Single-sensor anomaly detection method, device, computer device and storage medium

Abstract

Embodiments of the present invention disclose a single-sensor anomaly detection method, apparatus, computer device, and storage medium. The method includes: obtaining measurement values of a sensor to obtain data to be detected; inputting the data to be detected into an anomaly detection model to calculate an anomaly score to obtain a detection result; and outputting the detection result. Among them, the anomaly detection model is obtained by training an MCNN network with measurement values of a number of sensors with anomaly score labels as a sample set. By implementing the method of the embodiments of the present invention, the ability of feature expression can be enhanced, the accuracy of anomaly prediction can be improved, and the reduction error rate can be reduced.

Description

Technical Field

[0001] The present invention relates to sensors, and more particularly to a single-sensor anomaly detection method, apparatus, computer device, and storage medium. Background Art

[0002] The main principle of using AE (Auto-Encode) for anomaly detection is to utilize the reconstruction error and set corresponding error thresholds for anomaly detection.

[0003] However, in an unsupervised scenario, AE has no anomaly samples for learning, and the basic assumption of the algorithm is that anomaly points follow a different distribution. The auto-encoder trained based on normal data can reconstruct and restore normal samples. The original problem is a single time-series prediction problem, and for AE, the feature expression ability is insufficient to restore data points different from the normal distribution well, that is, the reconstruction loss based on AE leads to a large reduction error.

[0004] Therefore, it is necessary to design a method to enhance the feature expression ability, improve the anomaly prediction accuracy, and reduce the reduction error rate. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the prior art and provide a single-sensor anomaly detection method, apparatus, computer device, and storage medium.

[0006] To achieve the above object, the present invention adopts the following technical solutions: A single-sensor anomaly detection method, comprising:

[0007] Obtain the measurement values of the sensor to obtain the data to be detected;

[0008] Input the data to be detected into the anomaly detection model for anomaly score calculation to obtain the detection result;

[0009] Output the detection result;

[0010] Wherein, the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set.

[0011] Its further technical solution is: The MCNN network includes an input layer, a conversion layer, a convolutional pooling layer, a splicing layer, a deconvolutional pooling layer, a fully connected layer, and an output layer connected in sequence.

[0012] Its further technical solution is: The anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set, including:

[0013] Obtain the detection values of several sensors with anomaly score labels to obtain the sample set;

[0014] Construct the MCNN network;

[0015] Use the sample set to train the MCNN network to obtain a training result;

[0016] Calculate the loss value between the training result and the anomaly score label;

[0017] Determine whether the loss value tends to be stable;

[0018] If the loss value tends to be stable, determine the trained MCNN network as the anomaly detection model;

[0019] If the loss value does not tend to be stable, adjust the parameters of the MCNN network, and perform the training of the MCNN network using the sample set to obtain a training result.

[0020] Its further technical solution is: The training of the MCNN network using the sample set to obtain a training result includes:

[0021] Use the conversion layer to extract the original data and multi-frequency data from the sample set, downsample the sample set, and use VMD to extract the decomposition features to obtain the conversion data;

[0022] Pass the conversion data through the convolutional pooling layer for convolution and pooling, and splice it by the splicing layer to obtain a processing result;

[0023] Perform deconvolution on the processing result using the deconvolution pooling layer to obtain a deconvolution result;

[0024] Perform a full connection process on the deconvolution result using the full connection layer to obtain a training result.

[0025] Its further technical solution is: The calculation of the loss value between the training result and the anomaly score label includes:

[0026] Use the MSE loss function to calculate the loss value between the training result and the anomaly score label.

[0027] The present invention also provides a single-sensor anomaly detection device, including:

[0028] A data acquisition unit for acquiring the measurement value of the sensor to obtain the data to be detected;

[0029] An anomaly score calculation unit for inputting the data to be detected into the anomaly detection model to calculate the anomaly score to obtain a detection result;

[0030] An output unit for outputting the detection result.

[0031] Its further technical solution is: it further includes a model generation unit, which is used to train the MCNN network with the detection values of several sensors with abnormal score labels as a sample set to obtain an anomaly detection model.

[0032] Its further technical solution is: the model generation unit includes:

[0033] A sample set acquisition subunit, which is used to acquire the detection values of several sensors with abnormal score labels to obtain a sample set;

[0034] A network construction subunit, which is used to construct the MCNN network; a training subunit, which is used to train the MCNN network with the sample set to obtain a training result;

[0035] A calculation subunit, which is used to calculate the loss value between the training result and the abnormal score label;

[0036] A judgment subunit, which is used to judge whether the loss value tends to be stable; a determination subunit, which is used to determine the trained MCNN network as an anomaly detection model if the loss value tends to be stable;

[0037] An adjustment subunit, which is used to adjust the parameters of the MCNN network if the loss value does not tend to be stable, and execute the training of the MCNN network with the sample set to obtain a training result.

