Incremental isolation forest-based gas turbine anomaly detection method

Abstract

The present application relates to the field of gas turbine detection, and particularly relates to a gas turbine anomaly detection method based on incremental isolated forest, which comprises the following steps: arranging high-dimensional feature vectors corresponding to all feature windows in time sequence to form a high-dimensional feature vector sequence; pruning the isolated trees with completed weight distribution through information gain ratio; combining all the pruned and optimized isolated trees to form an isolated forest model; and calculating real-time anomaly scores for each high-dimensional feature vector input in real time. The present application introduces a sample weight distribution mechanism based on time decay, so that more recent samples obtain higher weights in model training, can dynamically track the slow drift of the normal operation state of the gas turbine, and calculates the information gain ratio of the leaf nodes of the isolated trees layer by layer upwards, reduces the calculation complexity and storage overhead of the model, screens out high-confidence normal samples in combination with the normal distribution principle, and avoids the huge calculation amount of complete retraining.

Description

Technical Field

[0001] This invention relates to the field of gas turbine testing, and more specifically to a gas turbine anomaly detection method based on incremental isolated forests. Background Technology

[0002] Gas turbines, as efficient and clean power plants, are widely used in key fields such as power generation, aerospace, marine propulsion, and industrial drives. Their safe and stable operation is directly related to the continuity of industrial production and the reliability of energy systems. During operation, gas turbines operate under extreme conditions of high temperature, high pressure, and high speed. Their components are subjected to alternating loads and thermal stresses over long periods, making them prone to progressive damage such as wear, corrosion, and fatigue. Failure to detect early anomalies and take timely intervention measures can lead to serious equipment failures, causing significant economic losses and safety hazards. Therefore, achieving real-time and accurate anomaly detection in gas turbine operation is of great engineering significance for ensuring equipment safety, reducing operation and maintenance costs, and extending equipment lifespan.

[0003] Currently, gas turbine anomaly detection technologies are mainly divided into three categories: mechanistic model-based methods, signal processing-based methods, and data-driven methods. Mechanism model-based methods identify anomalies by establishing physical and mathematical models of various gas turbine systems and comparing actual operating data with model predictions. However, the modeling process is complex, highly dependent on the experience of domain experts, and struggles to cover the complex operating conditions and all possible fault modes of gas turbines. Furthermore, they are poorly adaptable to nonlinear and strongly coupled system characteristics. Signal processing-based methods extract fault features through time-domain, frequency-domain, or time-frequency-domain analysis of monitoring signals such as vibration, temperature, and pressure. However, they have low sensitivity to early, subtle faults, require manual feature design, and the effectiveness of feature extraction depends heavily on the experience of technicians, making automated and intelligent detection difficult to achieve. Summary of the Invention

[0004] This invention addresses the technical problems existing in the prior art by providing a gas turbine anomaly detection method based on incremental isolated forests.

[0005] The technical solution of this invention to solve the above-mentioned technical problems is as follows: A gas turbine anomaly detection method based on incremental isolated forest, comprising the following steps: S1. Based on the gas turbine operating data after data cleaning, a sliding window is used to segment the data to obtain discrete and processable feature windows. The time-domain features and complexity features are calculated in each feature window. All features of all parameters calculated in each feature window are combined in a fixed order to form a high-dimensional feature vector. The high-dimensional feature vectors corresponding to all feature windows are arranged in time order to form a high-dimensional feature vector sequence. S2. Based on the time difference between the generation timestamp and the training timestamp corresponding to each high-dimensional feature vector, weights are assigned, and the weight values ​​are associated with the high-dimensional feature vectors as samples to form a weighted sample set. Subsample sets are extracted based on the weighted sample set, and weighted isolated trees are generated from the subsample sets. Each isolated tree is recursively split to form leaf nodes. The isolated trees with completed weight assignments are pruned according to the information gain ratio. All the pruned and optimized isolated trees are combined into an isolated forest model. S3. Based on the isolated forest model, calculate the anomaly score for each feature vector in the high-dimensional feature vector sequence corresponding to the current running data. Determine the high-confidence normal data set based on the arithmetic mean and arithmetic standard deviation of the anomaly scores of all samples. Then, evaluate the performance of each isolated tree in the current isolated forest model based on the high-confidence normal data set. After the isolated forest model is updated, calculate the real-time anomaly score for each high-dimensional feature vector input in real time and make anomaly judgment.

[0006] In a preferred embodiment, step S1 processes the cleaned gas turbine operating data using a sliding window segmentation method, specifically: the continuous time series gas turbine operating data is segmented into multiple overlapping feature windows with a fixed window length and a fixed step size; based on the first data point of the time series, a continuous data segment with a length equal to the window length is selected as the first feature window; the second feature window is selected by moving one time step backward from the starting position of the first feature window, until the entire time series of the gas turbine operating data is covered; S1 calculates the temporal and complexity features, including mean, variance, kurtosis, skewness, peak factor, and approximate entropy, within each feature window. It then combines all the temporal and complexity features of all parameters calculated within each feature window in a fixed order to form a high-dimensional feature vector. Finally, it arranges the high-dimensional feature vectors corresponding to all feature windows in chronological order to form a high-dimensional feature vector sequence. The purpose of this operation is to integrate the scattered feature values ​​into a unified input format.

