Anomaly detection method based on data flow concept drift

Abstract

This invention provides an anomaly detection method based on data stream concept drift, belonging to the field of data mining and anomaly detection. It offers a method capable of timely detecting concept drift based on data stream concept drift. The method includes: S1, acquiring real data collected by the system under test at different times to form a real data stream, and establishing a current prediction model for the system under test based on the real data stream; S2, using the prediction model to predict data for the next time period to obtain a predicted data stream; S3, calculating the similarity dataset between the real data stream and the predicted data stream; S4, determining whether concept drift has occurred based on the similarity dataset and the current concept drift threshold of the system under test; S5, if not, repeating S2 to S4; S6, if yes, updating the prediction model, concept drift threshold, and anomaly detection threshold, and repeating S2 to S6 based on the updated prediction model and concept drift threshold.

Description

Technical Field

[0001] This invention relates to the field of data mining and anomaly detection technology, and in particular to an anomaly detection method based on data flow concept drift. Background Technology

[0002] In real-world production systems where data is collected over time, data that deviates from normal or existing data patterns frequently appears; this is known as anomalous data. While many methods exist for anomaly detection, few consider the phenomenon of concept drift in data streams. Concept drift occurs when the concepts embedded in a data stream change. For example, changes in the target concept of the data stream due to process improvements, machine aging, equipment upgrades, or the emergence of unknown operating conditions can cause inconsistencies between the old and new data. Once concept drift occurs, the diagnostic performance of existing anomaly detection models based on the old concepts deteriorates under the new data, leading to misjudgments of anomalies and impacting user experience. Therefore, timely detection of concept drift is crucial for adjusting the anomaly detection model under the new concepts. This necessitates providing an anomaly detection method based on data stream concept drift to ensure timely detection and adjustment of the anomaly detection model under the new concepts. Summary of the Invention

[0003] The purpose of this invention is to provide an anomaly detection method based on data stream concept drift that can detect concept drift in a timely manner.

[0004] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0005] An anomaly detection method based on data flow concept drift includes the following steps:

[0006] S1, acquire the real data collected by the system under test at different times, forming a real data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N}, and establish a current prediction model M for the system to be detected based on the real data stream, where x t This represents the actual data of the system under test at time t;

[0007] S2, using the prediction model M to predict the data of the system to be detected in the next period, obtains the predicted data stream Y = {y1, y2, ..., y...} t y t+1 , ..., y N}, where y t This represents the predicted data of the system under test at time t;

[0008] S3, Calculate the real data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N} and the predicted data stream Y = {y1, y2, ..., y} t y t+1 , ..., y N The similarity between} is used to obtain the similarity dataset D. u ;

[0009] S4, based on the similarity dataset D u The current concept drift threshold of the system under test is used to determine whether concept drift has occurred in the system under test;

[0010] S5. If no concept drift occurs in the system under test, repeat S2 to S4.

[0011] S6. If concept drift occurs in the system to be detected, update the prediction model M, the concept drift threshold of the system to be detected, and the anomaly detection threshold δ of the system to be detected, and repeat S2 to S6 based on the updated prediction model M and concept drift threshold.

[0012] Optionally, when S1 establishes the current prediction model M of the system to be detected based on the real data stream, it uses a sliding window mechanism to analyze the real data stream X = {x1, x2, ..., x...}. t x t+1 , ..., x N} Establish a prediction model M, in which the sliding window size W1 = n, n << N; S3 calculates the real data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N} and the predicted data stream Y = {y1, y2, ..., y} t y t+1 , ..., y N To obtain the similarity dataset Du, the similarity between the real data and the corresponding predicted data is calculated using a sliding window mechanism. Specifically, a sliding window of size W2 = m, where W2 << W1 << N, is used to iterate through both the real data and the corresponding predicted data to obtain the real sequence q. u ={x u x u+1 , ..., x u+m-1} and predicted sequence Q u ={y u y u+1 , ..., y u+m-1}, where u∈(1,N); calculate the true sequence q in sequence. u With the predicted sequence Q u The similarity dataset D is obtained by using time dynamic normalization to determine the similarity between predicted and actual data. u .