[0038] The present invention also provides a computer device, which includes a memory and a processor. A computer program is stored on the memory, and when the processor executes the computer program, the above method is implemented.

[0039] The present invention also provides a storage medium, which stores a computer program, and when the computer program is executed by a processor, the above method is implemented.

[0040] The beneficial effects of the present invention compared with the prior art are: the present invention obtains the data to be detected, inputs it into the anomaly detection model for anomaly score calculation, and outputs the detection result. The anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with abnormal score labels as a sample set. The MCNN algorithm is used to enhance the feature expression ability, achieve a better prediction effect, realize the enhancement of the feature expression ability, improve the anomaly prediction accuracy, and reduce the reduction error rate.

[0041] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. Description of the Drawings

[0042] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0043] Figure 1 Schematic diagram of the application scenario of the single-sensor anomaly detection method provided by the embodiment of the present invention;

[0044] Figure 2 Schematic diagram of the flow of the single-sensor anomaly detection method provided by the embodiment of the present invention;

[0045] Figure 3 Schematic diagram of the sub-process of the single-sensor anomaly detection method provided by the embodiment of the present invention;

[0046] Figure 4 Schematic diagram of the sub-process of the single-sensor anomaly detection method provided by the embodiment of the present invention;

[0047] Figure 5 Schematic diagram of the MCNN network provided by the embodiment of the present invention;

[0048] Figure 6 Schematic block diagram of the single-sensor anomaly detection device provided by the embodiment of the present invention;

[0049] Figure 7 Schematic block diagram of the computer device provided by the embodiment of the present invention. Detailed implementation manners

[0050] The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts fall within the protection scope of the present invention.

[0051] It should be understood that when used in this specification and the appended claims, the terms "comprises" and "comprising" indicate the presence of the described features, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components, and / or their combinations.

[0052] It should also be understood that the terms used in the specification of the present invention are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the specification of the present invention and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include the plural forms.

[0053] It should be further understood that the term "and / or" used in the specification of the present invention and the appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0054] Please refer to Figure 1 and Figure 2 , Figure 1 which is a schematic diagram of the application scenario of the single-sensor anomaly detection method provided by the embodiment of the present invention. Figure 2 which is a schematic flowchart of the single-sensor anomaly detection method provided by the embodiment of the present invention. This single-sensor anomaly detection method is applied to a server. The server interacts with sensors and terminals to obtain the data to be detected of the sensors, and then uses the trained MCNN (Multiple Convolutional Neural Network) network to calculate the anomaly score, and outputs the detection result to the terminal for display. The main work of the MCNN network is reflected in the feature extraction part, where the original one-dimensional single time series data is extracted by two strategies of multi-scale and multi-frequency until multi-dimensional features are extracted, and then the important local information in the features is extracted by a convolutional neural network, and then encoder reconstruction is performed.

[0055] Figure 2 is a schematic flowchart of the single-sensor anomaly detection method provided by the embodiment of the present invention. As Figure 2 shown, the method includes the following steps S110 to S130.

[0056] S110. Obtain the measured value of the sensor to obtain the data to be detected.

[0057] In this embodiment, the data to be detected refers to the measured value of the sensor. The data to be detected, that is, the input signal Y = [y 1 , y 2 ,..., y t , where t represents the time stamp, and y t represents the measured value of the sensor at time t.

[0058] S120. Input the data to be detected into the anomaly detection model to calculate the anomaly score to obtain the detection result.

[0059] In this embodiment, the detection result refers to the anomaly score corresponding to the data to be detected.

[0060] Among them, the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set.

[0061] In one embodiment, please refer to Figure 3 , the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set, and may include steps S121 to S127.

[0062] S121. Obtain the detection values of several sensors with anomaly score labels to obtain a sample set.

[0063] In this embodiment, the sample set refers to a data set composed of the detection values of several sensors with anomaly score labels.

[0064] S122. Construct an MCNN network.

[0065] In this embodiment, since the original problem is a single time series prediction problem and the feature expression ability for the model is insufficient, the MCNN algorithm is adopted in the model selection to enhance the feature expression ability and achieve a better prediction effect.