[0007] In a preferred embodiment, S2 obtains the time difference between the timestamp corresponding to each high-dimensional feature vector and the current training timestamp based on the timestamp corresponding to each high-dimensional feature vector and the training timestamp when it is input into the isolated forest model for training. The unit of the time difference is consistent with the time unit of data acquisition. Based on the total time span of historical normal operation data, the total time span is divided into several equal time intervals. The Euclidean distance between the average high-dimensional feature vector of historical normal operation data and the average high-dimensional feature vector of gas turbine operation data within each time interval is calculated. After normalization, the distance weight of each time interval is obtained. Based on the distance weight, the attenuation coefficient is obtained through linear fitting. The attenuation coefficient represents the attenuation caused by the slow degradation of equipment performance over the time span. This attenuation is reflected in the feature imbalance and fluctuation of the high-dimensional feature vector. The attenuation coefficient is used as the base, and a power operation is performed with the time difference as the exponent. The value obtained by the power operation is used as the weight value of the corresponding high-dimensional feature vector. Through this calculation process, the weight value is negatively correlated with the time difference, that is, the more recent sample is assigned a higher weight, and the earlier sample is assigned a lower weight. The calculated weight value is associated one-to-one with the corresponding high-dimensional feature vector to form a weighted sample set. The sample refers to a single high-dimensional feature vector in the high-dimensional feature vector sequence output by S1. In this way, the timeliness characteristics of time series data are reflected, making the model pay more attention to the recent normal operation status, while retaining the reference value of historical data.

[0008] In a preferred embodiment, S2 randomly selects a subset of samples with the same number of samples from a weighted sample set. During the selection process, the probability of each sample being selected is proportional to its weight value, that is, the higher the weight of the sample, the greater the probability of it being selected. After each subset of samples is used to generate an isolated tree, the ratio of the sum of the weight values ​​of all samples in the weighted sample set to the total number of isolated trees is used as the average weighted sample number of each isolated tree. The minimum sample number threshold is set to one percent of the average weighted sample number. Then, the maximum tree depth threshold is obtained by rounding up the base-2 logarithm of the sample number of each subset of samples. For each node of each isolated tree, recursively segment it as follows: randomly select a feature dimension from all high-dimensional feature vectors as the segmentation feature of the current node, and randomly select a number as the segmentation value of the current node based on the range of all sample values ​​of the selected feature dimension. Divide all samples of the current node according to the relationship between the value of the segmentation feature and the segmentation value. Samples with values ​​less than the segmentation value are assigned to the left child node, and samples with values ​​greater than or equal to the segmentation value are assigned to the right child node, thus obtaining left and right child nodes. The sum of the weight values ​​of all samples in the left and right child nodes is used as the weighted sample count of each child node. Repeat the recursive segmentation until the weighted sample count of each child node is less than the small sample count threshold and / or the depth of all nodes is greater than or equal to the maximum tree depth threshold. Then, designate the current node as a leaf node and stop the recursive segmentation.

[0009] In a preferred embodiment, S2 begins with the leaf nodes at the bottom of each isolated tree and performs post-pruning operations layer by layer upwards, specifically as follows: Based on the proportion of the weight value of each sample in each leaf node of each generated isolated tree to the total number of weighted samples, the weighted entropy before the leaf node split is obtained by multiplying the obtained proportion by the logarithm of the proportion to the base 2, summing all the results and taking the negative number. Then, based on the weighted entropy of the left and right child nodes of the corresponding leaf node, the weighted entropy of the left child node is multiplied by the proportion of the number of weighted samples of the left child node to the total number of weighted samples of the corresponding leaf node, and the weighted entropy of the right child node is multiplied by the proportion of the number of weighted samples of the right child node to the total number of weighted samples of the corresponding leaf node. The two products are summed to obtain the weighted entropy after the leaf node split. Based on the difference between the weighted entropy before the split and the weighted entropy after the split, the information gain of the corresponding leaf node split is obtained. Based on the logarithm of the ratio of the weighted sample number of the left child node to the total weighted sample number of the leaf node, and the logarithm of the ratio of the weighted sample number of the right child node to the total weighted sample number of the leaf node, the two results are multiplied by the corresponding ratio, added together and the opposite number is taken to obtain the split information. The information gain is then divided by the split information to obtain the information gain ratio of the corresponding leaf node.

[0010] In a preferred embodiment, S2 obtains the information gain ratio of all leaf nodes by repeated calculation, sorts the information gain ratio of each leaf node of each isolated tree in ascending order, and uses the information gain ratio in the middle position as the pruning threshold. When the information gain ratio of a leaf node is less than the pruning threshold, the two child nodes of the corresponding leaf node are merged so that the weighted sample count of the leaf node is the sum of the weighted sample counts of the two child nodes. If the information gain ratio is still less than the threshold after merging, the leaf node is pruned. The pruning is repeated until the information gain ratio of all leaf nodes is greater than or equal to the pruning threshold and / or the root node is reached. Based on the above operations, this application removes redundant branches in isolated trees that contribute little to anomaly detection, simplifies the tree structure, reduces computational complexity, and improves the generalization ability of the model while reducing the risk of overfitting.

