A representation method of time series data and knowledge fusion for abnormal monitoring of industrial equipment

Abstract

The present invention belongs to the field of abnormal monitoring of industrial equipment, and proposes a time series data and knowledge fusion representation method for abnormal monitoring of industrial equipment. It is characterized by comprising the following steps: step 1. preprocessing; step 2. constructing a multi-layer association map of "equipment-event-state", and updating it by introducing data association, time association, and prior association; step 3. network representation learning. It solves the shortcomings of traditional equipment databases that are highly professional and weak in adaptability, and provides new ideas and solutions for the automated processing of data in industrial Internet scenarios.

Description

Technical Field

[0001] The present invention belongs to the field of industrial equipment anomaly monitoring, and in particular relates to a time series data and knowledge fusion representation method for industrial equipment anomaly monitoring. Background Art

[0002] The quality of features will directly affect the performance of the model. In machine learning tasks, this is usually the most time-consuming step and requires the most expertise in the relevant field. If there is a better expression of the original data after refinement, it can often make subsequent tasks more efficient. That is, find a better way to process the original data to facilitate the use of subsequent tasks.

[0003] In the field of industrial big data, the existing traditional approach to feature processing technology is mainly based on relational databases, and is carried out by experts in the field in the form of manual construction combined with business knowledge. This approach has the following problems: (1) The data volume is large, and relying solely on manual feature engineering is time-consuming and labor-intensive, resulting in serious loss of relevance and a lack of a data stratification standard suitable for industrial scenarios; (2) The effectiveness of expert knowledge is limited, and the degree of integration with the original data of the equipment is low. Summary of the invention

[0004] In view of the problems of the prior art, the present invention designs a fusion representation method that can make full use of the business knowledge association and data information association of the equipment, uses the association graph technology to represent the relational equipment data in the form of a graph, and designs an association graph with a multi-layer deep perception structure of "equipment-event-state". It fully mines the associated information and utilizes expert knowledge to achieve a full integration of expert knowledge and data; then uses a network representation method to learn the vector representation of each node of the knowledge graph network. These vectors maintain the structural characteristics of the original network and implicitly contain potential characteristics that are beneficial to equipment anomaly detection, providing features with both depth and breadth for subsequent abnormal monitoring tasks of industrial equipment.

[0005] Technical Solution

[0006] A time series data and knowledge fusion representation method for abnormal monitoring of industrial equipment, characterized by comprising the following steps:

[0007] Step 1. Preprocessing

[0008] Step 1.1 Divide and collect raw data

[0009] Divide industrial equipment into functional units and collect the required raw data according to the functional units;

[0010] Step 1.2 Preprocessing

[0011] Most of the raw data collected by the functional units are incomplete, inconsistent and dirty data, which cannot be directly used in the model calculation. Therefore, the raw data is preprocessed. Specifically, the noisy raw data is first smoothed, and then the related data is integrated according to the function.

[0012] Step 1.3 Discretization

[0013] Discretize all attributes in the original industrial equipment event data; the details are as follows:

[0014] For discrete data, retain its original discreteness; for continuous data, set basic units according to business characteristics, quantify the original attribute values ​​into multiples of the basic units, and turn them into discrete data.

[0015] Step 2. Build a multi-layer association graph of "device-event-state" and update it by introducing data association, time association, and prior association

[0016] Step 2.1: Construct a multi-level fusion hierarchical correlation map for the data after preprocessing

[0017] The hierarchical association graph is divided into a graph device layer, a graph event layer and a graph status layer:

[0018] The graph device layer is a space composed of different devices, that is, D = {a1, a2, ..., b1, b2, ...}, where a1, a2, ..., b1, b2, ... are different meta-devices;

[0019] The graph event layer is a sequence space composed of different events that occur, that is, E = {e1, e2, e3, ...}, where e1, e2, e3, ... represent indivisible meta-events related to the device, and the event types include normal events and abnormal events;

[0020] The graph state layer is a space composed of different features of the device, that is, A = {n1,n2,…,T1,T2,…,i1,i2,…}. Among them, n1,n2,…,T1,T2,…,i1,i2,… are different meta-states;

[0021] Traverse the device nodes in the graph device layer and connect them with all normal event nodes in the graph event layer through directed edges. The weight of the directed edge is set to the time when the normal event occurs (D→E).

