A high-dimensional data flow abnormal monitoring method and system

Abstract

The embodiment of the present application proposes a high-dimensional data flow anomaly monitoring method and system based on the SVM-WAMCUSUM control chart, the method comprising: obtaining a high-dimensional data flow, dividing the high-dimensional data flow according to category information to obtain an original feature set; training the SVM according to the original feature set to obtain the optimal classification hyperplane function of the SVM; using the optimal classification hyperplane function to calculate the score of each feature, sorting to obtain a feature sorting set, continuously deleting the features with the smallest scores and updating the feature sorting set, using the remaining features to train the SVM again until all features are screened, terminating the cycle and outputting the final feature sorting set; retaining the top k features ranked in importance, and forming their training samples into a data set Y; calculating an unbiased estimator of drift δ based on Y and substituting Y and into the WACMCUSUM chart and the WAPMCUSUM chart respectively, calculating the process control statistic and control limit, completing the drawing of the control chart, and when the statistic is greater than the control limit, the control chart initiates an out-of-control signal.

Description

Technical Field

[0001] The present application relates to the field of quality control technology, and in particular to a method and system for monitoring abnormalities in high-dimensional data streams. Background Art

[0002] Nowadays, due to the diversity of enterprise development and the expansion of production scale, the amount of data generated in the production process has increased dramatically, and the dimension is getting higher and higher. Massive data has been presented in the industrial field. In recent years, the monitoring of high-dimensional data flow processes has increasingly attracted the attention of scholars in related fields. In the case of high-dimensional data flow, the monitoring effect of traditional process control models is general, and alarm signals cannot be issued quickly when abnormalities occur. Control charts are one of the commonly used tools in statistical process control and play an important role in controlling product quality. The main purpose of control charts is to monitor the process, issue out-of-control alarms in a timely manner, and reduce resource waste.

[0003] The role of statistical process control is to quickly send out alarm signals through the statistics and control limits of the control chart when an abnormality occurs in the process control, thereby reducing losses. However, due to the reality and complexity of high-dimensional data streams, the process control charts previously applied to low-dimensional data streams have some shortcomings. Therefore, in order to adapt to today's rapidly developing industry and effectively solve some challenges brought by high-dimensional data streams, an effective high-dimensional data stream anomaly monitoring method is of great significance to current industrial production monitoring. At present, there are two common research ideas for the problem of high-dimensional data stream anomaly monitoring at home and abroad: (1) starting from the control chart itself, improving the existing control chart or proposing a new control chart to adapt to the high-dimensional data flow process; (2) combining the control chart with the dimensionality reduction method to reduce the difficulty of processing high-dimensional data. In comparison, these two ideas have their own advantages and disadvantages, but the combination of control charts and dimensionality reduction can avoid the "dimensionality disaster" to a certain extent.

[0004] In view of this, it is of great significance to design an abnormal monitoring method and system that can effectively deal with a series of problems caused by the characteristics of high-dimensional data streams, such as large data volume, high data dimension, numerous data quality characteristics, and relatively low data value density. Summary of the invention

[0005] According to the first aspect of the present application, a method for monitoring anomalies of high-dimensional data streams is proposed, the method comprising the following steps:

[0006] S110, obtain high-dimensional data stream Z t ∈{0,1}, divide the high-dimensional data stream according to the category information to obtain the original feature set S={1,2,K,p};

[0007] S120, training a support vector machine (SVM) classifier according to the original feature set to obtain an optimal classification hyperplane function of the support vector machine (SVM) classifier;

[0008] S130, using the optimal classification hyperplane function to calculate the score of each feature, and sorting to obtain a feature sorting set, continuously deleting the feature with the smallest score and updating the feature sorting set, and using the remaining features to train the support vector machine SVM classifier again until all features are screened, ending the cycle and outputting the final feature sorting set;

[0009] S140, retaining the top k features in the final feature ranking set, and forming a data set Y with the training samples corresponding to the k features; and

[0010] S150, calculate an unbiased estimator of drift δ based on the data set Y And the data set Y and the unbiased estimator Substitute them into the WACMCUSUM chart and WAPMCUSUM chart respectively, calculate the process control statistics and control limits, and finally complete the drawing of the control chart. When the statistics are greater than the control limit, the control chart activates the out-of-control signal.