[0011] In a preferred embodiment, step S2 combines all pruned and optimized isolated trees into an isolated forest model. The isolated forest model calculates the average maximum possible path length based on the number of samples in each subset. Specifically, the average maximum possible path length is obtained by adding the natural logarithm of twice the number of samples to Euler's constant, subtracting twice the number of samples minus one from the number of samples, and taking the arithmetic mean of the average maximum possible path lengths of all subsets. The isolated forest model then takes the input high-dimensional feature vector and calculates the number of nodes the high-dimensional feature vector passes through from the root node to the leaf node in each isolated tree as the path length. Then, it calculates the average path length of all isolated trees as the average path length, and converts the average path length into anomaly scores in the range [0, 1] by normalizing the average path length and the average maximum possible path length.

[0012] In a preferred embodiment, S3 calculates the anomaly score for each feature vector in the high-dimensional feature vector sequence corresponding to the current running data based on the isolated forest model, and obtains the arithmetic mean and arithmetic standard deviation of all high-dimensional feature vectors. Based on the principle of normal distribution, high-dimensional feature vectors with outlier scores less than the arithmetic mean minus three times the arithmetic standard deviation are identified as high-confidence normal samples. All high-confidence normal samples are collected to form a high-confidence normal sample set, thus ensuring that the samples used for model updates are reliable normal data and avoiding outlier samples from contaminating the model. Each high-dimensional feature vector in the set of high-confidence normal samples is input into the isolation tree model. The average path length of each high-dimensional feature vector in the isolation tree is calculated. The variance of the average path length of all high-dimensional feature vectors is used as the performance evaluation value of the corresponding isolation tree. All isolation trees are sorted in ascending order of performance evaluation value. The smaller the performance evaluation value, the stronger the tree's ability to distinguish normal data. General isolation trees are retained to form a set of retained trees, thereby retaining the part of the model that describes the distribution of normal data more accurately and avoiding knowledge loss caused by complete retraining. A second subset of samples, equal to the number of trees to be retained, is randomly selected from the set of normal samples with high confidence. Each subset is used to generate a new isolated tree. Based on the weight allocation of S2 and structural pruning, a new set of trees is formed. The set of retained trees and the new set of trees are merged to form the updated isolated forest model.

[0013] In a preferred embodiment, step S3 calculates anomaly scores for each high-dimensional feature vector input in real time using the updated isolated forest model, and stores the obtained anomaly scores in chronological order to form a real-time anomaly score sequence. Based on the historical anomaly score sequence of historical normal operation data, exponentially weighted moving averages are calculated on the historical anomaly score sequence using different smoothing coefficients, and the prediction error corresponding to each smoothing coefficient is calculated. It should be noted that the prediction error is the sum of squares of the differences between the predicted value and the actual value. The smoothing coefficient with the smallest prediction error is selected as the final smoothing coefficient. Based on the determined final smoothing coefficient, the exponentially weighted moving standard deviation is calculated for the anomaly scores in the anomaly score sequence at each time point. Specifically, the square of the difference between the anomaly score at each time point and the corresponding exponentially weighted moving average at the time point is calculated, and all squared value sequences are subjected to exponentially weighted moving averages to obtain the exponentially weighted moving variance. The exponentially weighted moving variance is then subjected to arithmetic square root operation to obtain the exponentially weighted moving standard deviation. The upper limit and lower limit of dynamic control are obtained by combining the exponentially weighted moving average and exponentially weighted moving standard deviation at the current time point with a preset multiple. When a new real-time anomaly score is input, that is, the anomaly score obtained from the real-time input high-dimensional feature vector, the exponentially weighted moving average and exponentially weighted moving standard deviation are updated, thereby completing the update of the new dynamic control upper limit and dynamic control lower limit, generating a dynamic threshold that can adapt to changes in the gas turbine operating state, and avoiding false alarms and missed alarms caused by fixed thresholds.

[0014] In a preferred embodiment, S3 compares each newly calculated real-time anomaly score with the latest dynamic control upper limit. If a real-time anomaly score exceeds the dynamic control upper limit, the value of the continuous anomaly counter used for timing is incremented by one. If a real-time anomaly score does not exceed the dynamic control upper limit, the value of the continuous anomaly counter used for timing is reset to zero. When the value of the continuous anomaly counter increases twice consecutively, an anomaly alarm is triggered. The start and end times of the anomaly time window are obtained. The start time is the time when the alarm is triggered minus a determined forward time length, and the end time is the time when the alarm is triggered plus a determined backward time length. The process of determining the forward and backward time lengths is as follows: based on the relationship between the time when the anomaly features appear and the time when the fault occurs, the forward time length is set to the length that can cover the earliest time when all anomaly features appear, and the backward time length is set to the length that can cover the anomaly features within a certain period after the fault occurs. The anomaly time period determined based on the start and end times is fed back to the terminal.

[0015] The beneficial effects of this invention are as follows: It introduces a time decay-based sample weight allocation mechanism, calculates the time difference between the sample timestamp and the training timestamp, and generates time decay weights based on the equipment performance degradation law. This allows more recent samples to receive higher weights during model training, while retaining the reference value of historical data. This enables the model to dynamically track the slow drift of the gas turbine's normal operating state. Furthermore, it calculates the information gain ratio layer by layer upwards from the leaf nodes of the isolated tree, uses the median as the pruning threshold to merge redundant branches, removes invalid structures that contribute little to anomaly detection, and reduces the computational complexity and storage overhead of the model. It also selects high-confidence normal samples based on the principle of normal distribution, uses these as a benchmark to evaluate the performance of existing isolated trees, retains high-quality old trees with strong discriminative ability, and generates an equal number of new trees to supplement the latest state information, avoiding the huge computational burden of complete retraining. Attached Figure Description

[0016] Figure 1 This is a flowchart of the present invention. Detailed Implementation

[0017] The present invention will now be further described with reference to the accompanying drawings.