[0022] Traverse the device nodes in the graph device layer, connect all abnormal event nodes in the graph event layer with the corresponding nodes in the device layer through directed edges, and set the directed edge weight to the time when the abnormal event occurred (E→D);

[0023] Traverse the event nodes in the graph event layer, connect the event nodes with all the associated state nodes in the graph state layer through directed edges, and set the directed edge weight to the function module type to which the state belongs. The function module type needs to be uniformly coded (E→A);

[0024] Traverse the event nodes in the graph event layer, connect the event node with other event nodes with dependencies through directed edges, and set the weight of the directed edge to the time interval between the two events (E→E);

[0025] In this way, the obtained layered graph can be expressed as

[0026] G1=(V1,R1),

[0027] The node set V1=D∪E∪A,

[0028] The directed edge set R1 = D→E∪E→D∪E→A∪E→E,

[0029] Among them, D→E represents the set of directed edges from the device layer to the event layer, E→D represents the set of directed edges from the event layer to the device layer, E→A represents the set of directed edges from the event layer to the state layer, and E→E represents the set of directed edges between events.

[0030] Step 2.2 introduces data association, time association, and prior association to update the "device-event-state" multi-layer association graph, and models the association and probability distribution between devices to obtain a complete probability graph model.

[0031] Step 2.2.1: By statistically analyzing the features of the preprocessed raw data and supplementing it with historical experience knowledge, data association on the state layer is introduced, relevant devices in the historical data are introduced, and the node set V1 is updated to obtain a new set V2;

[0032] Step 2.2.2 The present invention further enriches the association information between the device layer and the event layer by introducing time association;

[0033] Specifically, whenever an event of the device occurs at t i At the moment of occurrence, connect the corresponding device node and event node, and assign corresponding weight t to the corresponding edge i , and update the related edges in D→E and E→D; the set of edges after update is R2; the association graph after introducing time association can be expressed as:

[0034] G2=(V2,R2), where V2 and R2 have the same meanings as V1 and R1.

[0035] Step 2.2.3: The expert knowledge is integrated into the Bayesian network model to obtain a complete probability graph model based on the correlation and probability distribution between devices.

[0036] The present invention uses expert knowledge to fuse the Bayesian network model, integrates the knowledge of multiple field experts, and obtains a network structure G3=(V3,R3) containing prior knowledge through decision-making, eliminating most impossible network structures; where V3={S1,S2,...,S n} represents a set of device states S n The random characteristic variables (variable sequence) of R3 represent the set of directed edges, where V3 and R3 have the same meaning as V1 and R1.

[0037] Because there may be situations where expert opinions are inconsistent and there are implicit associations that cannot be included in expert knowledge, the network structure obtained by expert knowledge is not the final network structure. It is necessary to use a learning algorithm (such as the K2 algorithm) to process V3 to obtain a more accurate structural expression and obtain the final network structure G4 = (V4, R4), where V4 and R4 have the same meaning as V1 and R1.

[0038] Finally, G4 = (V4, R4) is used to update G2 = (V2, R2): for nodes that do not appear in V2, V2 is updated using the node set of V4, edges that exist in R2 but not in R4 are deleted, and edges that do not exist in R2 but in R4 are supplemented. Finally, a multi-layer association graph G5 = (V5, R5) is obtained, where V5 and R5 have the same meaning as V1 and R1.

[0039] Step 3. Network representation learning

[0040] Based on the information network graph G5 constructed in the above steps, we first obtain the adjacency matrix Z of the device-event-state nodes in G5, and then obtain the degree matrix Then, a heterogeneous network representation learning method is used to learn features through multiple graph convolution layers, as shown in formula (1);

[0041]

[0042] in,

[0043] W (l) is the weight matrix, initialized with random values, and is a trainable parameter matrix.