[0011] Through this method, the support vector machine classifier (SVM) and the weighted adaptive multivariate cumulative sum (WAMCUSUM) graph are combined to grasp the main characteristics of high-dimensional data streams, detect anomalies in time, issue alarm signals, and reduce the waste of resources.

[0012] In some embodiments, in step S120, it also includes giving Among them, x i ∈R d is the predictor variable, y i ∈{0,1} is a column of class variables, N is the number of samples, d is the number of sample features, and the optimal classification hyperplane function of the support vector machine SVM classifier is obtained by solving formula (1):

[0013]

[0014]

[0015] where ||·|| is the Euclidean norm, ξ i is a slack variable, c is a user-specified positive penalty factor used to control the weights of both classification error and interval size, ω is a d-dimensional normal vector orthogonal to the classification hyperplane, which determines the direction of the hyperplane, and b is a bias term that determines the distance between the hyperplane and the origin. The obtained high-dimensional data stream When X t In steady state process Z t =0; when Xt When in the process of losing control t =1, X t and Z t Substitute into formula (1) and solve the formula to get ω. The values ​​of ω and b can be obtained by solving formula (1). When the two classes of samples are extremely unbalanced, the parameter b can be adjusted to assign more weight to the class with a smaller sample size.

[0016] The essence of the support vector machine (SVM) classifier is to find a decision function between the prediction variable and the class variable. Its goal is to find a hyperplane f(x) = ωx + b to separate the training samples from different classes. If the training samples are not linearly separable, the function Map the original feature space to a higher-dimensional feature space so that different classes can be linearly separated, thereby obtaining a hyperplane where <·,·> represents the dot product function.

[0017] In order to find the optimal classification hyperplane ω·x+b=0, it is necessary to solve the optimization problem of the above formula (1).

[0018] In some embodiments, it is characterized in that the dual problem is considered as a quadratic programming problem to solve formula (1):

[0019]

[0020] Among them, α i is the Lagrange multiplier, α i ≠0 corresponding to the input data x i They play a major role in the decision function and are called support vectors (SVs); It is the kernel function used by the support vector machine (SVM) classifier, representing the specific similarity between input features.

[0021] Among them, the expression of the kernel function is:

[0022]

[0023] Among them, σ 2 It is called the diffusion parameter and determines the performance of the support vector machine (SVM) classifier.

[0024] It is defined using the Gaussian kernel function (BRF) using formula (3).

[0025] In some embodiments, in step S130, the score of each feature is calculated using the optimal classification hyperplane function, and the score formula is:

[0026]

[0027] Among them, ωi is a d-dimensional normal vector orthogonal to the classification hyperplane.

[0028] Use ω to calculate the score of each feature and sort them. And continuously delete the features with the smallest score and update the feature sorting set. Among them, the feature expression with the smallest score is: d=argmin i c i The remaining features are used to train the support vector machine (SVM) classifier again, and the next iteration is performed until all features are screened and the cycle ends, and the feature sorting set is output.

[0029] In some embodiments, in step S150, an unbiased estimator of the drift δ is calculated based on the data set Y The formula used is:

[0030]

[0031] Among them, μ 0 is the mean vector of the steady-state process, δ min is the minimum value of drift δ that needs to be protected, and k is the number of features ranked top in importance in the feature sorting set.

[0032] In some embodiments, in step S150, the data set Y and the unbiased estimator Substituting into the WACMCUSUM chart to calculate the process control statistics and control limits uses the following formula:

[0033]

[0034] in, make e t is the statistic of the WACMCUSUM chart. The control limit H is calculated based on the Monte Carlo simulation. When e t >H, the control chart starts the out-of-control signal.

[0035] In some embodiments, in step S150, the data set Y and the unbiased estimator Substituting into the WAPMCUSUM chart to calculate the process control statistics and control limits uses the following formula:

[0036]

[0037]

[0038] make E t is the statistic of the WAPMCUSUM chart. The control limit H is calculated based on the Monte Carlo simulation. When E t >H, the control chart starts the out-of-control signal.