[0018] Please refer to the appendix. Figure 1 This embodiment provides a gas turbine anomaly detection method based on incremental isolated forests, comprising the following steps: S1. Based on the gas turbine operating data after data cleaning, a sliding window is used to segment the data to obtain discrete and processable feature windows. The time-domain features and complexity features are calculated in each feature window. All features of all parameters calculated in each feature window are combined in a fixed order to form a high-dimensional feature vector. The high-dimensional feature vectors corresponding to all feature windows are arranged in time order to form a high-dimensional feature vector sequence. S1 processes the cleaned gas turbine operating data using a sliding window segmentation method. Specifically, the continuous time series gas turbine operating data is segmented into multiple overlapping feature windows with a fixed window length and a fixed step size. Based on the first data point of the time series, a continuous data segment with a length equal to the window length is selected as the first feature window. The second feature window is selected by moving one time step backward from the starting position of the first feature window until the entire time series of gas turbine operating data is covered. S1 calculates the temporal and complexity features, including mean, variance, kurtosis, skewness, peak factor, and approximate entropy, within each feature window. It then combines all the temporal and complexity features of all parameters calculated within each feature window in a fixed order to form a high-dimensional feature vector. Finally, it arranges the high-dimensional feature vectors corresponding to all feature windows in chronological order to form a high-dimensional feature vector sequence. The purpose of this operation is to integrate the scattered feature values ​​into a unified input format.

[0019] The gas turbine operating data after data cleaning generally includes key parameters such as the intake system, combustion system, lubrication system, compressor status, and unit vibration. Furthermore, in calculating the mean, this application employs the following method: summing the values ​​of all data points within the window and then dividing by the total number of data points within the window to obtain the mean of the parameter within that window. In calculating the variance, this application first calculates the difference between each data point within the window and the mean, squares each difference, sums all the squared results, and then divides by the total number of data points within the window to obtain the variance of the parameter within that window. In calculating the kurtosis, this application first calculates the difference between each data point within the window and the mean, cubes each difference, sums all the cubed results, and then divides by the product of the total number of data points within the window and the cube of the variance to obtain the skewness of the parameter within that window. In calculating the kurtosis factor, this application first finds the maximum absolute value of the data points within the window and then divides it by the root mean square value of the data points within the window to obtain the kurtosis factor of the parameter within that window. In the calculation of approximate entropy, the data points within the window are first sorted according to their numerical values. Then, the sorted data is divided into several equally wide intervals, and the number of data points in each interval is counted. Next, the frequency of continuous data segments of different lengths appearing in each interval is calculated, and then the logarithmic average of these frequencies is calculated. Finally, the approximate entropy is obtained by the difference between the logarithmic averages of continuous data segments of different lengths.

[0020] S2. Based on the time difference between the generation timestamp and the training timestamp corresponding to each high-dimensional feature vector, weights are assigned, and the weight values ​​are associated with the high-dimensional feature vectors as samples to form a weighted sample set. Subsample sets are extracted based on the weighted sample set, and weighted isolated trees are generated from the subsample sets. Each isolated tree is recursively split to form leaf nodes. The isolated trees with completed weight assignments are pruned according to the information gain ratio. All the pruned and optimized isolated trees are combined into an isolated forest model. S2 obtains the time difference between the timestamp corresponding to each high-dimensional feature vector and the current training timestamp when it is input into the isolated forest model, based on the timestamp corresponding to each high-dimensional feature vector and the training timestamp. The unit of the time difference is consistent with the time unit of data acquisition. Based on the total time span of historical normal operation data, the total time span is divided into several equal time intervals. The Euclidean distance between the average high-dimensional feature vector of historical normal operation data and the average high-dimensional feature vector of gas turbine operation data within each time interval is calculated. After normalization, the distance weight for each time interval is obtained. Based on the distance weight, a decay coefficient is obtained through linear fitting. The decay coefficient represents the attenuation caused by the slow degradation of equipment performance over the time span. This attenuation is reflected in the feature imbalance and fluctuation of the high-dimensional feature vector. The decay coefficient is used as the base, and time is used as the modulus. The difference is raised to a power, and the result is used as the weight value of the corresponding high-dimensional feature vector. Through this calculation process, the weight value is negatively correlated with the time difference, that is, the more recent sample is assigned a higher weight, and the earlier sample is assigned a lower weight. The calculated weight value is associated one-to-one with the corresponding high-dimensional feature vector to form a weighted sample set. A sample refers to a single high-dimensional feature vector in the high-dimensional feature vector sequence output by S1. Thus, this application reflects the timeliness characteristics of time series data, making the model pay more attention to the recent normal operation status, while retaining the reference value of historical data.