[0066] Specifically, as Figure 5 shown, the MCNN network includes an input layer, a conversion layer, a convolutional pooling layer, a splicing layer, a deconvolutional pooling layer, a fully connected layer, and an output layer connected in sequence.

[0067] S123. Use the sample set to train the MCNN network to obtain a training result.

[0068] In this embodiment, the training result refers to the anomaly score obtained by predicting the sample set through the MCNN network.

[0069] Specifically, the training result S = [s 1 , s 2 ,..., s T , T represents the timestamp, and s T represents the anomaly score at time T and time T - 1, that is, the probability that a certain data in the sample set belongs to an outlier.

[0070] In one embodiment, please refer to Figure 4 , step S123 above may include steps S1231 to S1234.

[0071] S1231. Use the conversion layer to extract the original data and multi-frequency data from the sample set, downsample the sample set, and use VMD to extract decomposition features to obtain conversion data.

[0072] In this embodiment, the conversion data includes four parts: the original data, i.e., the sample set, the multi-frequency data, the data obtained by downsampling, and the features obtained by decomposing the sample set using VMD.

[0073] S1232. Convolve and pool the conversion data through a convolutional pooling layer, and splice it by a splicing layer to obtain a processing result.

[0074] In this embodiment, the processing result refers to the result obtained by convolving, pooling, and splicing the conversion data.

[0075] The output of the conversion stage is separately convolved, pooled, and spliced. The network before splicing is equivalent to the encoding layer in AE.

[0076] S1233. Perform deconvolution on the processing result using a deconvolution pooling layer to obtain a deconvolution result.

[0077] In this embodiment, the deconvolution result refers to the result obtained by performing deconvolution on the spliced data once again.

[0078] S1234. Perform a fully connected process on the deconvolution result using a fully connected layer to obtain a training result.

[0079] Perform deconvolution on the spliced data once again and pass it through a fully connected layer. This part can be regarded as the decoding layer in AE, and the reconstruction result can be obtained That is, the anomaly score.

[0080] In the conversion stage of the sample set, the input is Y, and three parts of data are extracted. The first part is the initial data, the second part is the multi-frequency data, which refers to statistical features such as mean and standard deviation of the sample set in the form of a moving window, and the third part is the downsampling of the sample set. In this embodiment, in the conversion stage, VMD (Variational Mode Decomposition) is added as the fourth part of the features in the conversion stage. VMD is used to specifically decompose the signal into several subsequences to enhance the representation ability of the original signal. Then, the output of the conversion stage is separately convolved, pooled, and spliced. The network before splicing is equivalent to the encoding layer in AE. Perform deconvolution on the spliced data once again and pass it through a fully connected layer. This part can be regarded as the decoding layer in AE, and the reconstruction result can be obtained

[0081] S124. Calculate the loss value between the training result and the anomaly score label.

[0082] In this embodiment, the loss value refers to the degree of difference between the training result and the anomaly score label.

[0083] Specifically, the mean squared error (MSE) loss function is used to calculate the loss value between the training result and the anomaly score label. Since this is a regression problem, the MSE (Mean Square Error) is used as the optimization objective in the selection of the loss function, that is

[0084] S125. Determine whether the loss value tends to be stable;

[0085] S126. If the loss value tends to be stable, determine the trained MCNN network as the anomaly detection model;

[0086] S127. If the loss value does not tend to be stable, adjust the parameters of the MCNN network and execute step S123.

[0087] When the loss value tends to be stable, that is, tends to be unchanged, it indicates that the trained MCNN network has converged. At this time, it can be used as an anomaly detection model to calculate the anomaly scores for sensor monitoring, which has high accuracy, high precision, and high real-time performance. When the loss value does not tend to be stable, that is, does not tend to be unchanged, it indicates that the trained MCNN network has not converged, and the parameters need to be adjusted again for the next round of training.

[0088] In addition, during the training process, 60% of the sample set is used as the training data, 20% of the sample set is used as the validation set, and 20% of the sample set is used as the test set. Among them, the training data is mainly used to solve the model parameters, the validation set is used to select the optimal hyperparameters (generalization ability, fitting ability), and the test set is used to view the test performance of out-of-sample data.

[0089] This anomaly detection model draws on the idea of the AE. First, it uses a multi-scale and multi-frequency strategy to extract data features, then performs convolution and pooling operations, and finally has a fully connected layer. The principle of making anomaly judgments is the same, which is to use the reconstruction error for judgment.

[0090] S130. Output the detection result.