[0013] Optionally, S3 calculates the true sequence q sequentially. u With the predicted sequence Q u The similarity dataset D is obtained by using time dynamic normalization to determine the similarity between predicted and actual data. u At that time, for the true sequence q u ={x u x u+1 , ..., x u+m-1} and predicted sequence Q u ={y u y u+1 , ..., y u+m-1 First, construct an m×m matrix grid, where the element at position (i, j) in the m×m grid is x. i and y j The Euclidean distance d(x) between these two points i y j )=(x i -y j ) 2 The Euclidean distance between these two points is used as the similarity between the predicted and actual data; the smaller the distance, the higher the similarity. Then, a path D is found. u :D u =d1+d2+...+d k +...+d K Where u∈(1,N), m≤K<2m-1, the path D u The following constraints must be met:

[0014] (1) Boundary constraints:

[0015] d1 = (1, 1), dK(m, m), the selected path must start from the bottom left corner and end at the top right corner;

[0016] (2) Continuity:

[0017] If d k-1 = (a', b'), then the next path point d k = (a, b) satisfies: (a-a')≤1, (b-b')≤1; each point on the path cannot cross a point to match, but can only choose to align with its adjacent points, thus ensuring q u and Q u Each coordinate in D appears in Du middle;

[0018] (3) Monotonicity:

[0019] If d k-1 = (a', b'), then the next path point d k = (a, b) satisfies: 0 ≤ (a - a') , 0 ≤ (b - b'), which restricts point d to be monotonically increasing with time;

[0020] (4) Combining continuity and monotonicity:

[0021] Each point has only three paths. For point (i, j), the next point has only three possibilities: (i+1, j), (i, j+1), (i+1, j+1).

[0022] Finally, select D from all paths that satisfy the above constraints. u Minimum path:

[0023] D u =d1+d2+...+d k +...+d K , where u∈(1,N), m≤K<2m-1.

[0024] Optionally, S4 is based on the similarity dataset D u When determining whether the system under test has experienced concept drift based on the current concept drift threshold, the similarity dataset D is first analyzed. u Normalization yields D'. Then, D' is compared with the current concept drift threshold β of the system to be detected, where 0 < β < 1. If D' < β, it means that the current predicted data is similar to the real data and the data stream has not experienced concept drift. If D' > β, it means that the current predicted data is not similar to the real data and the data stream has experienced concept drift.

[0025] Optionally, when updating the anomaly detection threshold δ of the system to be detected in step S6, the anomaly detection threshold δ = 3M std M std The standard deviation of the real data when building the prediction model M.

[0026] The beneficial effects of this invention are:

[0027] By setting up a current prediction model for the system under test, and using the prediction model to predict data for the next period to obtain the predicted data stream and calculate the similarity dataset between the real data stream and the predicted data stream, and by judging whether concept drift has occurred based on the similarity dataset and the current concept drift threshold of the system under test, a method is provided to detect whether concept drift has occurred in the system under test in a timely manner. This method can promptly detect the drift phenomenon of the system under test, and can make timely anomaly diagnosis for the transformation between old and new concepts, thereby enabling timely judgment and handling of abnormal data and abnormal situations, and thus ensuring that the system under test can be adjusted in a timely manner. Attached Figure Description

[0028] Figure 1 This is a flowchart of the present invention.

[0029] Figure 2 This is a schematic diagram of the actual data flow in one embodiment of the present invention.

[0030] Figure 3 Figures a and b in the figure are prediction curves for data applicable to the examples of this invention.

[0031] Figure 4 Figures a and b in the figure are schematic diagrams of the prediction curve, abnormal data, and calculated data similarity curve when concept drift is not detected in this invention.

[0032] Figure 5 Figures a and b in the figure are schematic diagrams of the prediction curve, abnormal data, and calculated data similarity curve when detecting concept drift in this invention. Detailed Implementation

[0033] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments.

[0034] like Figure 1 As shown, the anomaly detection method based on data flow concept drift in this embodiment includes the following steps:

[0035] S1, acquire the real data collected by the system under test at different times, forming a real data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N}, and establish the current prediction model M of the system to be detected based on the real data stream, where xt represents the real data of the system to be detected at time t.

[0036] S2, using the prediction model M to predict the data of the system to be detected in the next period, obtains the predicted data stream Y = {y1, y2, ..., y...} t y t+1, ..., y N}, where y t This represents the predicted data of the system to be tested at time t.