[0021] S2 randomly selects a subset of samples with the same number of samples from a weighted sample set. During the selection process, the probability of each sample being selected is proportional to its weight value, that is, the higher the weight of the sample, the greater the probability of it being selected. After each subset of samples is used to generate an isolated tree, the ratio of the sum of the weight values ​​of all samples in the weighted sample set to the total number of isolated trees is used as the average weighted sample number of each isolated tree. The minimum sample number threshold is set to one percent of the average weighted sample number. Then, the maximum tree depth threshold is obtained by rounding up the base-2 logarithm of the sample number of each subset of samples. It should be noted that the maximum tree depth threshold ensures that the isolated tree has enough depth to distinguish between normal and abnormal samples, while avoiding overfitting. The minimum number of samples threshold ensures that the leaf nodes have enough samples to reflect the distribution characteristics of normal data, while avoiding an overly complex tree structure. For each node of each isolated tree, recursively segment it as follows: randomly select a feature dimension from all high-dimensional feature vectors as the segmentation feature of the current node, and randomly select a number as the segmentation value of the current node based on the range of all sample values ​​of the selected feature dimension. Divide all samples of the current node according to the relationship between the value of the segmentation feature and the segmentation value. Samples with values ​​less than the segmentation value are assigned to the left child node, and samples with values ​​greater than or equal to the segmentation value are assigned to the right child node. Obtain the left and right child nodes. The sum of the weight values ​​of all samples in the left and right child nodes is used as the weighted sample number of each child node. Repeat the recursive segmentation until the weighted sample number of each child node is less than the small sample number threshold and / or the depth of all nodes is greater than or equal to the maximum tree depth threshold. Then, designate the current node as a leaf node and stop the recursive segmentation. Therefore, this application incorporates a time decay mechanism into the generation process of isolated trees, enabling the tree structure to better reflect the recent normal data distribution.

[0022] S2 starts from the leaf node at the bottom level of each isolated tree and performs post-pruning operations layer by layer upwards, specifically: Based on the proportion of the weight value of each sample in each leaf node of each generated isolated tree to the total number of weighted samples, the weighted entropy before the leaf node split is obtained by multiplying the obtained proportion by the logarithm of the proportion to the base 2, summing all the results and taking the negative number. Then, based on the weighted entropy of the left and right child nodes of the corresponding leaf node, the weighted entropy of the left child node is multiplied by the proportion of the number of weighted samples of the left child node to the total number of weighted samples of the corresponding leaf node, and the weighted entropy of the right child node is multiplied by the proportion of the number of weighted samples of the right child node to the total number of weighted samples of the corresponding leaf node. The two products are summed to obtain the weighted entropy after the leaf node split. Based on the difference between the weighted entropy before the split and the weighted entropy after the split, the information gain of the corresponding leaf node split is obtained. Based on the logarithm of the ratio of the weighted sample number of the left child node to the total weighted sample number of the leaf node, and the logarithm of the ratio of the weighted sample number of the right child node to the total weighted sample number of the leaf node, the two results are multiplied by the corresponding ratio, added together and the opposite number is taken to obtain the split information. The information gain is then divided by the split information to obtain the information gain ratio of the corresponding leaf node.

[0023] S2 obtains the information gain ratio of all leaf nodes by repeated calculation, sorts the information gain ratio of each leaf node of each isolated tree in ascending order, and uses the information gain ratio in the middle position as the pruning threshold. That is, 50% is used as the threshold in this application. However, in the specific implementation process, if it is still necessary to consider the influence of features with slightly weaker weight ratios, then the 50% threshold is used for adjustment, which will not be elaborated further. When the information gain ratio of a leaf node is less than the pruning threshold, the two child nodes of the corresponding leaf node are merged so that the weighted sample count of the leaf node is the sum of the weighted sample counts of the two child nodes. If the information gain ratio is still less than the threshold after merging, the leaf node is pruned. The pruning is repeated until the information gain ratio of all leaf nodes is greater than or equal to the pruning threshold and / or the root node is reached. Based on the above operations, this application removes redundant branches in isolated trees that contribute little to anomaly detection, simplifies the tree structure, reduces computational complexity, and improves the generalization ability of the model while reducing the risk of overfitting.

[0024] S2 combines all pruned and optimized isolated trees into an isolated forest model. The isolated forest model calculates the average maximum possible path length based on the number of samples in each subset. Specifically, it adds the natural logarithm of twice the number of samples to Euler's constant, subtracts twice the number of samples minus one from the number of samples, and uses this as the average maximum possible path length. The arithmetic mean of the average maximum possible path lengths of all subsets is then used to obtain the average maximum possible path length of the isolated forest. The isolated forest model then takes the input high-dimensional feature vector and calculates the number of nodes traversed by the high-dimensional feature vector from the root node to the leaf node in each isolated tree as the path length. Then, it calculates the average path length of all isolated trees as the average path length. The average path length is then converted into an anomaly score in the range [0, 1] by a normalization formula and the average maximum possible path length. The specific calculation process of the normalization formula is to divide the average path length by the aforementioned determined average maximum possible path length of the isolated forest, and then subtract the ratio from 1 to obtain the anomaly score. The higher the anomaly score, the more likely the sample is to be an anomaly. The purpose of this operation is to establish a unified anomaly scoring standard.

