Industrial System Production Anomaly Detection and Diagnosis Method Based on Multidimensional Sensing Data

Abstract

The present invention discloses an industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data, including: preprocessing multi-dimensional sensing data samples, and dividing the preprocessed multi-dimensional sensing data samples into several sub-samples by using a sliding window; using an autoencoder to train an anomaly detection model based on normal sub-samples in an unsupervised training manner; training a classification model according to the anomaly detection model; and performing real-time detection and diagnosis of industrial system production anomalies based on the anomaly detection model and the classification model. The present invention solves the problem that it is difficult to perform anomaly diagnosis in the case of current black-box model for multi-dimensional sensing data anomaly detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of data mining, and particularly relates to a method for detecting and diagnosing production anomalies in industrial systems based on multi-dimensional sensing data. Background Art

[0002] Industrial Internet aims to achieve automated control and resource allocation of more sensitive and efficient industrial manufacturing systems, while improving the production efficiency of smart factories. However, since the Industrial Internet breaks the boundary between the cyber world and the physical world, industrial manufacturing systems are more vulnerable to external malicious behaviors. In addition, there are inevitably production problems such as equipment failures, performance degradation, and quality defects in industrial manufacturing systems. If anomalies such as intrusions and faults in industrial production cannot be detected in a timely manner, it may cause serious losses to the entire manufacturing system. Therefore, anomaly detection and diagnosis are basic requirements of the Industrial Internet and are of great significance to intelligent manufacturing enterprises.

[0003] With the rapid development of the Industrial Internet, modern industrial manufacturing systems have realized the perception and recording of production operation status and processes through sensors, accumulating a large amount of industrial production data. Data-driven methods have become the mainstream means of anomaly detection. In recent years, deep learning has gradually become the mainstream technology of data-driven methods. However, due to the complexity of deep learning models, which contain a large number of non-linear transformations and are generally a black box, their prediction results are not interpretable. In industrial system anomaly detection, the interpretation of detection results is very important and is the basis for realizing the diagnosis of anomaly detection results. For example, the diagnosis of anomaly detection results can help locate which device and which time period an anomaly occurred.

[0004] Existing methods for interpreting deep learning models focus on supervised learning models, such as deep learning interpretable frameworks like SHAP and LIME. However, due to the complexity of industrial production data and the high cost of manual annotation, the obtained industrial production data is basically unlabeled. Therefore, anomaly detection models need to be trained in an unsupervised manner. In particular, new deep unsupervised learning models such as autoencoders can hardly enable existing deep learning interpretable frameworks to learn the association between anomaly samples and semantic features, resulting in the inability to interpret deep unsupervised learning models. Summary of the Invention

[0005] The purpose of the present invention is to provide a method for detecting and diagnosing production anomalies in industrial systems based on multi-dimensional sensing data, so as to improve the accuracy of anomaly diagnosis.

[0006] To achieve the above purpose, the technical solutions adopted by the present invention are as follows:

[0007] An industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data, the industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data includes:

[0008] S1. Preprocess the multi-dimensional sensing data samples, and use a sliding window to divide the preprocessed multi-dimensional sensing data samples into several sub-samples, where the sub-samples include normal sub-samples and abnormal sub-samples; given a multi-dimensional sensing data sample s ∈ R N×T , s is a two-dimensional matrix, where N is the feature dimension of s, that is, the number of devices included in the industrial system, and T is the data duration of s, that is, the number of sensor sampling points;

[0009] S2. Use an autoencoder to train an anomaly detection model based on normal sub-samples in an unsupervised training manner;

[0010] S3. Train a classification model according to the anomaly detection model, including:

[0011] Step 31. Use the anomaly detection model to detect the sub-samples containing normal sub-samples and abnormal sub-samples, and add labels to the sub-samples according to the detection results to obtain a labeled sub-sample set;