[0037] S3, Calculate the real data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N} and the predicted data stream Y = {y1, y2, ..., y} t y t+1 , ...y N The similarity between} is used to obtain the similarity dataset D. u .

[0038] S4, based on the similarity dataset D u The current concept drift threshold of the system under test is used to determine whether concept drift has occurred in the system under test.

[0039] S5. If no concept drift occurs in the system under test, repeat S2 to S4.

[0040] S6. If concept drift occurs in the system to be detected, update the prediction model M, the concept drift threshold of the system to be detected, and the anomaly detection threshold δ of the system to be detected, and repeat S2 to S6 based on the updated prediction model M and concept drift threshold.

[0041] Optionally, when S1 establishes the current prediction model M of the system to be detected based on the real data stream, it uses a sliding window mechanism to analyze the real data stream X = {x1, x2, ..., x...}. t x t+1 , ..., x N} Establish a prediction model M, in which the sliding window size W1 = n, n << N; S3 calculates the real data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N} and the predicted data stream Y = {y1, y2, ..., y} t y t+1 , ...y N The similarity between} is used to obtain the similarity dataset D. u The similarity between the real data and the corresponding predicted data is obtained by calculating the time dynamic warping of the real data and the corresponding predicted data using a sliding window mechanism. Specifically, a sliding window of size W2 = m, W2 << W1 << N, is used to traverse the real data and the corresponding predicted data respectively to obtain the real sequence q. u ={x u x u+1 , ..., x u+m-1} and predicted sequence Qu ={y u y u+1 , ..., y u+m-1}, where u∈(1,N); calculate the true sequence q in sequence. u With the predicted sequence Q u The similarity dataset D is obtained by using time dynamic normalization to determine the similarity between predicted and actual data. u .

[0042] Optionally, S3 calculates the true sequence q sequentially. u With the predicted sequence Q u The similarity dataset D is obtained by using time dynamic normalization to determine the similarity between predicted and actual data. u At that time, for the true sequence q u ={x u x u+1 , ..., x u+m-1} and predicted sequence Q u ={y u y u+1 , ..., y u+m-1 First, construct an m×m matrix grid, where the element at position (i, j) in the m×m grid is x. i and y j The Euclidean distance d(x) between these two points i y j )=(x i -y j ) 2 The Euclidean distance between these two points is used as the similarity between the predicted and actual data; the smaller the distance, the higher the similarity. Then, a path D is found. u :

[0043] D u =d1+d2+...+d k +...+d K Where u∈(1,N), m≤K<2m-1, the path D u The following constraints must be met:

[0044] (1) Boundary constraints:

[0045] d1 = (1, 1), d K = (m, m), the selected path must start from the bottom left corner and end at the top right corner;

[0046] (2) Continuity:

[0047] If d k-1 = (a', b'), then the next path point d k= (a, b) satisfies: (a-a')≤1, (b-b')≤1; each point on the path cannot cross a point to match, but can only choose to align with its adjacent points, thus ensuring q u and Q u Each coordinate in D appears in D u middle;

[0048] (3) Monotonicity:

[0049] If d k-1 = (a', b'), then the next path point d k = (a, b) satisfies: 0 ≤ (a - a') , 0 ≤ (b - b'), which restricts point d to be monotonically increasing with time;

[0050] (4) Combining continuity and monotonicity:

[0051] Each point has only three paths. For point (i, j), the next point has only three possibilities: (i+1, j), (i, j+1), (i+1, j+1).

[0052] Finally, select D from all paths that satisfy the above constraints. u Minimum path:

[0053] D u =d1+d2+...+d k +...+d K , where u∈(1,N), m≤K<2m-1.

[0054] Furthermore, S4 is based on the similarity dataset D u When determining whether the system under test has experienced concept drift based on the current concept drift threshold, the similarity dataset D is first analyzed. u Normalization yields D'. Then, D' is compared with the current concept drift threshold β of the system to be detected, where 0 < β < 1. If D' > β, it means that the current predicted data is similar to the real data and the data stream has not experienced concept drift. If D' > β, it means that the current predicted data is not similar to the real data and the data stream has experienced concept drift.