[0039] In a second aspect, the present application provides a high-dimensional data flow anomaly monitoring system, the system comprising the following modules:

[0040] Acquisition module to obtain high-dimensional data stream Z t ∈{0,1}, divide the high-dimensional data stream according to the category information to obtain the original feature set S = {1,2,K,p}; and

[0041] A training module, used to train a support vector machine (SVM) classifier according to the original feature set to obtain an optimal classification hyperplane function of the support vector machine (SVM) classifier; and

[0042] A sorting module is used to calculate the score of each feature using the optimal classification hyperplane function, and sort them to obtain a feature sorting set, continuously delete the feature with the smallest score and update the feature sorting set, and use the remaining features to train the support vector machine SVM classifier again until all features are screened and the cycle ends, and the final feature sorting set is output; and

[0043] An extraction module is used to retain the top k features in the final feature ranking set, and to form a data set Y with the training samples corresponding to the k features; and

[0044] Control module, used to calculate an unbiased estimator of drift δ based on the data set Y And the data set Y and the unbiased estimator Substitute them into the WACMCUSUM chart and WAPMCUSUM chart respectively, calculate the process control statistics and control limits, and finally complete the drawing of the control chart. When the statistics are greater than the control limit, the control chart activates the out-of-control signal.

[0045] In a third aspect, the present application provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, any of the above methods is implemented.

[0046] A method and system for monitoring abnormalities of a high-dimensional data stream provided by an embodiment of the present application realizes data dimensionality reduction through a support vector machine (SVM) classifier, and draws a control chart based on the calculated control limits of the data set after dimensionality reduction and the WAMCUSUM chart statistics to realize the control process. The cumulative drift information of the SVM-WAMCUSUM chart is faster, the alarm is activated earlier, and the monitoring performance is better. In addition, the SVM-WAMCUSUM control chart needs to obtain the category information of the original data in advance during monitoring, and complete the dimensionality reduction while retaining the effective information as much as possible, thereby improving the monitoring efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Other features, objects and advantages of the present application will become more apparent by reading the detailed description of non-limiting embodiments made with reference to the following drawings:

[0048] Figure 1 is a flow chart of a high-dimensional data flow anomaly monitoring method based on a SVM-WAMCUSUM control graph according to an embodiment of the present application;

[0049] Figure 2 It is a schematic diagram of a framework of a high-dimensional data flow anomaly monitoring method based on an SVM-WAMCUSUM control graph according to an embodiment of the present application;

[0050] Figure 3 is the minimum drift value δ min Schematic diagram of the simulation results of SVM-WAMCUSUM graph at different times;

[0051] Figure 4 is a flow chart of a high-dimensional data flow anomaly monitoring system based on a SVM-WAMCUSUM control graph according to an embodiment of the present application;

[0052] Figure 5 It is a structural diagram of a computer system suitable for implementing an electronic device of an embodiment of the present application. DETAILED DESCRIPTION

[0053] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0054] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0055] Figure 1 A flowchart of a high-dimensional data flow anomaly monitoring method based on an SVM-WAMCUSUM control graph according to an embodiment of the present application is shown; Figure 2 A schematic diagram of a framework of an embodiment of the present application is shown. Figure 1 and Figure 2 , the method 100 comprises the following steps:

[0056] S110, obtain high-dimensional data stream Z t ∈{0,1}, divide the high-dimensional data stream according to the category information to obtain the original feature set S={1,2,K,p};

[0057] S120, training a support vector machine (SVM) classifier according to the original feature set to obtain an optimal classification hyperplane function of the support vector machine (SVM) classifier;

[0058] S130, using the optimal classification hyperplane function to calculate the score of each feature, and sorting to obtain a feature sorting set, continuously deleting the feature with the smallest score and updating the feature sorting set, and using the remaining features to train the support vector machine SVM classifier again until all features are screened, ending the cycle and outputting the final feature sorting set;

[0059] S140, retaining the top k features in the final feature ranking set, and forming a data set Y with the training samples corresponding to the k features; and

[0060] S150, calculate an unbiased estimator of drift δ based on the data set Y And the data set Y and the unbiased estimator Substitute them into the WACMCUSUM chart and WAPMCUSUM chart respectively, calculate the process control statistics and control limits, and finally complete the drawing of the control chart. When the statistics are greater than the control limit, the control chart activates the out-of-control signal.