[0025] S3. Based on the isolated forest model, calculate the anomaly score for each feature vector in the high-dimensional feature vector sequence corresponding to the current running data. Determine the high-confidence normal data set based on the arithmetic mean and arithmetic standard deviation of the anomaly scores of all samples. Then, evaluate the performance of each isolated tree in the current isolated forest model based on the high-confidence normal data set. After the isolated forest model is updated, calculate the real-time anomaly score for each high-dimensional feature vector input in real time and make anomaly judgment.

[0026] S3 calculates the anomaly score for each feature vector in the high-dimensional feature vector sequence corresponding to the current running data based on the isolated forest model, and obtains the arithmetic mean and arithmetic standard deviation of all high-dimensional feature vectors; Based on the principle of normal distribution, high-dimensional feature vectors with outlier scores less than the arithmetic mean minus three times the arithmetic standard deviation are identified as high-confidence normal samples. All high-confidence normal samples are collected to form a high-confidence normal sample set, thus ensuring that the samples used for model updates are reliable normal data and avoiding outlier samples from contaminating the model. Each high-dimensional feature vector in the set of high-confidence normal samples is input into the isolation tree model. The average path length of each high-dimensional feature vector in the isolation tree is calculated. The variance of the average path length of all high-dimensional feature vectors is used as the performance evaluation value of the corresponding isolation tree. All isolation trees are sorted in ascending order of performance evaluation value. The smaller the performance evaluation value, the stronger the tree's ability to distinguish normal data. General isolation trees are retained to form a set of retained trees, thereby retaining the part of the model that describes the distribution of normal data more accurately and avoiding knowledge loss caused by complete retraining. A second subset of samples, equal to the number of retained trees, is randomly selected from the high-confidence normal sample set. Each subset is used to generate a new isolated tree. Based on S2 weight allocation and structural pruning, a new tree set is formed. The retained tree set and the new tree set are merged to form the updated isolated forest model. The total number of isolated trees in the new model remains the same as before the update. The time decay-based sample weight allocation method, the weighted isolated tree generation method, and the information gain ratio-based pruning method are exactly the same as in step two, enabling the newly generated trees to reflect the latest equipment operating status and adapt to the slow degradation of equipment performance.

[0027] S3 processes each high-dimensional feature vector input in real time through the updated Isolation Forest model to calculate anomaly scores, and stores the resulting anomaly scores in chronological order to form a real-time anomaly score sequence. Based on the historical anomaly score sequence of historical normal operation data, it performs exponentially weighted moving average calculation on the historical anomaly score sequence using different smoothing coefficients, and calculates the prediction error corresponding to each smoothing coefficient. It should be noted that the prediction error is the sum of squares of the differences between the predicted value and the actual value. The smoothing coefficient with the smallest prediction error is selected as the final smoothing coefficient. Based on the determined final smoothing coefficient, the exponentially weighted moving standard deviation is calculated for the anomaly scores in the anomaly score sequence at each time point. Specifically, the square of the difference between the anomaly score at each time point and the corresponding exponentially weighted moving average at that time point is calculated, and all squared value sequences are processed by exponentially weighted moving average to obtain the exponentially weighted moving variance. The exponentially weighted moving variance is then subjected to arithmetic square root operation to obtain the exponentially weighted moving standard deviation. Based on the exponentially weighted moving average and exponentially weighted moving standard deviation at the current time point, and combined with a preset multiple, the upper and lower limits of dynamic control are obtained. The upper limit of dynamic control equals the exponentially weighted moving average plus the exponentially weighted moving standard deviation of the preset multiple, and the lower limit of dynamic control equals the exponentially weighted moving average minus the exponentially weighted moving standard deviation of the preset multiple. Furthermore, the process of determining the preset multiple involves collecting historical data including normal operating conditions and known abnormal conditions; then calculating the upper and lower limits of dynamic control using different multiples; next, calculating the false alarm rate and false negative rate corresponding to each multiple; finally, selecting the multiple with the smallest sum of false alarm rate and false negative rate as the final preset multiple; therefore, this value achieves the best balance between reducing the false alarm rate and reducing the false negative rate. When a new real-time anomaly score is input, that is, the anomaly score obtained from the real-time input high-dimensional feature vector, the exponentially weighted moving average and exponentially weighted moving standard deviation are updated, thereby completing the update of the new dynamic control upper limit and dynamic control lower limit, generating a dynamic threshold that can adapt to changes in the gas turbine operating state, and avoiding false alarms and missed alarms caused by fixed thresholds.

[0028] S3 compares each newly calculated real-time anomaly score with the latest dynamic control limit. If a real-time anomaly score exceeds the dynamic control limit, the value of the continuous anomaly counter used for timing is incremented by one. If a real-time anomaly score does not exceed the dynamic control limit, the value of the continuous anomaly counter used for timing is reset to zero. When the value of the continuous anomaly counter increases twice consecutively, an anomaly alarm is triggered. The start and end times of the anomaly time window are obtained. The start time is the time when the alarm is triggered minus a determined forward time length, and the end time is the time when the alarm is triggered plus a determined backward time length. The process of determining the forward and backward time lengths is as follows: based on the relationship between the time when the anomaly features appear and the time when the fault occurs, the forward time length is set to the length that can cover the earliest time when all anomaly features appear, and the backward time length is set to the length that can cover the anomaly features within a certain period after the fault occurs. The anomaly time period determined based on the start and end times is fed back to the terminal.