[0091] In this embodiment, the detection result is the anomaly score, that is, the anomaly scores of each data to be detected are output. Of course, a threshold can also be set, and the data to be detected corresponding to the anomaly score exceeding this threshold is an anomaly value.

[0092] The above single-sensor anomaly detection method obtains the data to be detected, inputs it into the anomaly detection model for anomaly score calculation, and outputs the detection result. The anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set. The MCNN algorithm is used to enhance the feature expression ability, achieve a better prediction effect, enhance the feature expression ability, improve the anomaly prediction accuracy, and reduce the reduction error rate.

[0093] Figure 6 It is a schematic block diagram of a single-sensor anomaly detection device 300 provided by an embodiment of the present invention. As Figure 6 shown, corresponding to the above single-sensor anomaly detection method, the present invention also provides a single-sensor anomaly detection device 300. The single-sensor anomaly detection device 300 includes a unit for executing the above single-sensor anomaly detection method, and the device can be configured in a server. Specifically, please refer to Figure 6 As shown, the single-sensor anomaly detection device 300 includes a data acquisition unit 301, an anomaly score calculation unit 302, and an output unit 303.

[0094] The data acquisition unit 301 is used to obtain the measurement value of the sensor to obtain the data to be detected; the anomaly score calculation unit 302 is used to input the data to be detected into the anomaly detection model for anomaly score calculation to obtain the detection result; the output unit 303 is used to output the detection result.

[0095] In one embodiment, the single-sensor anomaly detection device 300 further includes a model generation unit for training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set to obtain an anomaly detection model.

[0096] In one embodiment, the model generation unit includes a sample set acquisition subunit, a network construction subunit, a training subunit, a calculation subunit, a judgment subunit, a determination subunit, and an adjustment subunit.

[0097] The sample set acquisition subunit is used to obtain the detection values of several sensors with anomaly score labels to obtain a sample set; the network construction subunit is used to construct an MCNN network; the training subunit is used to train the MCNN network with the sample set to obtain a training result; the calculation subunit is used to calculate the loss value between the training result and the anomaly score label; the judgment subunit is used to judge whether the loss value tends to be stable; the determination subunit is used to determine the trained MCNN network as the anomaly detection model if the loss value tends to be stable; the adjustment subunit is used to adjust the parameters of the MCNN network if the loss value does not tend to be stable, and execute the training of the MCNN network with the sample set to obtain a training result.

[0098] In one embodiment, the training subunit includes a conversion module, a processing module, a deconvolution module, and a fully connected module.

[0099] The conversion module is configured to extract original data and multi-frequency data from the sample set by using a conversion layer, downsample the sample set, and extract decomposition features by using VMD to obtain conversion data; the processing module is configured to perform convolution and pooling on the conversion data through a convolutional pooling layer and perform splicing by a splicing layer to obtain a processing result; the deconvolution module is configured to perform deconvolution on the processing result through a deconvolution pooling layer to obtain a deconvolution result; the fully connected module is configured to perform a fully connected process on the deconvolution result through a fully connected layer to obtain a training result.

[0100] In one embodiment, the calculation subunit is configured to calculate a loss value between the training result and the anomaly score label by using an MSE loss function.

[0101] It should be noted that those skilled in the art can clearly understand the specific implementation processes of the above single-sensor anomaly detection device 300 and each unit, which can refer to the corresponding descriptions in the foregoing method embodiments. For the sake of convenience and brevity of description, they will not be elaborated here.

[0102] The above single-sensor anomaly detection device 300 can be implemented in the form of a computer program, and the computer program can run on a computer device as shown in Figure 7 shown.

[0103] Please refer to Figure 7 , Figure 7 which is a schematic block diagram of a computer device provided by an embodiment of the present application. The computer device 500 may be a server. Among them, the server may be an independent server or a server cluster composed of multiple servers.

[0104] Referring to Figure 7 , the computer device 500 includes a processor 502, a memory, and a network interface 505 connected through a system bus 501. Among them, the memory may include a non-volatile storage medium 503 and an internal memory 504.

[0105] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, and when the program instructions are executed, the processor 502 can be caused to execute a single-sensor anomaly detection method.

[0106] The processor 502 is configured to provide computing and control capabilities to support the operation of the entire computer device 500.

[0107] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503. When the computer program 5032 is executed by the processor 502, the processor 502 can be caused to execute a single-sensor anomaly detection method.