[0061] In this embodiment, since there are two types of WAMCUSUM graphs: WACMCUSUM and WAPMCUSUM, the data set Y and the unbiased estimator are respectively Substitute into the WACMCUSUM chart and WAPMCUSUM chart to calculate process control statistics and control. Therefore, the SVM-WAMCUSUM control chart provided in this application includes two control charts: SVM-WACMCUSUM and SVM-WAPMCUSUM.

[0062] The present invention combines the SVM method with the WAMCUSUM diagram to propose an SVM-WAMCUSUM diagram. The purpose of the SVM-WAMCUSUM diagram is to grasp the main features of the high-dimensional data stream and detect anomalies in time. First, the high-dimensional data stream is feature screened by the SVM method, each of which can be regarded as a feature, and the features ranked high in importance are screened out, and the new data stream composed of the screened data is used to achieve dimensionality reduction. Secondly, the WAMCUSUM diagram is used to monitor the new data stream, calculate the process control statistics and control limits, and then identify the anomalies in the process, send out alarm signals, and reduce the waste of resources.

[0063] The essence of support vector machine (SVM) is to find a decision function between the prediction variable and the class variable. Its goal is to find a hyperplane f(x) = ωx + b to separate the training samples from different classes. If the training samples are not linearly separable, it is necessary to use the function Map the original feature space to a higher-dimensional feature space so that different classes can be linearly separated, thereby obtaining a hyperplane where <·,·> represents the dot product function.

[0064] In a specific embodiment, given Among them, x i ∈R d is the predictor variable, y i ∈{0,1} is a column of class variables, N is the number of samples, and d is the number of sample features. In order to find the optimal classification hyperplane ω·x+b=0, the following optimization problem needs to be solved:

[0065]

[0066]

[0067] where ||·|| is the Euclidean norm, ξ i is a slack variable, c is a user-specified positive penalty factor used to control the weights of both classification error and interval size

[50] . ω is a d-dimensional normal vector orthogonal to the classification hyperplane, which determines the direction of the hyperplane, and b is a bias term that determines the distance between the hyperplane and the origin. The values ​​of ω and b can be obtained by solving the formula. When the two classes of samples are extremely unbalanced, the parameter b can be adjusted to assign more weight to the class with smaller sample size. A common method to solve the formula is to consider its dual problem as a quadratic programming problem:

[0068]

[0069]

[0070] where α i is the Lagrange multiplier, α i ≠0 corresponding to the input data x i Play a major role in the decision function and are called support vectors (SVs). Represents a kernel function, which represents a specific similarity between input features. This application uses a Gaussian kernel function (RBF), which is defined as follows:

[0071]

[0072] where σ 2 It is called the diffusion parameter and determines the performance of the support vector machine (SVM) classifier.

[0073] Known high-dimensional data flow When X t In steady state process Z t =0; when X t When in the process of losing control t=1, X t and Z t Substitute it into the SVM method, solve the formula, and get ω.

[0074] Use ω to calculate the score of each feature and sort them. Delete the feature with the smallest score and update the feature sorting set. Use the remaining features to train the SVM classifier again and perform the next iteration until all features are screened and the loop ends. Output the feature sorting set. The score formula of feature i is:

[0075]

[0076] According to the feature sorting set, the top k features with high importance are retained, and their corresponding data streams constitute Y to achieve dimensionality reduction.

[0077] Based on Y, calculate an unbiased estimator of the drift δ The formula is as follows:

[0078]

[0079] where μ 0 is the mean vector of the steady-state process, δ min is the minimum value of drift δ that needs to be protected.

[0080] Using Y and Calculate the SVM-WACMCUSUM plot statistics:

[0081]

[0082] in, make According to the Monte Carlo simulation, the control limit H is calculated. t When >H, the control chart starts the out-of-control signal. The value of H is related to the value of ARL of the steady-state process.

