Incremental track anomaly detection method based on incremental kernel principle component analysis

[0023] Example 1: First perform the initialization calculation of the model, and use the traditional Batch KPCA to perform the initial kernel feature space calculation. Whenever there are M new trajectory data coming, the M trajectory data are first standardized; then the Batch KPCA calculation is used The nuclear feature space of the newly added data. Calculate the average reconstruction error of the newly added data and the training data respectively. If the errors of the two are greater than the given threshold, perform the subsequent kernel feature space segmentation-merging method to update the kernel feature space; then project the updated kernel feature space , Extract the principal components; finally use a type of support vector machine for unsupervised learning and anomaly detection.

[0024] See figure 1 As shown, an incremental trajectory anomaly detection method based on incremental kernel principal component analysis includes the following steps:

[0025] (1) Initial trajectory data, trajectory standardization;

[0026] (2) Determine a fixed-size sliding data window, calculate the initial kernel feature space and reconstruction error;

[0027] (3) Calculate the average reconstruction error ratio between the newly added data and the sliding window. If the errors between the two are greater than the given threshold, execute the kernel feature space split-merge method to update the kernel feature space;

[0028] (4) Calculate the updated sliding window kernel feature space projection, and extract the principal components;

[0029] (5) Use a type of support vector machine for unsupervised learning and anomaly detection;

[0030] The specific method is as follows:

[0031] This incremental trajectory abnormality detection method based on incremental kernel principal component analysis first uses the Min-max method to standardize each trajectory, and sets the size P of the sliding window and the number of trajectories M updated each time. P represents the size of the kernel feature space that needs to be updated each time, and the size of the kernel feature space is fixed during the execution of the algorithm; M represents the size of each increment;

[0032] Then use the traditional Batch KPCA to calculate the initial kernel feature space model of the sliding data window and calculate its average reconstruction error An n-dimensional input vector t is mapped to an l-dimensional vector φ(t) through the kernel function; the reconstruction error ε is Is the squared distance between its projection in the kernel feature space, where Is the centralized mapping vector φ(t); afterwards, the newly added trajectory data vectors are processed in batches in a loop; when processing the newly added trajectory data vectors, the kernel feature space model is first constructed, and the average reconstruction error is calculated Average reconstruction error ratio ε ratio It is the ratio between the average reconstruction error of the newly added M trajectory data and the average reconstruction error of the training data set in the sliding data window. The specific calculation formula is

[0033] ϵ ‾ t r a i n i n g _ s e t = X i = 1 N ϵ ( i ) N , ϵ ‾ u p d a t e = X i = 1 M ϵ ( i ) M , ϵ r a t i o = ϵ ‾ u p d a t e ϵ ‾ t r a i n i n g _ s e t .

[0034] Then calculate the average reconstruction error ratio ε between it and the sliding window kernel feature space ratio When ε ratio When higher than the given threshold v, use the kernel feature space segmentation-merge algorithm to update the sliding window kernel feature space, first use the kernel feature space segmentation method to remove the earliest M trajectory data feature vectors from the sliding data window to reduce the kernel features Space, the kernel feature space segmentation method is the feature space segmentation method based on the original input space. The kernel feature space segmentation method suitable for incremental kernel principal component analysis is obtained by coring it; then the kernel feature space merging method is used to merge the new The M trajectory data vectors are merged into the sliding window kernel feature space. After the kernel feature space is merged, the kernel feature space is split from the sliding data window and the kernel feature space model composed of the remaining trajectories is obtained. Ω=(U ,Φ x ,α,Λ,N), the kernel feature space model formed by the newly added M trajectories is Θ=(V,Φ y ,β,Δ,M), merge Ω and Θ to get the updated kernel feature space model Q=(W,Φ z ,τ,∏,P).

[0035] Simultaneously calculate the feature space projection of the sliding window kernel, obtain the principal component and calculate its feature space projection;

[0036] Finally, a type of support vector machine is used to perform unsupervised learning and anomaly detection on the extracted principal components, traverse the trajectory set, for each trajectory sample in the data set, use the decision function to determine the abnormal trajectory, record the detected abnormal trajectory, and set the corresponding Trajectory label; after detection, the average reconstruction error of the sliding window kernel feature space needs to be recalculated In order to process the next new track data.

[0037] Embodiment 2: Comparison between the present invention and the incremental trajectory anomaly detection algorithm based on traditional KPCA (Batch KPCA);

[0038] In order to verify the effectiveness of the present invention, a total of 221 trajectories with 7,270 trajectory points between 1990 and 2006 in the Atlantic hurricane data were selected as the experimental data set for verification. From figure 2 It can be seen that the execution time of the incremental trajectory anomaly detection method based on the traditional KPCA is increasing rapidly with the increase of the sliding data window. The execution time of the incremental trajectory anomaly detection algorithm based on kernel feature space segmentation and merging will also increase with the increase of the sliding data window, but the amplitude is not large. And in the case of the same sliding data window size, the incremental trajectory anomaly detection algorithm based on kernel feature space segmentation and merging takes less calculation time than the incremental trajectory anomaly detection method based on traditional KPCA, and with the sliding data window The increase, this difference will become bigger and bigger.

[0039] Embodiment 3: The abnormality detection effect diagram of the present invention;

[0040] Select the detection results of the fourth iteration and the sixth iteration of the method of the present invention on the Atlantic hurricane data set, such as image 3 with Figure 4 Shown. The thicker line in the figure represents the detected abnormal trajectory, and the thinner line represents the normal trajectory. It can be seen from the figure that the anomaly detection effect is very good, and many trajectories with abnormal behavior have been detected. And from the results of the two iterations, it can be seen that with the continuous addition of new trajectories, some new abnormal trajectories are detected, and because the nuclear feature space is constantly updated, some previous abnormal trajectories are ignored.