Anomaly detection method and apparatus

An anomaly detection apparatus comprising a

• processor and a computer-readable storage medium in which instructions are stored, wherein the instructions, in response to being executed by the processor, implement the anomaly detection method comprising:
• detecting first feature data of collected first data using N anomaly detection algorithms to obtain first detection results corresponding, respectively, to the N anomaly detection algorithms, wherein N is an integer greater than or equal to I;
• in response to first detection results corresponding to one or more anomaly detection algorithms being abnormal, performing reliability verification on the first feature data of the collected first data to obtain first verification results;
• and
• determining second detection results according to the first verification results and according to whether reliability of the one or more anomaly detection algorithms is greater than or equal to a first preset threshold;
• wherein the method further comprises one or more of the following:
• in response to the second detection results being abnormal and anomaly cancellation information from a user having been received, annotating the collected first data as a normal sample and adding the collected first data to an annotated sample library;
• and
• in response to the second detection results being abnormal and anomaly confirmation information from the user having been received, annotating the collected first data as an abnormal sample and adding the collected first data to the annotated sample library;
• wherein, samples annotated as normal or abnormal in the annotated sample library are configured for training supervised learning models of the N anomaly detection algorithms, and the N anomaly detection algorithms are configured to detect the first feature data of the collected first data based on the supervised learning models to obtain the first detection results corresponding, respectively, to the N anomaly detection algorithms.

A non-transitory computer-readable storage medium on which a computer program is stored, wherein the computer program, in response to being executed by a processor, performs the operations of an anomaly detection method comprising:

• detecting first feature data of collected first data using N anomaly detection algorithms to obtain first detection results corresponding, respectively, to the N anomaly detection algorithms, wherein N is an integer greater than or equal to 1;
• in response to first detection results corresponding to one or more anomaly detection algorithms being abnormal, performing reliability verification on the first feature data of the collected first data to obtain first verification results;
• and
• determining second detection results according to the first verification results and according to whether reliability of the one or more anomaly detection algorithms is greater than or equal to a first preset threshold;
• wherein the method further comprises one or more of the following:
• in response to the second detection results being abnormal and anomaly cancellation information from a user having been received, annotating the collected first data as a normal sample and adding the collected first data to an annotated sample library;
• and
• in response to the second detection results being abnormal and anomaly confirmation information from the user having been received, annotating the collected first data as an abnormal sample and adding the collected first data to the annotated sample library;
• wherein, samples annotated as normal or abnormal in the annotated sample library are configured for training supervised learning models of the N anomaly detection algorithms, and the N anomaly detection algorithms are configured to detect the first feature data of the collected first data based on the supervised learning models to obtain the first detection results corresponding, respectively, to the N anomaly detection algorithms.