Claims

1. A gas turbine anomaly detection method based on incremental isolated forests, characterized in that, Includes the following steps: S1. Based on the gas turbine operating data after data cleaning, a sliding window is used to segment the data to obtain discrete and processable feature windows. The time-domain features and complexity features are calculated in each feature window. All features of all parameters calculated in each feature window are combined in a fixed order to form a high-dimensional feature vector. The high-dimensional feature vectors corresponding to all feature windows are arranged in time order to form a high-dimensional feature vector sequence. S2. Based on the time difference between the generation timestamp and the training timestamp corresponding to each high-dimensional feature vector, weights are assigned, and the weight values ​​are associated with the high-dimensional feature vectors as samples to form a weighted sample set. Subsample sets are extracted based on the weighted sample set, and weighted isolated trees are generated from the subsample sets. Each isolated tree is recursively split to form leaf nodes. The isolated trees with completed weight assignments are pruned according to the information gain ratio. All the pruned and optimized isolated trees are combined into an isolated forest model. S3. Based on the isolated forest model, calculate the anomaly score for each feature vector in the high-dimensional feature vector sequence corresponding to the current running data. Determine the high-confidence normal data set based on the arithmetic mean and arithmetic standard deviation of the anomaly scores of all samples. Then, evaluate the performance of each isolated tree in the current isolated forest model based on the high-confidence normal data set. After the isolated forest model is updated, calculate the real-time anomaly score for each high-dimensional feature vector input in real time and make anomaly judgment.

2. The gas turbine anomaly detection method based on incremental isolated forests according to claim 1, characterized in that, S1 processes the cleaned gas turbine operating data using a sliding window segmentation method. Specifically, the continuous time series gas turbine operating data is segmented into multiple overlapping feature windows with a fixed window length and a fixed step size. Based on the first data point of the time series, a continuous data segment with a length equal to the window length is taken as the first feature window. The second feature window is taken by moving one time step backward from the starting position of the first feature window until the entire time series of gas turbine operating data is covered. S1 calculates the time-domain features and complexity features, including mean, variance, kurtosis, skewness, peak factor and approximate entropy, within each feature window. It then combines all time-domain features and complexity features of all parameters calculated within each feature window in a fixed order to form a high-dimensional feature vector. Finally, it arranges the high-dimensional feature vectors corresponding to all feature windows in chronological order to form a high-dimensional feature vector sequence.

3. The gas turbine anomaly detection method based on incremental isolated forests according to claim 1, characterized in that, S2 obtains the time difference between the timestamp corresponding to each high-dimensional feature vector and the current training timestamp based on the timestamp corresponding to each high-dimensional feature vector and the training timestamp when it is input into the isolated forest model. Based on the total time span of historical normal operation data, the total time span is divided into several equal time intervals. The Euclidean distance between the average high-dimensional feature vector of historical normal operation data and the average high-dimensional feature vector of gas turbine operation data in each time interval is calculated. After normalization, the distance weight of each time interval is obtained. Based on the distance weight, the attenuation coefficient is obtained through linear fitting. The attenuation coefficient is used as the base, and a power operation is performed with the time difference as the exponent. The value obtained by the power operation is used as the weight value of the corresponding high-dimensional feature vector. The calculated weight values ​​are associated one-to-one with the corresponding high-dimensional feature vectors to form a weighted sample set.

4. The gas turbine anomaly detection method based on incremental isolated forests according to claim 3, characterized in that, S2 is based on randomly selecting a subset of samples with the same number of samples from the weighted sample set. After each subset of samples is used to generate an isolated tree, the ratio of the sum of the weight values ​​of all samples in the weighted sample set to the total number of isolated trees is used as the average weighted sample number of each isolated tree. The minimum sample number threshold is set to one percent of the average weighted sample number. Then, the maximum tree depth threshold is obtained by rounding up the base-2 logarithm of the sample number of each subset of samples. For each node of each isolated tree, recursively segment it as follows: randomly select a feature dimension from all high-dimensional feature vectors as the segmentation feature of the current node, and randomly select a number as the segmentation value of the current node based on the range of all sample values ​​of the selected feature dimension. Divide all samples of the current node according to the relationship between the value of the segmentation feature and the segmentation value to obtain the left child node and the right child node. The sum of the weight values ​​of all samples in the left child node and the right child node is used as the weighted sample number of each child node. Repeat the recursive segmentation until the weighted sample number of each child node is less than the small sample number threshold and / or the depth of all nodes is greater than or equal to the maximum tree depth threshold. Then, designate the current node as a leaf node and stop the recursive segmentation.

5. The gas turbine anomaly detection method based on incremental isolated forests according to claim 4, characterized in that, S2 starts from the leaf node at the bottom layer of each isolated tree and performs post-pruning operations layer by layer upwards, specifically as follows: Based on the proportion of the weight value of each sample in each leaf node of each generated isolated tree to the total number of weighted samples, the weighted entropy before the leaf node split is obtained by multiplying the obtained proportion by the logarithm of the proportion to base 2, summing all the results and taking the negative number. Then, based on the weighted entropy of the left and right child nodes of the corresponding leaf node, the weighted entropy of the left child node is multiplied by the proportion of the number of weighted samples of the left child node to the total number of weighted samples of the corresponding leaf node, and the weighted entropy of the right child node is multiplied by the proportion of the number of weighted samples of the right child node to the total number of weighted samples of the corresponding leaf node. The two products are summed to obtain the weighted entropy after the leaf node split. Based on the difference between the weighted entropy before and after the split, the information gain of the corresponding leaf node split is obtained. The splitting information is obtained by taking the logarithm of the ratio of the weighted sample count of the left child node to the total weighted sample count of the leaf node, and the logarithm of the ratio of the weighted sample count of the right child node to the total weighted sample count of the leaf node. The information gain is then divided by the splitting information to obtain the information gain ratio of the corresponding leaf node.