[0083] Using Y and Calculate the SVM-WAPMCUSUM graph statistic:

[0084]

[0085]

[0086] Similar to the SVM-WACMCUSUM graph, Whenever E t When the control limit H is greater than H, the SVM-WAPMCUSUM chart will send out a signal of out-of-control. The size of the control limit H depends on the steady-state process ARL.

[0087] In a specific embodiment, in order to better illustrate the SVM-WAMCUSUM diagram, a specific algorithm is given below. First, it is known that the high-dimensional data stream SVM is used to select the top ten features in terms of importance to form a new data stream and achieve dimensionality reduction. Secondly, the WAMCUSUM chart is used to monitor the new data stream, calculate the process control statistics and control limits, and complete the drawing of the control chart. The specific process of the SVM-WAMCUSUM chart algorithm is as follows:

[0088] Algorithm input: high-dimensional data stream Z t ∈{0,1}

[0089] 1. Initialize the original feature set S = {1, 2, K, p} and the feature sorting set R = [].

[0090] 2. Loop the following process until S = []:

[0091] (a) Obtain training samples of the candidate feature set;

[0092] (b) Select a suitable kernel function and train the SVM classifier according to formula (1) to obtain ω;

[0093] (c) Calculate feature scores i=1,2,K,|S|,find the feature with the smallest score d=argmin i c i ;

[0094] (d) Update the feature set R = [d, R] and delete feature d from S;

[0095] 3. According to the first k features of the feature sorting set R, the corresponding training samples are combined into the data set Y;

[0096] 4. Based on Y, use formula (5) to calculate an unbiased estimator of drift δ

[0097] 5. Add Y and Substitute into the WACMCUSUM and WAPMCUSUM charts respectively, calculate the process control statistics and control limits, and draw the control chart.

[0098] (a) Calculate the WACMCUSUM graph statistic corresponding to Y. Substituting into formula (6) we get A t . Calculate statistics and control limit H, if e t >H, start the out-of-control signal.

[0099] (b) Calculate the WAPMCUSUM graph statistic corresponding to Y. Substituting into formula (7) we get C t and n t . Calculate statistics and control limit H, if E t >H, start the out-of-control signal.

[0100] In a specific embodiment, by generating a high-dimensional data stream of a steady-state process, it is assumed that the high-dimensional data stream obeys a multivariate normal distribution X:N P (μ 0 ,∑ 0 ), 500 observations are randomly sampled to form a steady-state process data set, where μ 0 =0,∑ 0 =I; The second part generates a high-dimensional data stream of the out-of-control process, assuming that the high-dimensional data stream obeys the multivariate normal distribution X:N P (μ 1 ,∑ 0 ), randomly sample 500 observations as the out-of-control process data set, where μ 1 is the out-of-control process mean, is μ 0 Randomly sample a mean value and add a drift δ μ Combined with the model characteristics of the high-dimensional data stream anomaly monitoring method provided by this application, the continuous data stream dimension p, the number of features k retained, and the minimum drift value δ to be protected in the high-dimensional data stream are changed respectively. min The three parameters are used to observe the changes in the monitoring performance of the PCA-WAMCUSUM and SVM-WAMCUSUM graphs. In order to better illustrate the simulation results, ARL and SDRL are used as evaluation indicators, and the ARL of the steady-state process is 0 Fixed to 370. Set the drift amount δ μ =0(0.25)3, number of iterations T=1000.

[0101] Tables 1 and 2 show the simulation results of SVM-WACMCUSUM and SVM-WAPMCUSUM respectively when the data stream dimension p is different in the high-dimensional data stream. Set the continuous data stream dimension p in the high-dimensional data stream to 100, 200, 300, 400, the number of features retained in the dimensionality reduction process k = 10, and the minimum drift value δ to be protected min = 0.25. In the simulation results, the change of the data flow dimension p value gives the average run length (ARL) of the out-of-control process of the SVM-WAMCUSUM graph. 1 ) and the standard mean run length (SDRL) of the out-of-control process 1 ) caused by the difference.