[0044] H (l) is the input vector, H (0) Sampling the graph via random walks (prior art) from G5,

[0045] l represents the lth layer of the neural network,

[0046] σ represents the activation function (such as Sigmoid function),

[0047] I n is the identity matrix;

[0048] In the implementation, the number of layers L of the neural network is determined according to the requirements and complexity, and the final feature representation H is obtained by superimposing multiple convolutional layers using the above formula. (L) .

[0049] Furthermore, the specific construction method of step 2.2.3 is as follows:

[0050] ① Assume that there is a dependency relationship between any two variables in the selected variable sequence, and through S i →S j With S j →S i Connect these variables to obtain the complete latent graph G′;

[0051] ②Based on variable sequence S n Involving equipment information, multiple experts are selected to analyze any set of variables S and S in the potential graph G′ in step ① based on their own business knowledge. j The credibility of the causal relationship between them is assigned and the expert credibility is obtained.

[0052] ③ According to m(A)=K∑m1(A1)m2(A2)…m n (A n ) fuses the expert knowledge, determines the causal relationship between variables, prunes the complete latent graph G′ in step ②, and obtains G3=(V3,R3); where: K=(1-∑m1(A1)m2(A2)…m n (A n )) -1 And A1∩A2∩…∩A n =A, A is the included assumption, A n is the hypothesis of the nth expert;

[0053] ④ Use the K2 learning algorithm to further search for a better network structure in the remaining search space, and input the variable sequence {S1, S2, …, S t}, there are t variables in total, and the upper limit value k of the parent node of the variable sequence (k is a positive integer);

[0054] ⑤For each variable S in step ④ i, starting from an empty node set, the pruned potential graph G3 and the scoring function F are obtained according to step ③ to calculate the score of the candidate parent node combination, and the number of parent nodes is gradually increased. When the number of parent nodes is increased but the score does not increase or the number of parent nodes reaches k, the algorithm ends and finally obtains G4. The scoring function F is as shown in formula (3)

[0055]

[0056] in, In the formula, Π(s i ) is node s i The combination of parent nodes, is the number of combinations under the value conditions, r i Represents node s i The number of possible states, q i Indicates i The number of states of the parent node; N ijk Represents node s i The number of combinations where the i-th value is taken and its parent node takes the j-th value,

[0057] Beneficial Effects

[0058] The network representation learning method based on association graph proposed in this paper solves the shortcomings of traditional equipment databases, which are highly specialized and weakly adaptable, and provides new ideas and solutions for the automated processing of data in industrial Internet scenarios:

[0059] 1. A method for hierarchical and structured processing of complex data of industrial equipment is proposed, which effectively solves the limitations of traditional manual feature extraction methods and optimizes the retention of related information.

[0060] 2. The information of multi-layer association graphs is enhanced in the form of data association, time association, and prior association, which promotes the deep integration of expert knowledge and equipment raw data. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 Flow chart of the time series data and knowledge fusion characterization method for abnormal monitoring of industrial equipment in the present invention;

[0062] Figure 2 The architecture diagram of the time series data and knowledge fusion characterization method for abnormal monitoring of industrial equipment in the present invention;

[0063] Figure 3 The Bayesian network of the present invention introduces expert knowledge schematic diagram by prior association;

[0064] Figure 4 Flow chart of expert knowledge fusion Bayesian network structure modeling in this embodiment. DETAILED DESCRIPTION

[0065] The technical solution provided by the present application will be further described below in conjunction with specific embodiments and accompanying drawings. The advantages and features of the present application will become more apparent with the following description.

[0066] It should be noted that the embodiments of the present application have better practicability and are not any form of limitation to the present application. The technical features or combinations of technical features described in the embodiments of the present application should not be considered to be isolated, and they can be combined with each other to achieve better technical effects. The scope of the preferred implementation of the present application may also include other implementations, and this should be understood by those skilled in the art of the present application embodiment.

