Specific embodiment
In order to make those skilled in the art more fully understand the technical solution in this specification one or more embodiment,Below in conjunction with the attached drawing in this specification one or more embodiment, to the technology in this specification one or more embodimentScheme is clearly and completely described, it is clear that described embodiment is only a part of the embodiment, rather than whole realitiesApply example.Based on this specification one or more embodiment, those of ordinary skill in the art are not making creative work premiseUnder every other embodiment obtained, shall fall within the protection scope of the present application.
Abnormality detection is also referred to as outlier detection, and outlier is the object for deviating considerably from other data points, outlierIt is not quite alike with most data, also only account for sub-fraction in whole data, abnormality detection need by these fromGroup's point is distinguished from data.For example, can be used for identifying abnormal transaction.
The explanation feature that at least one embodiment of this specification provides a kind of abnormality detection determines method, and this method can be withIt is released applied to unsupervised abnormality detection solution to model, and the interpretation scheme may not need and introduce additional interpretation model,And abnormality detection model itself will not be depended on.
The Partial Feature being related in this method description is illustrated as follows:
Sample: the sample can be for the input as abnormality detection model, and can correspond to an abnormality detectionThe model of model exports result.For example, A can be inputted abnormality detection model, and the B of model output is obtained, then A is instituteState sample.
Sample characteristics: a sample can have at least one sample characteristics, which exists for describing the sampleThe attribute properties of different aspect.For example, the sample can be user identifier be 1100 user, the sample include at least oneSample characteristics may include: age, address, length of service of the user etc..Wherein, the age is a sample characteristics, and address canTo be another sample characteristics.
Explain feature: in machine learning task, different models is suggested, to model to problem.In addition to modelDirectly export other than, we also need to be further understood from result, for example, actually which feature on model output influence mostIt greatly, is that factor determines output corresponding to it actually, this just needs to explain model accordingly.This specification is realApplying is indicated that the feature that result explains, the explanation can be exported to the model of abnormality detection model with " explaining feature " in exampleFeature can be used for explaining the association between the input sample of abnormality detection model and model output result.For example, by sample Y1Input abnormality detection model obtains model output result D1, and the explanation determined is characterized in t1 and t2, then, include in sample Y1Feature t1 and t2 to output D1 contribution margin it is higher, it may be possible to since the two sample characteristics t1 and t2 just cause to obtainD1.Explain that feature can be the Partial Feature by determining in above-mentioned sample characteristics, for example, sample characteristics may include F1, F2And F3, explain that feature can be F1 and F2 therein.
On the basis of features described above explanation, the explanation feature that this specification embodiment is described below determines method.
Shown in Figure 1, the process of abnormality detection includes " training " and " prediction " two processes.Wherein, in " training "Stage can go to train abnormality detection model by training set data.In " prediction " stage, so that it may will be in test set dataInput of some sample as the abnormality detection model, to predict whether the sample of the input is abnormal data.And this specificationWhat at least one embodiment provided releases in scheme abnormality detection solution to model, with above-mentioned training abnormality detection model and applicationIt is unrelated that the model, which carries out prediction, that is, the training prediction that solution to model is released with model is two independently operated parts.
Continuing with referring to Fig. 1, and as shown in connection with fig. 2, Fig. 2 describes a kind of determination side of the explanation feature of abnormality detectionMethod.Wherein, it is necessary first to which explanation, this method are explained, i.e. needle when explaining abnormality detection model using partial modelRespective explanations are provided to the prediction of the specific sample of a certain item.
As shown in Fig. 2, this method may include:
In step 200, it according to the training set data of abnormality detection model, obtains respectively each in the training set dataThe distribution parameter of sample characteristics.
In this step, which can be unsupervised model.
The training set data can be the data for training abnormality detection model, can be in the training set dataIt may include at least one sample characteristics in each sample including multiple samples.
Illustratively, which can be the user that user identifier is 1100, at least one sample for including in the sampleFeature may include: age, address, length of service, annual income of the user etc..
Each sample characteristics can obtain a corresponding distribution parameter, for example, sample characteristics " age " corresponding oneA distribution parameter S 1, the corresponding distribution parameter S 2 of sample characteristics " length of service ".