[0012] Step 32. Assume that F is a set of N features. Each time, take n features from the set F according to the combination of features to obtain 2 N -1 feature subsets S, n = 1, 2,..., N. Generate a training subset that only contains the features in the feature subset from the labeled sub-sample set according to each feature subset. Use an XGBoost classifier to train a classification model in a supervised manner on each training subset, and a total of 2 N -1 classification models are obtained;

[0013] S4. Perform real-time detection and diagnosis of industrial system production anomalies based on the anomaly detection model and the classification model, including:

[0014] Obtain real-time sub-samples to be detected. If the detection result of the real-time sub-samples by the anomaly detection model is a normal sub-sample, end; otherwise, use the classification model to calculate the feature confidence corresponding to each feature dimension in the N feature dimensions in turn according to the real-time sub-samples, and diagnose the abnormal features according to the feature confidence, that is, locate the abnormal devices in the industrial system.

[0015] The following also provides several optional methods, but they are not additional limitations to the above overall solution, but only further supplements or optimizations. Without technical or logical contradictions, each optional method can be combined with the above overall solution alone, or multiple optional methods can be combined with each other.

[0016] Preferably, the preprocessing of the multi-dimensional sensing data samples includes:

[0017] For the missing values in the multi-dimensional sensing data sample s, fill them with the average value of the front and back data;

[0018] Perform normalization processing on the multi-dimensional sensing data sample s so that the data is within the range of [0, 1].

[0019] Preferably, the preprocessed multi-dimensional sensing data sample is divided into several sub-samples by using a sliding window, including:

[0020] Use a sliding window with a window size of W to divide the multi-dimensional sensing data sample s to obtain M consecutive sub-samples sS∈R N×W .

[0021] Preferably, the network structure of the autoencoder includes an input layer, an encoding layer, a semantic layer, a decoding layer, and an output layer, where:

[0022] The input layer: The input is the sub-sample Ss∈R N×W ;

[0023] The encoding layer: Use two layers of LSTM as the encoder. The N-dimensional feature vectors x1, x2,..., x at W time moments in the sub-sample ss W Are sequentially input into each unit of the first layer of LSTM, and the W hidden vectors obtained are then sequentially input into each unit of the second layer of LSTM to obtain W hidden vectors h1, h2,..., h W ;

[0024] The semantic layer: Take the hidden vector h W As the encoded low-dimensional semantic vector;

[0025] The decoding layer: Use two layers of LSTM as the decoder. Repeat the hidden vector h W W times and sequentially input it into each unit of the first layer of LSTM. The W hidden vectors obtained are then sequentially input into each unit of the second layer of LSTM to obtain W hidden vectors g1, g2,..., g w ;

[0026] The output layer: Use a fully connected layer to convert the W hidden vectors g1, g2,..., g W Into vectors y1, y2,..., y with the same dimension as the sub-sample ss W , and the vectors y1, y2,..., y W Are used as the output data rss.

[0027] Preferably, in the training of the anomaly detection model, use the mean square error between the output data rss and the sub-sample ss as the loss function, and use the gradient descent method for optimization iteration.

[0028] Preferably, the calculating the feature confidence corresponding to each feature dimension in the N feature dimensions in sequence according to the real-time sub-samples includes:

[0029] The feature confidence is calculated for feature k as follows:

[0030]

[0031] In the formula, φ k is the feature confidence of feature k, k = 1, 2, ..., N, CM S (x S ) is the classification model CM trained using the training subset corresponding to the feature subset S that does not contain feature k S In the subsample x S The output result on the subsample x is 0 or 1. S is the sample data extracted from the real-time sub-sample with the same features as those contained in the feature subset S, CM S∪{k} (x S∪{k} ) is the classification model CM trained using the training subset corresponding to the feature subset S∪{k} containing feature k S∪{k} In the subsample x S∪{k} The output result on the subsample x is 0 or 1. S∪{k} is the sample data extracted from the real-time sub-sample with the same features as those contained in the feature subset S∪{k}, Represents the feature subset S that does not contain feature k.