[0108] The network interface 505 is used for network communication with other devices. Those skilled in the art can understand that Figure 7 the structure shown in is only a block diagram of some structures related to the solution of the present application, and does not constitute a limitation on the computer device 500 to which the solution of the present application is applied. The specific computer device 500 may include more or fewer components than those shown in the figure, or combine some components, or have different component arrangements.

[0109] Among them, the processor 502 is used to run the computer program 5032 stored in the memory to implement the following steps:

[0110] Obtain the measurement value of the sensor to obtain the data to be detected; input the data to be detected into the anomaly detection model for anomaly score calculation to obtain the detection result; output the detection result;

[0111] Among them, the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set.

[0112] The MCNN network includes an input layer, a conversion layer, a convolutional pooling layer, a splicing layer, a deconvolutional pooling layer, a fully connected layer, and an output layer connected in sequence.

[0113] In one embodiment, when the processor 502 implements the step that the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set, the following steps are specifically implemented:

[0114] Obtain the detection values of several sensors with anomaly score labels to obtain the sample set; construct the MCNN network; use the sample set to train the MCNN network to obtain the training result; calculate the loss value between the training result and the anomaly score label; determine whether the loss value tends to be stable; if the loss value tends to be stable, determine the trained MCNN network as the anomaly detection model; if the loss value does not tend to be stable, adjust the parameters of the MCNN network, and execute the step of using the sample set to train the MCNN network to obtain the training result.

[0115] In one embodiment, when the processor 502 implements the step of using the sample set to train the MCNN network to obtain the training result, the following steps are specifically implemented:

[0116] The original data and multi-frequency data are extracted from the sample set by using a conversion layer, the sample set is downsampled, and the variational mode decomposition (VMD) is used to extract decomposition features to obtain conversion data; the conversion data is convolved and pooled through a convolutional pooling layer and then concatenated by a concatenation layer to obtain a processing result; the processing result is deconvolved by a deconvolution pooling layer to obtain a deconvolution result; and the deconvolution result is fully connected through a fully connected layer to obtain a training result.

[0117] In one embodiment, when the processor 502 implements the step of calculating the loss value between the training result and the anomaly score label, the specific implementation is as follows:

[0118] The mean squared error (MSE) loss function is used to calculate the loss value between the training result and the anomaly score label.

[0119] It should be understood that in the embodiments of the present application, the processor 502 may be a central processing unit (CPU), and the processor 502 may also be other general-purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0120] Those of ordinary skill in the art can understand that all or part of the processes in the methods of the above embodiments can be completed by instructing relevant hardware through a computer program. The computer program includes program instructions, and the computer program can be stored in a storage medium, and the storage medium is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the embodiments of the above methods.

[0121] Therefore, the present invention also provides a storage medium. The storage medium may be a computer-readable storage medium. The storage medium stores a computer program, and when the computer program is executed by a processor, the processor executes the following steps:

[0122] Obtain the measurement value of the sensor to obtain the data to be detected; input the data to be detected into the anomaly detection model to calculate the anomaly score to obtain a detection result; output the detection result.

[0123] Among them, the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set.

[0124] The MCNN network includes an input layer, a conversion layer, a convolutional pooling layer, a splicing layer, a deconvolutional pooling layer, a fully connected layer, and an output layer connected in sequence.

[0125] In one embodiment, when the processor executes the computer program to implement the step of obtaining the anomaly detection model by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set, the specific implementation steps are as follows:

[0126] Obtain the detection values of several sensors with anomaly score labels to obtain a sample set; construct an MCNN network; use the sample set to train the MCNN network to obtain a training result; calculate the loss value between the training result and the anomaly score label; determine whether the loss value tends to be stable; if the loss value tends to be stable, determine the trained MCNN network as the anomaly detection model; if the loss value does not tend to be stable, adjust the parameters of the MCNN network, and execute the step of using the sample set to train the MCNN network to obtain a training result.

[0127] In one embodiment, when the processor executes the computer program to implement the step of using the sample set to train the MCNN network to obtain a training result, the specific implementation steps are as follows:

[0128] Use the conversion layer to extract the original data and multi-frequency data from the sample set, downsample the sample set, and use VMD to extract the decomposition features to obtain the conversion data; pass the conversion data through the convolutional pooling layer for convolution and pooling, and splice it by the splicing layer to obtain a processing result; perform deconvolution on the processing result using the deconvolutional pooling layer to obtain a deconvolution result; perform a fully connected process on the deconvolution result using the fully connected layer to obtain a training result.