[0102] It can be seen from Tables 1 and 2 that when the dimension p of the continuous data stream remains unchanged, as the drift δ μThe average run length (ARL) of the out-of-control process of the two SVM-WAMCUSUM graphs increases. 1 ) will decrease accordingly, and vice versa. The standard mean run length (SDRL) of the out-of-control process 1 ) also has the same performance. Fixed drift δ μ As the continuous data stream dimension p increases, the average run length (ARL) of the out-of-control process of the two SVM-WAMCUSUM graphs increases. 1 ) fluctuates back and forth and tends to increase; the standard average run length (SDRL) of the out-of-control process of the SVM-WACMCUSUM graph 1 ) has no uniform trend, while the standard average run length (SDRL) of the out-of-control process of SVM-WAPMCUSUM 1 ) tends to increase. For example, for the SVM-WAPMCUSUM graph, in the continuous data stream dimension p = 100, 200, 300, the drift δ μ = 0.5 when the average run length of the out-of-control process (ARL 1 ) and the standard mean run length (SDRL) of the out-of-control process 1 ) values ​​are 29.19 (18.58), 26.95 (19.23), and 27.7 (17.24), respectively. Comparison of the average run length (ARL) of the out-of-control process of the two SVM-WAMCUSUM graphs 1 ) and the standard mean run length (SDRL) of the out-of-control process 1 ), as the continuous data stream dimension p increases, the average run length (ARL) of the out-of-control process of the SVM-WACMCUSUM graph at the beginning 1 ) is large until the drift δ μ =2 The average run length (ARL) of the out-of-control process of SVM-WAPMCUSUM diagram 1 ) begins to exceed the average run length (ARL) of the out-of-control process in the SVM-WACMCUSUM graph 1 ).

[0103] Table 1 Simulation results of SVM-WACMCUSUM graph when the dimensions of continuous data stream are different

[0104]

[0105] Table 2 Simulation results of SVM-WAPMCUSUM graph when the continuous data stream dimensions are different

[0106]

[0107]

[0108] Figure 3The drift minimum δ is shown respectively. min The influence of different values ​​of on the SVM-WACMCUSUM graph and SVM-WAPMCUSUM graph. min = 0.25, 0.5, 0.75, 1, the continuous data stream dimension p = 100, and the number of retained features k = 10. Figure 3 It can be seen that the fixed drift δ μ After that, as the drift minimum δ min For the SVM-WACMCUSUM graph, the minimum drift value δ min =0.25, the average run length of the out-of-control process (ARL 1 ) is the smallest, δ min =1 corresponds to 0, the average run length of the out-of-control process (ARL 1 ) is the largest, and in the other two cases, the drift δ μ ≤1 when δ min =0.5 corresponding to the average run length of the out-of-control process (ARL 1 ) is small, δ μ >1 hour δ min =0.75 corresponding to the average run length of the out-of-control process (ARL 1 ) is small; however, the SVM-WAPMCUSUM graph is different, the average run length of the out-of-control process (ARL 1 ) increases with the drift minimum value δ min In addition, the SVM-WACMCUSUM graph shows different drift minimum values ​​δ min The corresponding curve is at drift δ μ =2.5, they tend to overlap. The SVM-WAPMCUSUM graph has different minimum drift values ​​δ min The corresponding curve is in the drift δ μ =1.25, they tend to coincide. In comparison, for different drift minimum values ​​δ min , the average run length (ARL) of the out-of-control process of SVM-WACMCUSUM graph 1 ) values ​​are smaller, and the average run length (ARL) of the out-of-control process of SVM-WAPMCUSUM graph 1 ) values ​​have a large gap.

[0109] Further references Figure 4 As an implementation of the above method, the present application provides an embodiment of a high-dimensional data flow anomaly monitoring system based on a SVM-WAMCUSUM control graph. Figure 1 Corresponding to the method embodiment shown, the system can be specifically applied to various electronic devices. The system 200 includes the following modules:

[0110] Acquisition module 210, used to acquire high-dimensional data stream Z t ∈{0,1}, divide the high-dimensional data stream according to the category information to obtain the original feature set S = {1,2,K,p}; and

[0111] A training module 220 is used to train the support vector machine (SVM) classifier according to the original feature set to obtain an optimal classification hyperplane function of the support vector machine (SVM) classifier; and