[0067] Example 1

[0068] This example uses the power plant dataset as the research object, such as Figure 1 The processing process includes the following steps:

[0069] Step 1: Preprocessing

[0070] The preprocessing process is to process the raw data and store it in an appropriate way so that the data can be better used for model training. The mean and median are used to supplement the missing values, and then the formula (X i -μ) / σ for standardization, where X i is the attribute to be standardized, μ is the attribute X i The mean of the attribute X i The standard deviation of. For text fields and floating-point fields, digitize them. For example, the status of the boiler includes different text fields such as startup, preheating, operation, safety valve failure, and superheater failure. For these fields, they must be encoded. Startup is set to 000, preheating is set to 001, operation is set to 010, safety valve failure is set to 011, and superheater failure is set to 100. For discrete data, retain its original discreteness; for continuous data, set basic units according to different business characteristics. According to the functional division of the equipment, it includes substation module, preheating module, heating module, condensation module, heat dissipation module, and power generation module. Then, for each functional module, determine its basic unit field name. As an example, in the heat dissipation module, the fields related to the fan include: TimeStamp of collecting fan data, pitch1_angle of fan blade 1, and pitch1_speed of fan blade 1. The acceleration of the fan in the X-axis direction acc_x, the acceleration of the fan in the Y-axis direction acc_y, and the label Label of whether the fan is abnormal, etc., are of integer type after preprocessing.

[0071] Taking the power plant data set of this embodiment as an example, some original fields in the data and some fields after processing are listed as follows.

[0072] Table 1 Original fields and some fields after processing

[0073] Field Name Data Types Field Description Preprocessing type TimeStamp String Data collection time Integer pitch1_angle Floating point Angle of blade 1 Integer pitch1_speed Floating point Blade 1 speed Integer moto_tmp Floating point Temperature of motor 1 Integer acc_x Floating point x-direction acceleration Integer acc_y Floating point Acceleration in the y direction Integer Label String A label indicating whether an abnormality has occurred in the device unit Integer

[0074] Table 2 Partial attribute set of a power generation functional unit (Unit11)

[0075]

[0076]

[0077] As can be seen from Table 1, most of the string type data and floating point value type data in the original field are converted into feature attributes; the sequence data that is too short or has many missing values ​​are discarded, and the missing values ​​are filled with the median.

[0078] Preprocessing not only includes the data cleaning and data integration mentioned above, but also converts continuous floating-point numbers into computable discrete variables to facilitate subsequent calculations during the data transformation process.

[0079] From Table 2, we can see that the equipment in industrial scenarios is complex and the amount of data is huge.

[0080] Step 2: Build a multi-layer association graph

[0081] Step 2.1: Construct a multi-level fusion hierarchical association map for the data after preprocessing

[0082] For the large amount of data after the output of the preprocessing module, the present invention constructs a multi-layer fused multi-layer association map. The association map is divided into a device layer, an event layer and a state layer. The constructed map device layer is a space composed of different devices, that is, D = {a1, a2, ..., b1, b2, ...}; a1, a2 and b1, b2 are heterogeneous industrial equipment groups, and a1 and a2 as well as b1 and b2 are different meta-equipment components in the isomorphic industrial equipment group; the event layer is a sequence space composed of different events that occur, that is, E = {e1, e2, e3, ...}, where e1, e2, e3 represent device-related indivisible meta-events respectively; the state layer is a space composed of different characteristics of the equipment, that is, A = {n1, n2, ..., T1, T2, ..., i1, i2, ...}. n1, n2 and T1, T2 and i1, i2 are heterogeneous industrial state groups, n1 and n2, T1 and T2, and i1 and i2 are different meta-state components in the homogeneous industrial state group.

[0083] In this embodiment, the power plant data is concentrated:

[0084] The equipment layer includes blowers, steam-driven feedwater pumps, condensate pumps, heaters, boiler water circulation pumps, condensing steam turbines, motors, fans, etc.;

[0085] The event layer consists of events related to water pump equipment, such as pump start-up, fixed-cycle water pump operation data collection, water pump shutdown, etc., events related to condensing steam turbine equipment, such as steam turbine trial operation, new steam pipeline flushing, oil system cleaning, circuit testing, etc., and a series of events occurring in other different equipment;

[0086] The state layer consists of different attributes of these events, including speed ω, temperature T, current I, etc.