And the acquisition of the distribution parameter of each sample characteristics, it can be in each sample by the training set data respectivelyIdentical sample characteristics are obtained, which is properly termed as target sample feature, and then obtains including multiple targetsThe target signature collection of sample characteristics；And according to the target signature collection, the distribution parameter of the target sample feature is determined.
For example, may include multiple samples in training set data by taking sample characteristics " annual income " as an example, it is assumed that including markFor 1100 user, be identified as 1101 user and be identified as 1102 user.Include in the sample characteristics of each userIt is somebody's turn to do " annual income "." annual income " sample characteristics can be somebody's turn to do by obtaining respectively in each sample, this feature is properly termed as target sampleFeature.An available target signature collection, the target signature concentrate " annual income " including above three user.It then can be withAccording to the characteristic value of " annual income " that the target signature is concentrated, the corresponding distribution parameter of this feature " annual income " is determined.
Distribution parameter can be used to indicate that characteristic distributions of the sample characteristics in the training set data of abnormality detection model.ExampleSuch as, in abnormality detection, multivariate Gaussian models are a kind of classic algorithms, and data are assumed to be every dimensional feature distribution and meet normal state pointCloth has a famous 3-sigma principle under this hypothesis, is contained near the mean value in 3 variance regional scopes99.7% data, and other than this region can be considered as an abnormal point (outlier).Certainly there can also be 2-Sigma principle, 1-sigma principle etc..
The description above illustrates a kind of data distribution feature, the abnormal point of the abnormality detection identification of being detected, by dividingFrom the point of view of in cloth feature, usually deviate the point of most of data regions, and most of data regions are that haveCertain features, for example, near the mean value in the regional scope of 3 variances.
Based on above-mentioned, for example, the distribution parameter calculated in this step may include: the mean value and variance of sample characteristics.ExampleSuch as, mean value can be indicated with u, and variance can be indicated with s.
In step 202, for a sample of input abnormality detection model, the input sample includes at least one sampleEigen determines the drift rate of the sample characteristics according to the distribution parameter of each sample characteristics.
In this step, the sample is a sample in test set data, and test set data may include multiple samplesThis, each sample may include at least one sample characteristics.As previously described, this method is to the interpretation scheme of abnormality detectionIt explains, i.e., the abnormality detection of each specific sample is explained applied to partial model.
Input different for example, the abnormality detection model that sample Y1 input training is completed obtains model output result D1, sample Y2Normal detection model obtains model output result D2, and the model explanation of this method is applied to explain the pass between Y1 and D1 respectivelyConnection and the association between Y2 and D2.For example, which feature of Y1 is larger to the contribution for obtaining result D1, which feature of Y2It is larger to the contribution for obtaining D2.Therefore, step 202 and step 204, which can be, holds one of sample in test set dataRow.
Similar with training set data, each of test set data sample also may include multiple sample characteristics.ThisIn step, its corresponding drift rate is calculated to each sample characteristics, which can be one for measuring the sample characteristicsWhether the index of above-mentioned " most of data region " is in.
For example, drift rate can be calculated based on following principle: to every one-dimensional characteristic, it is inclined that each new samples can be calculatedWith a distance from several times from mean value on training set variances, the deviation the more, prove that data are more abnormal.So, using distribution parameter as mean value andFor variance, following formula (1) can be used as the calculation formula of drift rate:
N=(v-u)/s ... ... (1)
In above-mentioned formula (1), n is drift rate, which can provide a unified exception for different sample characteristicsMeasurement index.V is the actual characteristic value of a sample characteristics in the sample in sample；U is united based on training set dataCount the mean value of the obtained sample characteristics；S is the variance of the sample characteristics counted based on training set data.According to formula(1), determine that the actual value deviates the distance of several times of variances of the mean value, as the drift rate.
In step 204, according to the drift rate of each sample characteristics in the sample, at least one sample characteristics is determinedExplanation feature as this corresponding abnormality detection of the sample.
Wherein, the explanation feature is for explaining the sample inputted in this abnormality detection and model output resultBetween association.For example, sample Y1 input abnormality detection model is obtained model output result D1, and the explanation determined is characterized inT1 and t2, then, it include this feature t1 and t2 in sample Y1, also, the t1 and t2 is higher to the contribution margin of output D1, it may be possible toSince the two sample characteristics t1 and t2 just cause to have obtained model output result D1.It is, of course, also possible in the base for explaining featureThe reason of corresponding abnormality detection of this Y1 of further detailed analysis exports result D1 on plinth.