[0032] Preferably, the diagnosing abnormal features according to feature confidence comprises:

[0033] First, the Sigmoid function is used to normalize the confidence of all features to obtain the weight score. The absolute value of the weight score indicates the influence of the feature on the final detection result. The SHAP interpretation model is used to interpret the detection result based on the influence value.

[0034] The industrial system production anomaly detection and diagnosis method based on multi-dimensional sensor data provided by the present invention adopts an automatic encoder to train the anomaly detection model in an unsupervised manner without providing abnormal labeled samples; the output of the anomaly detection model is used to train a supervised classification model, and on this basis, the interpretation and diagnosis of the anomaly detection results are realized, thereby solving the problem that it is difficult to perform anomaly diagnosis when using a black box model for anomaly detection of multi-dimensional sensor data. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A flowchart of the method for detecting and diagnosing anomalies in industrial system production based on multi-dimensional sensor data of the present invention;

[0036] Figure 2Grid structure diagram of the automatic encoder of the present invention;

[0037] Figure 3 Schematic diagram of parameter settings for each layer of the automatic encoder of the present invention;

[0038] Figure 4 Abnormal detection explanation diagram for abnormal sub-samples output by the present invention;

[0039] Figure 5 Abnormal detection explanation diagram for normal sub-samples output by the present invention. Detailed implementation manners

[0040] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0041] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present invention belongs. The terms used in the description of the present invention herein are only for the purpose of describing specific embodiments, and are not intended to limit the present invention.

[0042] In order to solve the problem that it is difficult to perform abnormal diagnosis in the case of abnormal detection of multi-dimensional sensing data using a black-box model in the prior art, this embodiment provides an industrial system production abnormal detection and diagnosis method based on multi-dimensional sensing data.

[0043] As Figure 1 shown, this embodiment proposes an industrial system production abnormal detection and diagnosis method based on multi-dimensional sensing data, including the following steps:

[0044] S1. Preprocess the multi-dimensional sensing data samples, and use a sliding window to divide the preprocessed multi-dimensional sensing data samples into several sub-samples, and the sub-samples include normal sub-samples and abnormal sub-samples.

[0045] In this embodiment, given a multi-dimensional sensing data sample s ∈ R N×T , s is a two-dimensional matrix, where N is the feature dimension of s, that is, the number of devices included in the industrial system, and T is the data duration of s, that is, the number of sampling points of the sensor. Therefore, the detailed operations for preprocessing the sample data in this embodiment are as follows:

[0046] 1) Data cleaning: For the missing values in the multi-dimensional sensing data sample s, fill them with the average values of the front and back data.

[0047] 2) Data standardization: Standardize the multi-dimensional sensing data sample s so that the data is within the range of [0, 1].

[0048] When dividing the data in this embodiment, use a sliding window with a window size of W to divide the multi-dimensional sensing data sample s to obtain M consecutive sub-samples ss ∈ R N×W .

[0049] It should be noted that since the training of the anomaly detection model in this embodiment requires the use of normal sub-samples, the sub-samples in this embodiment include normal sub-samples and abnormal sub-samples. However, the sub-samples obtained by the division in step 1 are not labeled, and the distinction between normal and abnormal corresponds to the normal and abnormal of the original data taken.

[0050] S2. Adopt an autoencoder to train an anomaly detection model in an unsupervised training manner based on normal sub-samples.

[0051] In this embodiment, an autoencoder is used to train the anomaly detection model AM. The input of the autoencoder is the original sub-sample ss. First, the original sub-sample is converted to a low-dimensional feature space through the encoder, and then the low-dimensional features are output as a reconstructed sub-sample rss through the decoder. The training objective is to make ss and rss as close as possible. Refer to Figure 2 As shown, the network structure of the adopted autoencoder is as follows:

[0052] Input layer: The input is the sub-sample ss ∈ R N×W .