[0087] In this way, the hierarchical graph we get can be expressed as G1 = (V1, R1),

[0088] The node set V1=D∪E∪A,

[0089] The directed edge set R1 = D→E∪E→D∪E→A∪E→E,

[0090] Among them, D→E represents the set of directed edges from the device layer to the event layer, E→D represents the set of directed edges from the event layer to the device layer, E→A represents the set of directed edges from the event layer to the state layer, and E→E represents the set of directed edges between event layers;

[0091] Step 2.2 Association map update

[0092] Step 2.2.1 First, statistical analysis is performed on the preprocessed raw data features to introduce data association on the state layer;

[0093] Step 2.2.2 further enriches the association information between the device layer and the event layer by introducing time association. Specifically, whenever an event of a device occurs, the corresponding device node and event node are connected, and the corresponding edge is assigned a corresponding weight. Whenever an event of a device occurs at t i At the moment of occurrence, the corresponding device node and event node are connected, and the corresponding edge is given the corresponding weight t i ,For example, boiler equipment A1 has boiler startup event e1 at time t1, then the corresponding edge m1 is introduced, from A1 to e1, and the weight is the time t1 when the event occurs;

[0094] Step 2.2.3 Finally, the present invention uses expert knowledge to fuse the Bayesian network model and utilizes domain expert knowledge to determine a network structure G3=(V3, R3) containing prior knowledge, removing most of the impossible network structures;

[0095] Where V3={S1,S2,...,S n} represents a set of device states S n The random feature variables (variable sequence) of R3 represent the set of directed edges.

[0096] The above Bayesian network can be expressed as B = (G3, θ), where θ = (θ 1, θ2,…,θ n ) represents the set of conditional probability parameters of the network.

[0097] Because there may be situations where expert opinions are inconsistent, and there are implicit associations that cannot be included in expert knowledge, the network structure obtained by expert knowledge is not the final network structure. It is necessary to use a learning algorithm (K2 algorithm is used in this embodiment) to obtain a more accurate structural expression. After learning, the final network structure G4=(V4,R4) is obtained.

[0098] For example, the state of device X1 at time t1 is S1, and the state of device X2 at time t1 is S2. Four experts are selected. For expert 1, through analyzing historical data and combining his own professional knowledge, he knows that when state S1 changes, the probability that S2 may also change in the historical data is 0.3; for expert 2, through analyzing historical data and combining his own professional knowledge, he knows that when state S1 changes, the probability that S2 may also change in the historical data is 0.6; for expert 3, through analyzing historical data and combining his own professional knowledge, he knows that when state S1 changes, the probability that S2 may also change in the historical data is 0.3; for expert 4, through analyzing historical data and combining his own professional knowledge, he knows that when state S1 changes, the probability that S2 may also change in the historical data is 0.1. The final result after synthesis is 0.77, so an X1->X2 is added to indicate the causal correlation between the existence of random variables in the equipment. The corresponding expert knowledge is also integrated for other variables, and finally the network structure is preliminarily obtained. The K2 algorithm is further used to learn the best network structure in the remaining search space.

[0099] The specific construction method of step 2.2.3 is described as follows: Figure 4 As shown:

[0100] ① Assume that there is a dependency relationship between any two variables in the selected variable sequence, and through S i →S j With S j →S i Connect these variables to obtain the complete latent graph G′;

[0101] ②Based on variable sequence S nInvolving equipment information, multiple experts are selected to analyze any set of variables S and S in the potential graph G′ in step ① based on their own business knowledge. j The credibility of the causal relationship between them is assigned and the expert credibility is obtained.

