CN-121997210-A - Method for anomaly detection, electronic device, computer readable medium, computer program product

Abstract

The disclosure provides an anomaly detection method, which comprises the steps of converting original data to be detected into a first-order logic FOL set by adopting a large language model LLM, extracting a minimum unsatisfiable subset MUS of the FOL set by adopting a satisfiability modulus theory SMT solver, wherein the MUS is used for indicating mutually conflicting FOLs, and carrying out conflict set analysis based on the MUS to obtain anomaly points of the original data. The present disclosure also provides an electronic device, a computer readable medium, a computer program product.

Inventors

• GUO TIAN

Assignees

• 中兴通讯股份有限公司

Dates

Publication Date

20260508

Application Date

20241107

Claims (10)

1. 1. A method of anomaly detection, comprising: Converting the original data to be detected into a first-order logic FOL set by adopting a large language model LLM; Extracting a Minimum Unsatisfiable Subset (MUS) of the FOL set by adopting a Satisfiability Modulo Theory (SMT) solver, wherein the MUS is used for indicating mutually conflicting FOLs; and carrying out conflict set analysis based on the MUS to obtain abnormal points of the original data.
2. 2. The method of claim 1, wherein the converting the raw data to be detected into a first order logical form set using a large language model LLM comprises: Acquiring a system prompt word matched with the data type of the original data, wherein the system prompt word is used for indicating a mode of extracting FOL; and inputting the original data and the system prompt words into the LLM, and outputting the FOL set corresponding to the original data.
3. 3. The method of claim 2, wherein the system hint word includes at least a data processing requirement, an input instance, and an output instance.
4. 4. The method of claim 1, wherein the extracting a minimum unsatisfiable subset, MUS, of the set of FOLs with a satisfaction theory, SMT, solver comprises: In a knowledge base, storing the original data and FOL sets corresponding to the original data in a correlated manner; responding to a first triggering condition, and extracting a FOL set stored in the knowledge base; And solving the extracted FOL set by adopting the SMT solver to obtain the MUS.
5. 5. The method of claim 4, wherein the first trigger condition comprises at least one or more of: the time interval between the current time and the time of the previous acquisition of the MUS reaches a first threshold; the current time reaches a first preset time; the number of FOL sets stored in the knowledge base reaches a second threshold; the original data stored in the knowledge base is first preset data; And receiving a first trigger instruction, wherein the first trigger instruction is used for indicating that a user performs an operation of determining the MUS.
6. 6. The method of any one of claims 1 to 5, wherein the performing a conflict set analysis based on the MUS detection to obtain outliers of the raw data comprises: Storing the MUS in an inference conclusion store; Responding to a second triggering condition, and extracting MUS stored in the reasoning conclusion library; Performing conflict set analysis on the extracted MUS to obtain root cause data; an outlier of the raw data is determined based on the root data.
7. 7. The method of claim 6, wherein the second trigger condition comprises at least one or more of: the time interval between the current time and the time when the root data was obtained last time reaches a third threshold; the current time reaches a second preset time; the number of MUSs stored in the reasoning conclusion library reaches a fourth threshold; The MUS stored in the reasoning conclusion library is second preset data; and receiving a second trigger instruction, wherein the second trigger instruction is used for indicating that the user performs the operation of acquiring root cause data.
8. 8. The method of claim 6, wherein the root cause data comprises a list of tuple objects and a list of MUS identifications, the list of tuple objects comprising at least one tuple object, each tuple object comprising an identification and a weight of a FOL, the list of MUS identifications identifying MUS that determine the root cause data.
9. 9. An electronic device comprising a memory, a processor, the memory storing a computer program executable by the processor, the computer program when executed by the processor implementing the method of anomaly detection of any one of claims 1 to 8.
10. 10. A computer readable medium having stored thereon a computer program which, when executed by a processor, implements the method of anomaly detection of any one of claims 1 to 8.