[0055] When comparing D' with the current concept drift threshold β of the system under test, it is necessary to first determine the current concept drift threshold β of the system under test. Specifically, the determination of the current concept drift threshold β of the system under test is based on the Hoeffding inequality, as follows:

[0056] Hoeffding's inequality is expressed as follows: (1)

[0057]

[0058] Let the actual data used in building the prediction model M be X1, with an average value of λ1; let the predicted data used in building the prediction model be X2, with an average value of λ2; Assumptions:

[0059] E(λ1)=E(λ2)

[0060] D(λ1)=D(λ2)

[0061] Based on the above assumptions, the two sets of data have the same distribution and there is no concept drift. To determine whether there is a significant difference between the true data X1 and data X2, we construct the test statistic: λ1-λ2, with a confidence level of α. Therefore:

[0062] P[(λ1-λ2)-E(λ1-λ2)≥p]≤α (2)

[0063] Central standardization yields:

[0064]

[0065] Simplifying, we get:

[0066]

[0067] Substituting equation (1) into equation (4) using Hoeffding's general inequality, we get:

[0068]

[0069] Results:

[0070]

[0071] The current concept drift threshold β of the system under test is p / 100.

[0072] Among them, D trianmean The confidence level α is the average similarity between X1 and X2 calculated when building the prediction model M, where α = 10 × D. trianmean The range of values ​​for X1 and X2 [a] i :b i ], i = 1, 2; n = 2 is the number of data sets, n1 and n2 are the number of data in X1 and X2 respectively, and D(X1) and D(X2) are the variances of data X1 and X2.

[0073] Optionally, when updating the anomaly detection threshold δ of the system to be detected in step S6, the anomaly detection threshold δ = 3M std M std Let x be the standard deviation of the real data used to build the prediction model M. For any real data, if |x| t-M mean |≥δ, then x t This is abnormal data, M mean The average value of the real data when building the prediction model M.

[0074] To facilitate understanding, an example is provided below to illustrate an embodiment of the present invention:

[0075] The data in this example are tool temperature data collected during machining operations, switching from a spindle speed of 400 r / min, depth of cut of 1.1 mm, and feed rate of 0.5 mm / r (0-1800) to a spindle speed of 450 r / min, depth of cut of 0.8 mm, and feed rate of 0.1 mm / r (1800-2921). In this process, the system under test is a machining system, and the data involved is temperature data. Figure 2 As shown, this is the actual data stream collected during the machining process. In a specific implementation, the method provided by this invention, after obtaining the actual temperature data stream, further includes the following steps:

[0076] Step 1: Build a prediction model for the real data stream to predict the data and obtain the predicted data stream.

[0077] This step employs a sliding window mechanism to analyze the actual data stream X = {x1, x2, ..., x...}. t x t+1 , ..., x N A prediction model M is established using the LSTM (Long Short-Term Memory) neural network prediction algorithm, and the data for the next time period is predicted to obtain the predicted data stream Y = {y1, y2, ..., y...}. t y t+1 , ..., y N}

[0078] like Figure 3 As shown, this example uses LSTM to build a prediction model based on nearly 600 temperature data points. Figure 3 In Figure a, the solid curves represent the actual data, the dotted curves represent the predicted values ​​when the prediction model was built, and the dashed curves represent the predicted values ​​obtained through the prediction model when making predictions. Figure 3 Figure b is for Figure 3 The simplified graph is obtained by averaging every ten points in graph a, to ensure that the meaning can be clearly seen. Figure 3 The relationship between the data in graph a.

[0079] Step 2: Calculate the similarity between the real data stream and the predicted data stream.

[0080] Specifically, a sliding window mechanism is used to calculate the time dynamic regularization between the real data and the corresponding predicted data to determine their similarity. A sliding window of W2 = m, W2 << W1 << N is used to traverse both the real data and the corresponding predicted data to obtain the real sequence q. u ={x u x u+1 , ..., x u+m-1} and predicted sequence Q u ={y u y u+1 , ..., y u+m-1}, where u∈(1,N). Calculate the true sequence q sequentially. u With the predicted sequence Q u The similarity dataset D is obtained by using Dynamic Time Rendering (DWT) to determine the similarity between predicted and actual data. u .