[0102] ③ According to m(A)=K∑m1(A1)m2(A2)…m n (A n ) fuses the expert knowledge, determines the causal relationship between variables, prunes the complete latent graph G′ in step ②, and obtains G3=(V3,R3); where: K=(1-∑m1(A1)m2(A2)…m n (A n )) -1 And A1∩A2∩…∩A n =A, A is the included assumption, A n is the hypothesis of the nth expert;

[0103] ④ Use the K2 learning algorithm to further search for a better network structure in the remaining search space, and input the variable sequence {S1, S2, …, S t}, there are t variables in total, and the upper limit value k of the parent node of the variable sequence (k is a positive integer);

[0104] ⑤For each variable S in step ④ i , starting from an empty node set, the pruned potential graph G3 and the scoring function F are obtained according to step ③ to calculate the score of the candidate parent node combination, and the number of parent nodes is gradually increased. When the number of parent nodes is increased but the score does not increase or the number of parent nodes reaches k, the algorithm ends and finally obtains G4. The scoring function F is as shown in formula (3)

[0105]

[0106] in, In the formula, ∏(s i ) is node s i The combination of parent nodes, is the number of combinations under the value conditions, r i Represents node s i The number of possible states, q i Indicates i The number of states of the parent node; N ijk Represents node s i The number of combinations where the i-th value is taken and its parent node takes the j-th value,

[0107] Finally, G4 = (V4, R4) is used to update G2 = (V2, R2): for nodes that do not appear in V2, V2 is updated using the node set of V4, edges that exist in R2 but not in R4 are deleted, and edges that do not exist in R2 but in R4 are supplemented. Finally, a multi-layer association graph G5 = (V5, R5) is obtained.

[0108] After the above steps, all raw data can be stored in the form of entities and relationships to form a knowledge graph network G5 that fully integrates implicit associations such as co-occurrence associations between entities that appear together in a record, spatiotemporal associations between events that appear in chronological order, and a priori associations defined by expert knowledge between entities. Combining this network with diversified retrieval, complex graph analysis, data mining and other technologies can provide features with both depth and breadth for the industrial Internet model level.

[0109] Step 3 Network representation learning

[0110] Through this solution, the fusion of business data and expert knowledge is achieved, and a fully integrated knowledge graph network is obtained. The expert knowledge contained in this knowledge graph network can provide reference and basis for subsequent anomaly detection. Further, by converting the target network from the network structure to the vector space, the graph neural network technology of network representation learning is used to extract the structural information and feature information of the associated graph to generate the representation vector of the node or edge, through formula (1);

[0111]

[0112] Get the final feature representation.

[0113] Input the features obtained in step 3 into the XGBoost classifier, and calculate the recall rate and disturbance rate according to the detection results. As shown in formula (2):

[0114]

[0115] Among them, the total number of positive classes judged as positive classes is TP, the total number of negative classes judged as positive classes is FP, the total number of positive classes judged as negative classes is FN, and the total number of negative classes judged as negative classes is TN.

[0116] Compare the detection results using the following 4 features:

[0117] The features obtained by the method of the present invention (G5-graph features), the original features under structured data, the original features introduced with expert knowledge features and the graph features under the G2 association graph, the control classifiers are the same, and the classifier parameters are the same. The results are as follows:

[0118]

[0119] In the field of industrial equipment anomaly detection, a recall rate improvement of more than 1% is considered a significant technical improvement. We compared the original features under structured data, the original features + expert features, and the graph features under the G2 association graph, and obtained the recall rates under the disturbance rate (false interception rate) less than 2.0%, 1.0%, and 0.5%, and used this to evaluate the performance of the system. We selected the XGBoost classifier as a representative. We analyzed the experimental results and found that the graph representation method can make full use of the original data of the industry and learn better features. Knowledge fusion is of great significance to graph representation. Compared with the original features, at different disturbance rate levels, the recall rate is improved by more than 3% compared with the original features, which is better than the existing research and proves the effectiveness of our fusion representation method.

[0120] References:

[0121] [1]West J,Bhattacharya M.Intelligent financial fraud detection:acomprehensive review.Computers&Security,2016,57:47-66.

[0122] [2]Bhattacharyya S, Jha S, Tharakunnel KK, Westland J C. Data mining for credit card fraud: a comparative study. Decision Support Systems, 2011, 50(3): 602-613.

[0123] [3]Chen RC, Chen TS, Lin C CA new binary support vector system for increasing detection rate of credit card fraud. International Journal of Pattern Recognition, 2006, 20(2): 227–239.