For example, explaining that the preparation method of feature may is that the inclined of each sample characteristics in the sample according to input modelEach sample characteristics are carried out descending arrangement by shifting degree, and at least one sample characteristics by sequence in preceding presetting digit capacity are madeFor the explanation feature.This method is to have chosen the higher sample characteristics of several drift rates as explanation feature.In specific implementation,It is not limited to this method, for example, it is also possible to set drift rate threshold value, drift rate is higher than the sample characteristics of the threshold value as explanationFeature.
Above-mentioned each step can be executed on the same device respectively, can also be executed on different devices.For example,Step 200 can be executed in an equipment, belong to the training stage, i.e. the training stage of abnormality detection model may include two portionsPoint, a part is the training of conventional abnormality detection model, and another part is to obtain distribution parameter according to training set data.And it walksRapid 202 and step 204 can be executed in another equipment (can also be with same equipment), belong to the forecast period of model, i.e., extremelyThe forecast period of detection model also includes two parts, a part be it is conventional carry out predicting whether exception using model, it is anotherPart is to be obtained explaining feature according to distribution parameter.In each stage, training stage or forecast period, model explanation scheme andThe training prediction scheme of model, can be independent operating.It is of course also possible to be calculate distribution parameter on one side trained while, orIt is calculated while predicting according to input sample and explains feature.
The determination method of the explanation feature of the abnormality detection of at least one embodiment of this specification, by according to distribution parameterAbnormal explanation feature is found, this is the data distribution feature of characteristic value based on sample characteristics itself, come feature of finding the explanation,Unrelated with model and independent of model, therefore, the not perfect such as sample imbalance of model relevant information does not interfere withIt explains the detection of feature, also, explains feature using distribution parameter identification, the abnormal point numerical distribution for meeting abnormality detection is specialPoint, the accuracy for explaining that feature obtains are higher.
Fig. 3 is a kind of explanation feature determining device for abnormality detection that this specification one or more embodiment provides, such asShown in Fig. 3, the apparatus may include: drift rate computing module 31 and characteristic determination module 32.
Drift rate computing module 31, for a sample for inputting abnormality detection model, the sample includes at leastOne sample characteristics, the drift rate of the sample characteristics is determined according to the distribution parameter of each sample characteristics；The distribution parameterFor indicating characteristic distributions of the sample characteristics in the training set data of the abnormality detection model；The abnormality detection modelIt is unsupervised model；
Characteristic determination module 32 determines at least one for the drift rate according to each sample characteristics in the sampleSample characteristics as the corresponding explanation feature of the sample, the explanation feature for explain the sample with it is corresponding described differentAssociation between the model output result of normal detection model.
Fig. 4 is the explanation feature determining device for another abnormality detection that this specification one or more embodiment provides,As shown in figure 4, can also include: distribution calculation module 33 on the basis of device structure shown in Fig. 3.
Distribution calculation module 33 is obtained for obtaining target sample feature respectively in each sample by training set dataTarget signature collection including multiple target sample features；According to the target signature collection, point of the target sample feature is determinedCloth parameter；The training set data includes multiple samples, and each sample includes at least one sample characteristics.
In another example, drift rate computing module 31, is specifically used for: for the test set of the abnormality detection modelOne of sample characteristics of sample described in data determine the actual value of the sample characteristics in the sample；Obtain instituteState mean value of the sample characteristics in training set data；Determine that the actual value deviates the distance of several times of variances of the mean value, asThe drift rate；The distribution parameter includes: the mean value and variance of the sample characteristics.
The explanation feature that at least one embodiment of this specification additionally provides a kind of abnormality detection determines equipment, the equipmentIncluding memory, processor and the computer program that can be run on a memory and on a processor is stored, the processor is heldIt is performed the steps of when row described program
For inputting a sample of abnormality detection model, the sample includes at least one sample characteristics, according to eachThe distribution parameter of sample characteristics determines the drift rate of the sample characteristics；The distribution parameter is for indicating the sample characteristics in instituteState the characteristic distributions in the training set data of abnormality detection model；The abnormality detection model is unsupervised model；
According to the drift rate of each sample characteristics in the sample, determine at least one sample characteristics as the sampleCorresponding explanation feature, it is described to explain that feature is used to explain that the sample to be exported with the model of the corresponding abnormality detection modelAs a result the association between.