[0129] In one embodiment, when the processor executes the computer program to implement the step of calculating the loss value between the training result and the anomaly score label, the specific implementation steps are as follows:

[0130] Use the MSE loss function to calculate the loss value between the training result and the anomaly score label.

[0131] The storage medium can be various computer-readable storage media such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a magnetic disk, or an optical disc that can store program codes.

[0132] Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described according to functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of the present invention.

[0133] In several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of each unit is only a logical function division, and there can be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0134] The steps in the method embodiments of the present invention can be adjusted, combined, and deleted according to actual needs. The units in the device embodiments of the present invention can be combined, divided, and deleted according to actual needs. In addition, the functional units in each embodiment of the present invention can be integrated into a processing unit, or each unit can exist physically alone, or two or more units can be integrated into one unit.

[0135] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a storage medium. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the methods described in each embodiment of the present invention.

[0136] As described above, the above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should all be covered by the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the protection scope of the claims.

Claims

1. Single-sensor anomaly detection method, Characterized in that, Comprising: Obtain the measurement value of the sensor to obtain the data to be detected; Input the data to be detected into the anomaly detection model for anomaly score calculation to obtain the detection result; Output the detection result; Wherein, the anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set; The MCNN network includes an input layer, a conversion layer, a convolutional pooling layer, a splicing layer, a deconvolutional pooling layer, a fully connected layer, and an output layer connected in sequence; The anomaly detection model is obtained by training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set, including: Obtain the detection values of several sensors with anomaly score labels to obtain the sample set; Construct the MCNN network; Use the sample set to train the MCNN network to obtain the training result; Calculate the loss value between the training result and the anomaly score label; Judge whether the loss value tends to be stable; If the loss value tends to be stable, determine the trained MCNN network as the anomaly detection model; If the loss value does not tend to be stable, adjust the parameters of the MCNN network, and execute the step of using the sample set to train the MCNN network to obtain the training result; The step of using the sample set to train the MCNN network to obtain the training result includes: Use the conversion layer to extract the original data and multi-frequency data from the sample set, downsample the sample set, and use VMD to extract the decomposition features to obtain the conversion data; Pass the conversion data through the convolutional pooling layer for convolution and pooling, and splice it by the splicing layer to obtain the processing result; Perform deconvolution on the processing result using the deconvolutional pooling layer to obtain the deconvolution result; Perform full connection processing on the deconvolution result using the fully connected layer to obtain the training result.

2. The single-sensor anomaly detection method according to claim 1, Characterized in that, The step of calculating the loss value between the training result and the anomaly score label includes: Use the MSE loss function to calculate the loss value between the training result and the anomaly score label.

3. Single-sensor anomaly detection device, Characterized in that, Comprising: A data acquisition unit for obtaining the measurement value of the sensor to obtain the data to be detected; An anomaly score calculation unit for inputting the data to be detected into the anomaly detection model for anomaly score calculation to obtain the detection result; An output unit for outputting the detection result; It further includes a model generation unit for training the MCNN network with the detection values of several sensors with anomaly score labels as the sample set to obtain the anomaly detection model; The model generation unit includes: A sample set acquisition subunit for obtaining the detection values of several sensors with anomaly score labels to obtain the sample set; A network construction subunit for constructing the MCNN network; a training subunit for using the sample set to train the MCNN network to obtain the training result; A calculation subunit for calculating the loss value between the training result and the anomaly score label; A judgment subunit, configured to judge whether the loss value tends to be stable; a determination subunit, configured to, if the loss value tends to be stable, determine the trained MCNN network as an anomaly detection model; An adjustment subunit, configured to, if the loss value does not tend to be stable, adjust the parameters of the MCNN network, and execute the training of the MCNN network using the sample set to obtain a training result; The training subunit includes a conversion module, a processing module, a deconvolution module, and a fully connected module; The conversion module is configured to use a conversion layer to extract original data and multi-frequency data from the sample set, downsample the sample set, and use VMD to extract decomposition features to obtain conversion data; the processing module is configured to perform convolution and pooling on the conversion data through a convolutional pooling layer, and perform splicing by a splicing layer to obtain a processing result; the deconvolution module is configured to perform deconvolution on the processing result through a deconvolution pooling layer to obtain a deconvolution result; the fully connected module is configured to perform a fully connected process on the deconvolution result through a fully connected layer to obtain a training result.

4. A computer device, characterized in that, the computer device includes a memory and a processor, a computer program is stored on the memory, and when the processor executes the computer program, the method according to any one of claims 1 to 2 is implemented.

5. A storage medium, characterized in that, the storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 2 is implemented.

Images