[0112] A sorting module 230 is used to calculate the score of each feature using the optimal classification hyperplane function, and sort the features to obtain a feature sorting set, continuously delete the features with the smallest scores and update the feature sorting set, and use the remaining features to train the support vector machine SVM classifier again until all features are screened and the cycle ends, and outputs a final feature sorting set; and

[0113] An extraction module 240 is used to retain the top k features in the final feature ranking set, and to form a data set Y with the training samples corresponding to the k features; and

[0114] Control module 250, used to calculate an unbiased estimator of drift δ based on data set Y And the data set Y and the unbiased estimator Substitute them into the WACMCUSUM chart and WAPMCUSUM chart respectively, calculate the process control statistics and control limits, and finally complete the drawing of the control chart. When the statistics are greater than the control limit, the control chart activates the out-of-control signal.

[0115] The present application also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, any of the above methods is implemented.

[0116] like Figure 5 As shown, the computer system 500 includes a central processing unit (CPU) 501, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 502 or a program loaded from a storage part 508 into a random access memory (RAM) 503. In the RAM 503, various programs and data required for the operation of the system 500 are also stored. The CPU 501, the ROM 502, and the RAM 503 are connected to each other via a bus 504. An input / output (I / O) interface 505 is also connected to the bus 504.

[0117] The following components are connected to the I / O interface 505: an input section 506 including a keyboard, a mouse, etc.; an output section 507 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN card, a modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to the I / O interface 505 as needed. A removable medium 511, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 510 as needed, so that a computer program read therefrom is installed into the storage section 508 as needed.

[0118] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 509, and / or installed from the removable medium 511. When the computer program is executed by the central processing unit (CPU) 501, the above functions defined in the method of the present application are executed. It should be noted that the computer-readable medium described in the present application can be a computer-readable signal medium or a computer-readable medium or any combination of the above two. The computer-readable medium can be, for example, - but not limited to - an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable media may include, but are not limited to, an electrical connection with one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, an apparatus or a device. In the present application, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium may also be any computer-readable medium other than a computer-readable medium, which may send, propagate, or transmit a program for use by or in combination with an instruction execution system, an apparatus or a device. The program code contained on the computer-readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0119] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0120] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0121] The modules involved in the embodiments described in the present application may be implemented by software or hardware. The modules described may also be set in a processor, for example, it may be described as: a processor includes an acquisition module, an analysis module, and an output module. The names of these modules do not, in some cases, constitute limitations on the modules themselves.

[0122] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A method for monitoring abnormalities in high-dimensional data streams, characterized in that: The following steps are involved: S110, obtain high-dimensional data stream X t represents the tth predictor variable in the high-dimensional data stream, Z t represents the t-th class variable in the high-dimensional data stream, n is the number of samples in the high-dimensional data stream, t∈[1,n] and t is an integer, and the high-dimensional data stream is divided according to the category information to obtain the original feature set S={1,2,…,p}, and p is the dimension of the continuous data stream in the high-dimensional data stream; S120, training a support vector machine (SVM) classifier according to the original feature set to obtain an optimal classification hyperplane function of the support vector machine (SVM) classifier; S130, using the optimal classification hyperplane function to calculate the score of each feature, and sorting to obtain a feature sorting set, continuously deleting the features with the smallest scores and updating the feature sorting set, and using the remaining features to train the support vector machine SVM classifier again until all features are screened, ending the loop and outputting the final feature sorting set; S140, retaining k features with the highest importance in the final feature ranking set, and forming a data set Y with training samples corresponding to the k features; as well as S150, calculating an unbiased estimator of drift δ according to the data set Y And the data set Y and the unbiased estimator Substitute into the WACMCUSUM chart and the WAPMCUSUM chart respectively, calculate the process control statistics and control limits, and finally complete the drawing of the control chart. When the statistics are greater than the control limit, the control chart starts the out-of-control signal.