Each step in process shown in above method embodiment, execution sequence are not limited to suitable in flow chartSequence.In addition, the description of each step, can be implemented as software, hardware or its form combined, for example, those skilled in the artMember can implement these as the form of software code, can be can be realized the computer of the corresponding logic function of the step canIt executes instruction.When it is realized in the form of software, the executable instruction be can store in memory, and by equipmentProcessor execute.
The device or module that above-described embodiment illustrates can specifically realize by computer chip or entity, or by havingThe product of certain function is realized.A kind of typically to realize that equipment is computer, the concrete form of computer can be personal meterCalculation machine, laptop computer, cellular phone, camera phone, smart phone, personal digital assistant, media player, navigation are setIt is any several in standby, E-mail receiver/send equipment, game console, tablet computer, wearable device or these equipmentThe combination of equipment.
For convenience of description, it is divided into various modules when description apparatus above with function to describe respectively.Certainly, implementing thisThe function of each module can be realized in the same or multiple software and or hardware when specification one or more embodiment.
It should be understood by those skilled in the art that, this specification one or more embodiment can provide for method, system orComputer program product.Therefore, complete hardware embodiment can be used in this specification one or more embodiment, complete software is implementedThe form of example or embodiment combining software and hardware aspects.Moreover, this specification one or more embodiment can be used oneIt is a or it is multiple wherein include computer usable program code computer-usable storage medium (including but not limited to disk storageDevice, CD-ROM, optical memory etc.) on the form of computer program product implemented.
These computer program instructions, which may also be stored in, is able to guide computer or other programmable data processing devices with spyDetermine in the computer-readable memory that mode works, so that it includes referring to that instruction stored in the computer readable memory, which generates,Enable the manufacture of device, the command device realize in one box of one or more flows of the flowchart and/or block diagram orThe function of being specified in multiple boxes.
These computer program instructions also can be loaded onto a computer or other programmable data processing device, so that countingSeries of operation steps are executed on calculation machine or other programmable devices to generate computer implemented processing, thus in computer orThe instruction executed on other programmable devices is provided for realizing in one or more flows of the flowchart and/or block diagram oneThe step of function of being specified in a box or multiple boxes.
It should also be noted that, the terms "include", "comprise" or its any other variant are intended to nonexcludabilityIt include so that the process, method, commodity or the equipment that include a series of elements not only include those elements, but also to wrapInclude other elements that are not explicitly listed, or further include for this process, method, commodity or equipment intrinsic wantElement.In the absence of more restrictions, the element limited by sentence "including a ...", it is not excluded that including described wantThere is also other identical elements in the process, method of element, commodity or equipment.
This specification one or more embodiment can computer executable instructions it is general onIt hereinafter describes, such as program module.Generally, program module includes executing particular task or realization particular abstract data typeRoutine, programs, objects, component, data structure etc..Can also practice in a distributed computing environment this specification one orMultiple embodiments, in these distributed computing environments, by being executed by the connected remote processing devices of communication networkTask.In a distributed computing environment, the local and remote computer that program module can be located at including storage equipment is depositedIn storage media.
All the embodiments in this specification are described in a progressive manner, same and similar portion between each embodimentDividing may refer to each other, and each embodiment focuses on the differences from other embodiments.It is adopted especially for dataFor collecting equipment or data processing equipment embodiment, since it is substantially similar to the method embodiment, so the comparison of description is simpleSingle, the relevent part can refer to the partial explaination of embodiments of method.
It is above-mentioned that this specification specific embodiment is described.Other embodiments are in the scope of the appended claimsIt is interior.In some cases, the movement recorded in detail in the claims or step can be come according to the sequence being different from embodimentIt executes and desired result still may be implemented.In addition, process depicted in the drawing not necessarily require show it is specific suitableSequence or consecutive order are just able to achieve desired result.In some embodiments, multitasking and parallel processing be also canWith or may be advantageous.
The foregoing is merely the preferred embodiments of this specification one or more embodiment, not to limit this public affairsIt opens, all within the spirit and principle of the disclosure, any modification, equivalent substitution, improvement and etc. done should be included in the disclosureWithin the scope of protection.