[0081] In this example, the sliding window size m is 5 in this step to calculate the similarity dataset D between the real data stream and the predicted data stream. u ,like Figure 5 The curve in the lower half of Figure a is shown. Figure 5 Figure b is for Figure 5 The simplified graph is obtained by averaging every ten points in graph a, to ensure that the meaning can be clearly seen. Figure 5 The relationship between the data in graph a.

[0082] Step 3: Based on the similarity dataset D u The current concept drift threshold of the system under test is used to determine whether concept drift has occurred in the system under test.

[0083] Specifically, for the similarity dataset D u Normalization The normalized D' is compared with the current concept drift threshold. Based on the above real data and the method for calculating the concept drift threshold, in this example, α = 0.35, X1 ∈ [174.3: 215.9], X2 ∈ [180.6: 205.7], D(X1) = 40.6, D(X2) = 14.7, n1 = n2 = 585, n = 2, and β = 0.73 is calculated.

[0084] (1) If D' < β, it means that the current predicted data is similar to the real data, and it is determined that the data stream has not undergone concept drift; then the prediction model M, the current concept drift threshold and the anomaly detection threshold δ are not updated, and the second and third steps are repeated to continue anomaly detection.

[0085] (2) If D' > β, it indicates that the current predicted data is not similar to the actual data, and concept drift has occurred in the data stream. At this time, update the prediction model M, the concept drift threshold, and the anomaly detection threshold δ, where δ = 3M. std M std To establish the standard deviation of the real data when setting the prediction model M, repeat steps two and three for anomaly detection.

[0086] In this example, as Figure 5 Concept drift was detected in the lower half of graph a or b, between 1800 and 1850. In this example, as... Figure 3 In Figure a, the dotted line curve starting at 1812 represents the predicted data when building the prediction model M after detecting concept drift, while the dashed line curve starting at 2500 represents the data prediction performed after detecting concept drift. Figure 5 Points not on the solid curve or the dotted curve in graph a are detected abnormal data.

[0087] like Figure 4 This refers to a situation where conceptual drift occurs without prior judgment. The solid line curve represents actual data, while the dotted line curve represents predicted data. Figure 4 Points in graph a that do not lie on the solid line curve or the dotted line curve are detected abnormal data. Figure 4 In graph a or b, the lower half of the curve represents the similarity of the data (the higher the curve, the less similar the data). Comparison Figure 4 and Figure 5 As can be seen, when concept drift occurs, the predicted data differs significantly from the actual data. If the anomaly detection threshold is not updated, normal data will be judged as anomaly data. For example... Figure 5 This is used to determine situations where concept drift occurs. The solid line curve represents the actual data, and the dotted line curve represents the predicted data. Points not on either the solid or dotted line curves are detected abnormal data. Figure 4 It can be observed that the method provided by the embodiments of the present invention improves the accuracy of abnormal data detection.

[0088] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of the present invention, and the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. An anomaly detection method based on data flow concept drift, characterized in that, Includes the following steps: S1, acquire the real data collected by the system under test at different times, forming a real data stream X={x1, x2, ..., x...} t x t+1 ,..,x N }, and establish a current prediction model M for the system to be detected based on the real data stream, where x t This represents the actual data of the system under test at time t; wherein, the system under test is a machining system, and the actual data is the tool temperature data collected during machining when the spindle speed is 400 r / min, depth of cut is 1.1 mm, feed rate is 0.5 mm / r (0-1800) and the spindle speed is 450 r / min, depth of cut is 0.8 mm, feed rate is 0.1 mm / r (1800-2921); S2, using the prediction model M to predict the data of the system to be detected in the next period, obtains the predicted data stream Y={y1, y2, ..., y... t y t+1 , ...y N }, where y t This represents the predicted data of the system under test at time t; S3, Calculate the actual data stream X = {x1, x2, ..., x...} t x t+1 , ..., x N } and the predicted data stream Y={y1, y2, ..., y t y t+1 , ...y N The similarity between} is used to obtain the similarity dataset D; S4. Determine whether the system to be detected has experienced concept drift based on the similarity dataset D and the current concept drift threshold of the system to be detected. S5. If no concept drift occurs in the system under test, repeat S2 to S4. S6. If concept drift occurs in the system to be detected, update the prediction model M, the concept drift threshold of the system to be detected, and the anomaly detection threshold δ of the system to be detected, and repeat S2 to S6 according to the updated prediction model M and concept drift threshold. Steps S1-S6 involve establishing a current prediction model M for the machining system, using the prediction model M to predict temperature data for the next time period to obtain a predicted data stream, and calculating the similarity dataset D between the actual data stream and the predicted data stream. Based on the similarity dataset D and the current concept drift threshold of the machining system, it is determined whether concept drift has occurred. This method allows for timely detection of drift phenomena in the machining system, timely anomaly diagnosis for the transition between old and new concepts, and timely judgment and processing of abnormal data and abnormal situations, ensuring timely adjustments to the machining system.