[0124] [4]Pedro M DA few useful things to know about machinelearning.Commun.ACM,2012,55(10):78–87.

[0125] [5] Jiang Hongde. Industrial Internet and deep integration of industrialization and information technology: different paths lead to the same destination[J]. China Information Technology, 2014, 000(019): 11-13.

[0126] [6]Weston DJ,Hand DJ,Adams NM,Whitrow C,Juszczak P.Plastic cardfraud detection using peer group analysis.Advances in Data Analysis andClassification,2008,2(1):45-62.

[0127] [7]Jurgovsky J, Granitzer M, Ziegler K, Calabretto S, Portier PE, GueltonL H, Caelen O. Sequence classification for credit-card fraud detection. ExpertSyst.Appl., 2018, 100: 234-245.

Claims

1. A time series data and knowledge fusion representation method for abnormal monitoring of industrial equipment, characterized in that: The steps include: Step 1. Preprocessing Step 1.1 Divide and collect raw data Divide industrial equipment into functional units and collect the required raw data according to the functional units; Step 1.2 Preprocessing The original data is preprocessed, specifically: first, the noisy original data is smoothed, and then the related data are integrated according to the function; Step 1.3 Discretization Discretize all attributes in the original industrial equipment event data; Step 2. Build a multi-layer association graph of "device-event-state" and update it by introducing data association, time association, and prior association Step 2.1: Construct a multi-level fusion hierarchical association map for the data after preprocessing The hierarchical association graph is divided into a graph device layer, a graph event layer and a graph status layer: The graph device layer is a space composed of different devices, that is, D = {a1, a2, ..., b1, b2, ...}, where a1, a2, ..., b1, b2, ... are different meta-devices; The graph event layer is a sequence space composed of different events that occur, that is, E= {e1,e2,e3,…}, where e1,e2,e3,… represent device-related indivisible meta-events. Event types include normal events and abnormal events. The graph state layer is a space composed of different features of the device, that is, A= {n1,n2,…,T1,T2,…,i1,i2,…}; Among them, n1,n2,…,T1,T2,…,i1,i2,… are different meta-states; Traverse the device nodes in the graph device layer and connect them with all normal event nodes in the graph event layer through directed edges. The weight of the directed edge is set to the time when the normal event occurs. Traverse the device nodes in the graph device layer, connect all abnormal event nodes in the graph event layer with the corresponding nodes in the device layer through directed edges, and set the directed edge weight to the time when the abnormal event occurred; Traverse the event nodes in the graph event layer, connect the event nodes with all the associated state nodes in the graph state layer through directed edges, and set the directed edge weights to the function module type to which the state belongs. The function module types need to be uniformly coded. Traverse the event nodes in the graph event layer, connect the event node with other event nodes with dependencies through directed edges, and set the weight of the directed edge to the time interval between the two events; In this way, the obtained layered graph can be expressed as G1=(V1,R1), The node set V1=D∪E∪A, The directed edge set R1 = D→E∪E→D∪E→A∪E→E, Among them, D→E represents the set of directed edges from the device layer to the event layer, E→D represents the set of directed edges from the event layer to the device layer, E→A represents the set of directed edges from the event layer to the state layer, and E→E represents the set of directed edges between events. Step 2.2 introduces data association, time association, and prior association to update the "device-event-state" multi-layer association graph, and models the association and probability distribution between devices to obtain a complete probability graph model. Step 2.2.1: By statistically analyzing the features of the preprocessed raw data and supplementing it with historical experience knowledge, data association on the state layer is introduced, relevant devices in the historical data are introduced, and the node set V1 is updated to obtain a new set V2; Step 2.2.2 further enriches the association information between the device layer and the event layer by introducing time association; Specifically, whenever an event of the device occurs at t i At the moment of occurrence, connect the corresponding device node and event node, and assign corresponding weight t to the corresponding edge i , and update the related edges in D→E and E→D; the set of updated edges R2, the association graph after introducing time association can be expressed as: G2=(V2,R2), where V2 and R2 have the same meaning as V1 and R1; Step 2.2.3 Expert knowledge is integrated into the Bayesian network model to obtain a complete probability graph model based on the correlation and probability distribution between devices; By integrating the knowledge of experts with the Bayesian network model, the knowledge of multiple experts in the field is integrated and a network structure G3=(V3,R3) containing prior knowledge is obtained through decision making; where V3={S1,S2,...,S n } represents a set of device states S n A random feature variable sequence, R3 represents a set of directed edges, where V3 and R3 have the same meaning as V1 and R1; Because there are also situations where expert opinions are inconsistent and there are implicit associations that cannot be included in expert knowledge, the network structure obtained by expert knowledge is not the final network structure. It is necessary to use a learning algorithm to process G3 to obtain a more accurate structural expression and obtain the final network structure G4 = (V4, R4), where V4 and R4 have the same meaning as V1 and R1; Finally, G4=(V4,R4) is used to update G2=(V2,R2): for nodes that do not appear in V2, V2 is updated using the node set of V4, edges that exist in R2 but not in R4 are deleted, and edges that do not exist in R2 but in R4 are supplemented; finally, a multi-layer association graph G5=(V5,R5) is obtained, where V5,R5 have the same meaning as V1,R1; Step 3. Network representation learning Based on the information network graph G5 constructed in the above steps, we first obtain the adjacency matrix Z of the device-event-state nodes in G5, and then obtain the degree matrix Then, a heterogeneous network representation learning method is used to learn features through multiple graph convolution layers, as shown in formula (1); in, W (l) is the weight matrix, initialized with random values, and is a trainable parameter matrix; H (l) is the input vector, H (0) The graph is sampled from G5 by random walks, l represents the lth layer of the neural network, σ represents the activation function, I n is the identity matrix; In the implementation, the number of layers L of the neural network is determined according to the requirements and complexity, and the final feature representation H is obtained by superimposing multiple convolutional layers using the above formula. (L) .