2. The high-dimensional data flow anomaly monitoring method according to claim 1, characterized in that: Also includes the given Among them, x i ∈R d is the predictor variable, y i ∈{0,1} is a column of class variables, N is the number of samples, d is the number of sample features, and in step S120, the optimal classification hyperplane function of the support vector machine SVM classifier is obtained by solving formula (1): where ||·|| is the Euclidean norm, ξ i is a slack variable, c is a user-specified positive penalty factor that controls the weights of both classification error and interval size, is the value of x mapped to a higher-dimensional feature space, ω is the d-dimensional normal vector orthogonal to the classification hyperplane, which determines the direction of the hyperplane, and b is the deviation term, which determines the distance between the hyperplane and the origin. The obtained high-dimensional data stream When X t In steady state process Z t =0; when X t When in the process of losing control t =1, X t and Z t Substitute into formula (1) and solve the formula to obtain ω.

3. The high-dimensional data flow abnormality monitoring method according to claim 2 is characterized in that: Considering the dual problem as a quadratic programming problem, we can solve formula (1): Among them, α i is the Lagrange multiplier, α i ≠0 corresponding to the input data x i It plays a major role in the decision function and is called support vector SVs; It is the kernel function used by the support vector machine SVM classifier, representing the special similarity between input features; The expression of the kernel function is: Among them, σ 2 is the diffusion parameter, which determines the performance of the support vector machine (SVM) classifier.

4. The high-dimensional data flow anomaly monitoring method according to claim 2, characterized in that: In step S130, the score of each feature is calculated using the optimal classification hyperplane function, and the score formula is: Among them, ω i It is the d-dimensional normal vector corresponding to feature i and orthogonal to the classification hyperplane.

5. The high-dimensional data flow anomaly monitoring method according to claim 1, characterized in that: In step S150, an unbiased estimator of the drift δ is calculated based on the data set Y. The formula used is: Among them, μ0 is the mean vector of the steady-state process, Y t is the tth data in the data set Y, δ min is the minimum value of drift δ that needs to be protected, and k is the number of features ranked high in importance in the feature ranking set.

6. The high-dimensional data flow anomaly monitoring method according to claim 1, characterized in that: In step S150, the data set Y and the unbiased estimator Substituting into the WACMCUSUM chart to calculate the process control statistics and control limits uses the following formula: Among them, A0=0, Y t is the tth data in the data set Y, let e t is the statistic of the WACMCUSUM chart. The control limit H is calculated based on the Monte Carlo simulation. When e t >H, the control chart starts the out-of-control signal.

7. The high-dimensional data flow anomaly monitoring method according to claim 1, characterized in that: In step S150, the data set Y and the unbiased estimator Substituting into the WAPMCUSUM chart to calculate the process control statistics and control limits uses the following formula: Y t is the tth data in the data set Y, let E t is the statistic of the WAPMCUSUM chart. The control limit H is calculated based on the Monte Carlo simulation. When E t >H, the control chart starts the out-of-control signal.

8. A high-dimensional data flow anomaly monitoring system, characterized in that: Includes the following modules: Acquisition module to obtain high-dimensional data stream X t represents the tth predictor variable in the high-dimensional data stream, Z t represents the t-th class variable in the high-dimensional data stream, n is the number of samples in the high-dimensional data stream, t∈[1,n] and t is an integer, and the high-dimensional data stream is divided according to the category information to obtain the original feature set S={1,2,…,p}, and p is the dimension of the continuous data stream in the high-dimensional data stream; as well as A training module, used to train a support vector machine (SVM) classifier according to the original feature set to obtain an optimal classification hyperplane function of the support vector machine (SVM) classifier; as well as A sorting module is used to calculate the score of each feature using the optimal classification hyperplane function, and sort them to obtain a feature sorting set, continuously delete the feature with the smallest score and update the feature sorting set, and use the remaining features to train the support vector machine SVM classifier again until all features are screened and the cycle ends, and outputs the final feature sorting set; as well as An extraction module is used to retain the top k features in the final feature ranking set, and to form a data set Y with training samples corresponding to the k features; as well as A control module is used to calculate an unbiased estimator of the drift δ based on the data set Y And the data set Y and the unbiased estimator Substitute into the WACMCUSUM chart and the WAPMCUSUM chart respectively, calculate the process control statistics and control limits, and finally complete the drawing of the control chart. When the statistics are greater than the control limit, the control chart starts the out-of-control signal.

9. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

Images