Description

Method for anomaly detection, electronic device, computer readable medium, computer program product Technical Field The present disclosure relates to the field of computer technology, and in particular, to a method, an electronic device, a computer readable medium, and a computer program product for anomaly detection. Background In recent years, large language models (Large Language Model, LLM) have seen significant progress in the ability to process natural language data (including text and images, etc.). When carrying out outlier analysis and reasoning on a large amount of natural language data, the large language model has the problems of poor accuracy and the like. Disclosure of Invention The present disclosure provides a method, an electronic device, a computer readable medium, a computer program product for anomaly detection. In a first aspect, an embodiment of the present disclosure provides a method for anomaly detection, including: Converting the original data to be detected into a first-order logic FOL set by adopting a large language model LLM; Extracting a Minimum Unsatisfiable Subset (MUS) of the FOL set by adopting a Satisfiability Modulo Theory (SMT) solver, wherein the MUS is used for indicating mutually conflicting FOLs; and carrying out conflict set analysis based on the MUS to obtain abnormal points of the original data. In a second aspect, the disclosed embodiments provide an electronic device, which includes a memory and a processor, where the memory stores a computer program executable by the processor, and where the computer program when executed by the processor implements any one of the methods of anomaly detection of the disclosed embodiments. In a third aspect, the disclosed embodiments provide a computer readable medium having stored thereon a computer program which, when executed by a processor, implements a method of any one of the disclosed embodiments. In a fourth aspect, the disclosed embodiments provide a computer program product comprising a computer program which, when executed by a processor, implements a method of any one of the disclosed embodiments. In the embodiment of the disclosure, first, LLM is adopted to convert original data to be detected into FOL set, then SMT solver is adopted to extract MUS of the FOL set, so that conflict set analysis is carried out based on MUS, and abnormal points of the original data are obtained. On one hand, the information extraction of FOL is performed by utilizing the natural language data understanding capability of LLM without deep reasoning of LLM, and on the other hand, the method of extracting MUS by using an SMT solver and analyzing conflict sets to determine abnormal points is adopted, and the process of extracting MUS by using the SMT solver is an accurate and transparent process, so that the accuracy of abnormality detection is improved. Drawings In the drawings of the embodiments of the present disclosure: FIG. 1 is a flow chart of a method of anomaly detection provided by an embodiment of the present disclosure; FIG. 2 is a block diagram of an electronic device provided in an embodiment of the present disclosure; FIG. 3 is a block diagram of one computer-readable medium provided by an embodiment of the present disclosure; FIG. 4 is a schematic diagram of an anomaly detection system according to an embodiment of the present disclosure; Fig. 5 is a schematic diagram of a master control system according to an embodiment of the disclosure; FIG. 6 is a schematic diagram of a knowledge base construction process according to an embodiment of the disclosure; fig. 7 is a schematic diagram of an outlier analysis flow provided in an embodiment of the disclosure; FIG. 8 is a schematic diagram of the interrelationship of data objects of a knowledge base and an inference conclusion base in an embodiment of the disclosure; FIG. 9 is a schematic diagram of another knowledge base construction process provided in an embodiment of the disclosure; FIG. 10 is a schematic diagram of another outlier analysis flow provided in an embodiment of the disclosure; FIG. 11 is an exemplary schematic diagram of a system hint word provided by embodiments of the present disclosure; FIG. 12 is a schematic diagram of a legal provision conflict detection system provided by embodiments of the present disclosure; FIG. 13 illustrates a relationship diagram of various relationship tables within a database provided by an embodiment of the present disclosure; FIG. 14 illustrates a reference SQL code schematic of database construction in an embodiment of the disclosure; FIG. 15 illustrates a sample example data schematic of input data in an embodiment of the present disclosure; FIG. 16 illustrates an exemplary schematic of a system hint word in an embodiment of the present disclosure. Detailed Description In order to better understand the technical solutions of the present disclosure, the following detailed description of the embodiments of the present disclosure i