in the scene and each entity can be constructed into a graph structure, and then path information is searched from the graph structure. Thereby determining an abnormal situation in the traffic based on the path information. Disclosure of Invention The present disclosure provides an anomaly detection method, apparatus, electronic device, storage medium, and computer program product. According to one aspect of the disclosure, an anomaly detection method is provided, which includes performing at least one round of super-step processing on graph data to obtain a target message, wherein the graph data includes vertices representing entities and edges representing links between two entities, the target message includes point information and edge information recorded in the course of the at least one round of super-step processing, determining searched path information according to the target message, and determining at least one anomaly entity information and at least one anomaly link information according to the path information. Each turn of the super-step processing in the at least one turn of the super-step processing comprises the steps of determining a current vertex in an active state in the current turn from graph data, updating a message by utilizing point information of the current vertex in response to detecting that the current vertex meets a preset termination condition, determining the updated message as a target message, and updating the message by utilizing the point information of the current vertex and the edge information of an outgoing edge in response to detecting that the current vertex does not meet the preset termination condition and the outgoing edge of the current vertex meets an edge propagation condition, and sending the updated message to the target vertex connected with the outgoing edge. According to another aspect of the present disclosure, there is provided an abnormality detection apparatus including a processing module, a path determination module, and an abnormality determination module. The processing module is used for carrying out at least one round of super-step processing on the graph data to obtain a target message, wherein the graph data comprises vertexes representing the entities and edges representing a link between the two entities, and the target message comprises point information and edge information recorded in the process of at least one round of super-step processing. The path determining module is used for determining the searched path information according to the target message. The anomaly determination module is used for determining at least one piece of anomaly entity information and at least one piece of anomaly link information according to the path information. Each turn of super-step processing in the at least one turn of super-step processing comprises the steps of determining a current vertex in an active state in a current turn from graph data, updating a message by utilizing point information of the current vertex in response to detecting that the current vertex meets a preset termination condition, determining the updated message as a target message, and updating the message by utilizing the point information of the current vertex and the edge information of an outgoing edge in response to detecting that the current vertex does not meet the preset termination condition and the outgoing edge of the current vertex meets an edge propagation condition, and sending the updated message to the target vertex connected with the outgoing edge. According to another aspect of the present disclosure, there is provided an electronic device comprising at least one processor, and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods provided by the present disclosure. According to another aspect of the present disclosure, there is provided a non-transitory computer-readable storage medium storing computer instructions for causing a computer to perform the method provided by the present disclosure. According to another aspect of the present disclosure, there is provided a computer program product comprising a computer program which, when executed by a processor, implements the method provided by the present disclosure.