6. The gas turbine anomaly detection method based on incremental isolated forest according to claim 5, wherein S2 obtains the information gain ratio of all leaf nodes by repeated calculation, sorts the information gain ratio of each leaf node of each isolated tree in ascending order, and uses the information gain ratio in the middle position as the pruning threshold. When the information gain ratio of a leaf node is less than the pruning threshold, the two child nodes of the corresponding leaf node are merged so that the weighted sample number of the leaf node is the sum of the weighted sample numbers of the two child nodes. This pruning is repeated until the information gain ratio of all leaf nodes is greater than or equal to the pruning threshold and / or the root node is reached.

7. The gas turbine anomaly detection method based on incremental isolated forests according to claim 1, characterized in that, S2 combines all pruned and optimized isolated trees into an isolated forest model. The isolated forest model calculates the average maximum possible path length based on the number of samples in each subset. Specifically, it adds the natural logarithm of twice the number of samples to Euler's constant, subtracts twice the number of samples minus one from the number of samples, and uses this as the average maximum possible path length. The arithmetic mean of the average maximum possible path lengths of all subsets is then used to obtain the average maximum possible path length of the isolated forest. The isolated forest model then takes the input high-dimensional feature vector and calculates the number of nodes the high-dimensional feature vector passes through from the root node to the leaf node in each isolated tree as the path length. Then, it calculates the average path length of all isolated trees as the average path length, and converts the average path length into anomaly scores in the range [0, 1] by normalizing the average path length and the average maximum possible path length.

8. The gas turbine anomaly detection method based on incremental isolated forests according to claim 1, characterized in that, S3 calculates the anomaly score for each feature vector in the high-dimensional feature vector sequence corresponding to the current running data based on the isolated forest model, and obtains the arithmetic mean and arithmetic standard deviation of all high-dimensional feature vectors; Based on the principle of normal distribution, high-dimensional feature vectors with outlier scores less than the arithmetic mean minus three times the arithmetic standard deviation are identified as high-confidence normal samples. All high-confidence normal samples are collected to form a high-confidence normal sample set. Each high-dimensional feature vector in the set of high-confidence normal samples is input into the isolation tree model. The average path length of each high-dimensional feature vector in the isolation tree is calculated. The variance of the average path length of all high-dimensional feature vectors is used as the performance evaluation value of the corresponding isolation tree. All isolation trees are sorted in ascending order of performance evaluation value. The general isolation trees are retained to form a set of retained trees. A second subset of samples, equal to the number of trees to be retained, is randomly selected from the set of normal samples with high confidence. Each subset is used to generate a new isolated tree. Based on the weight allocation of S2 and structural pruning, a new set of trees is formed. The set of retained trees and the new set of trees are merged to form the updated isolated forest model.

9. The gas turbine anomaly detection method based on incremental isolated forests according to claim 8, characterized in that, S3 calculates anomaly scores for each high-dimensional feature vector input in real time using the updated Isolation Forest model, and stores the resulting anomaly scores in chronological order to form a real-time anomaly score sequence. Based on the historical anomaly score sequence of historical normal operation data, exponentially weighted moving averages are calculated on the historical anomaly score sequence using different smoothing coefficients, and the prediction error corresponding to each smoothing coefficient is calculated. The smoothing coefficient with the smallest prediction error is selected as the final smoothing coefficient. Based on the determined final smoothing coefficient, the exponentially weighted moving standard deviation is calculated for the anomaly scores in the anomaly score sequence at each time point. Specifically, the square of the difference between the anomaly score at each time point and the corresponding exponentially weighted moving average is calculated, and all squared value sequences are subjected to exponentially weighted moving averages to obtain the exponentially weighted moving variance. The exponentially weighted moving variance is then subjected to arithmetic square root operation to obtain the exponentially weighted moving standard deviation. The upper limit and lower limit of dynamic control are obtained by combining the exponentially weighted moving average and exponentially weighted moving standard deviation at the current time point with a preset multiple. When new real-time abnormal score inputs are available, the exponentially weighted moving average and exponentially weighted moving standard deviation are updated, thereby completing the update of the new dynamic control upper limit and dynamic control lower limit.

10. The gas turbine anomaly detection method based on incremental isolated forests according to claim 1, characterized in that, S3 compares each newly calculated real-time anomaly score with the latest dynamic control upper limit. If a real-time anomaly score exceeds the dynamic control upper limit, the value of the continuous anomaly counter used for timing is incremented by one. If a real-time anomaly score does not exceed the dynamic control upper limit, the value of the continuous anomaly counter used for timing is reset to zero. When the value of the continuous anomaly counter increases twice consecutively, an anomaly alarm is triggered. The start and end times of the anomaly time window are obtained, and the anomaly time period determined based on the start and end times is fed back to the terminal.

Images