2. A method for integrating time series data and knowledge for abnormal monitoring of industrial equipment as claimed in claim 1, characterized in that: The discretization process in step 1.3 is as follows: For discrete data, retain its original discreteness; for continuous data, set basic units according to business characteristics, quantify the original attribute values ​​into multiples of the basic units, and turn them into discrete data.

3. The method for integrating time series data and knowledge for abnormal monitoring of industrial equipment according to claim 1, characterized in that: The specific construction method of step 2.2.3 is as follows: ① Assume that there is a dependency relationship between any two variables in the selected variable sequence, and through S i →S j With S j →S i Connect these variables to obtain the complete latent graph G′; ②Based on variable sequence S n Involving equipment information, multiple experts are selected to analyze any set of variables S and S in the potential graph G′ in step ① based on their own business knowledge. j Assign credibility to the causal relationship between them and obtain expert credibility; ③ According to m(A)=K∑m1(A1)m2(A2)…m n (A n ) fuses the expert knowledge, determines the causal relationship between variables, prunes the complete latent graph G′ in step ②, and obtains G3=(V3,R3); where: K=(1-∑m1(A1)m2(A2)…m n (A n )) -1 And A1∩A2∩…∩A n =A, A is the included assumption, A n is the hypothesis of the nth expert; ④ Use the K2 learning algorithm to further search for a better network structure in the remaining search space, and input the variable sequence {S1, S2, …, S t }, there are t variables in total, and the upper limit value k of the parent node of the variable sequence, k is a positive integer; ⑤For each variable S in step ④ i , starting from an empty node set, the pruned potential graph G3 and the scoring function F are obtained according to step ③ to calculate the score of the candidate parent node combination, and the number of parent nodes is gradually increased. When the number of parent nodes is increased but the score does not increase or the number of parent nodes reaches k, the algorithm ends and finally obtains G4; the scoring function F is as shown in formula (3) in, In the formula, ∏(s i ) is node s i The combination of parent nodes, is the number of combinations under the value conditions, r i Represents node s i The number of possible states, q i Indicates i The number of states of the parent node; N ijk Represents node s i The number of combinations where the i-th value is taken and its parent node takes the j-th value,

Images