2. The anomaly detection method based on data flow concept drift according to claim 1, characterized in that, When S1 establishes the current prediction model M of the system to be detected based on the real data stream, it uses a sliding window mechanism to apply the prediction model M to the real data stream X={x1, x2, ..., x...}. t x t+1 , ..., x N } Establish a prediction model M, in which the sliding window size W1=n, n<<N; S3 calculates the real data stream X={x1, x2, ..., x...} t x t+1 , ..., x N } and the predicted data stream Y={y1, y2, ..., y t y t+1 , ...y N To obtain the similarity dataset D, the similarity between the real data and the corresponding predicted data is calculated using a sliding window mechanism. Specifically, a sliding window of size W2=m, where W2<<W1<<N, is used to iterate through both the real data and the corresponding predicted data to obtain the real sequence q. u ={x u x u+1 , ..., x u+m-1 } and predicted sequence Q u ={y u y u+1 , ..., y u+m-1 }, where u∈(1,N); calculate the true sequence q in sequence. u With the predicted sequence Q u The similarity dataset D is obtained by using time dynamic regularization to determine the similarity between the predicted data and the real data.

3. The anomaly detection method based on data flow concept drift according to claim 2, characterized in that, S3 calculates the true sequence q sequentially. u With the predicted sequence Q u When using time dynamic regularization to determine the similarity between predicted and real data to obtain the similarity dataset D, for the real sequence q... u ={x u x u+1 , ..., x u+m-1 } and predicted sequence Q u ={y u y u+1 , ..., y u+m-1 First, construct an m×m matrix grid, where the element at position (i, j) in the m×m grid is x. i and y j The Euclidean distance d(x) between these two points i y j )=(x i -y j ) 2 The Euclidean distance between these two points is used as the similarity between the predicted and actual data; the smaller the distance, the higher the similarity. Then, a path D is found. u :D u =d1+d2+…+d k +…+d K Where u∈(1,N), m≤K<2m-1, the path D u The following constraints must be met: (1) Boundary constraints: d1=(1,1),d K =(m, m), the selected path must start from the bottom left corner and end at the top right corner; (2) Continuity: If d k-1 =(a', b'), then the next path point d k =(a, b) satisfies: (a-a')≤1, (b-b')≤1; each point on the path cannot cross any other point to match, but can only choose to align with its adjacent points, ensuring q u and Q u Each coordinate in D appears in D u middle; (3) Monotonicity: If d k-1 =(a', b'), then the next path point d k =(a, b) satisfies: 0≤(a-a'), 0≤(b-b'), which restricts point d to be monotonically increasing with time; (4) Combining continuity and monotonicity: Each point has only three paths. For point (i, j), the next point has only three possibilities: (i+1, j), (i, j+1), (i+1, j+1). Finally, select D from all paths that satisfy the above constraints. u Minimum path: D u =d1+d2+…+d k +…+d K , where u∈(1,N), m≤K<2m-1.

4. The anomaly detection method based on data flow concept drift according to claim 3, characterized in that, In step S4, when determining whether the system to be detected has experienced concept drift based on the similarity dataset D and the current concept drift threshold of the system to be detected, the similarity dataset D is first normalized to obtain... D′, Then, D′ is compared with the current concept drift threshold β of the system to be detected, where 0 < β < 1. If D′ < β, it means that the current predicted data is similar to the real data and the data stream has not experienced concept drift. If D′ > β, it means that the current predicted data is not similar to the real data and the data stream has experienced concept drift.

5. The anomaly detection method based on data flow concept drift according to claim 4, characterized in that, In step S6, when updating the anomaly detection threshold δ of the system to be detected, the anomaly detection threshold δ = 3M std M std The standard deviation of the real data when building the prediction model M.

Images