[0053] Encoding layer: Use two layers of LSTM as the encoder. The N-dimensional feature vectors x1, x2,..., x W (a total of W time steps, that is, x1 is an N-dimensional feature vector, and the others are understood similarly) at each time step in the sub-sample ss are sequentially input into each unit of the first layer of LSTM, and the W hidden vectors obtained are then sequentially input into each unit of the second layer of LSTM to obtain W hidden vectors h1, h2,..., h W .

[0054] Semantic layer: Take the hidden vector h W as the encoded low-dimensional semantic vector.

[0055] Decoding layer: Use two layers of LSTM as the decoder. Repeat the hidden vector h W W times and sequentially input them into each unit of the first layer of LSTM. The W hidden vectors obtained are then sequentially input into each unit of the second layer of LSTM to obtain W hidden vectors g1, g2,..., g w .

[0056] Output layer: Use a fully connected layer to combine the W hidden vectors g1, g2,..., g wConvert to vectors y1, y2, …, y that are consistent with the dimension of the subsample ss W , vectors y1, y2, …, y W as the output data rss.

[0057] During the training process of the anomaly detection model AM, on the one hand, in order to minimize the difference between ss and rss, the mean square error between the output data rss and the subsample ss is used as the loss function, and on this basis, the model is optimized and trained by means of gradient descent; on the other hand, in order to let the model learn the patterns of normal subsamples, only normal subsamples are used for training. The parameter settings of each layer of the autoencoder adopted in this embodiment are as Figure 3 shown.

[0058] After training is completed, given a real-time subsample ss, input it into the trained autoencoder (i.e., the anomaly detection model AM) to obtain the reconstructed subsample rss of the output. Calculate the mean square error between ss and rss. If the mean square error is greater than the predefined threshold, then determine that the subsample is abnormal, otherwise determine it as normal.

[0059] S3. Train a classification model according to the anomaly detection model, including:

[0060] Step 31. Construction of the labeled subsample set: Use the anomaly detection model to detect the subsamples containing normal subsamples and abnormal subsamples, and add labels to the subsamples according to the detection results. Label the detected abnormal subsamples as 1 and the normal subsamples as 0 to obtain the labeled subsample set LSS.

[0061] Step 32. Construction of the classification model: Assume that F is a set of N features. Each time, take n features from the set F according to the combination of features to obtain 2 N -1 feature subsets S, where n = 1, 2, …, N. Generate a training subset that only contains the features in the feature subset from the labeled subsample set LSS according to each feature subset. Train a classification model in a supervised manner using the XGBoost classifier on each training subset, and a total of 2 N -1 classification models are obtained.

[0062] The number of subsamples in each training subset is the same as the number of subsamples in the labeled subsample set LSS, and the labels of each subsample remain unchanged.

[0063] S4. Perform real-time detection and diagnosis of industrial system production anomalies based on the anomaly detection model and the classification model, including:

[0064] S41. Obtain the real-time subsample to be detected. If the detection result of the anomaly detection model for the real-time subsample is a normal subsample, then end; otherwise, execute the next step;

[0065] S42. Calculate the feature confidence corresponding to each feature dimension in the N feature dimensions in turn according to the real-time sub-sample by using the classification model.

[0066] In this embodiment, when the real-time sub-sample is abnormal, the feature confidence corresponding to each feature is calculated. Taking the calculation of the feature confidence of feature k as an example, given feature k (the feature is one of the N features), the confidence φ of feature k is evaluated by calculating the difference between the classification model using feature k and the classification model not using feature k. k , confidence φ k The greater the confidence φ, the higher the importance of feature k.

[0067] The calculation of the feature confidence for feature k is as follows:

[0068]

[0069] In the formula, φ k is the feature confidence of feature k, k = 1, 2,..., N, CM S (x S ) is the output result of the classification model CM trained with the training subset corresponding to the feature subset S that does not contain feature k on the sub-sample x S The output result is 0 or 1. The sub-sample x S is the sample data extracted from the real-time sub-sample that is the same as the features included in the feature subset S. CM S (x S∪{k} ) is the output result of the classification model CM trained with the training subset corresponding to the feature subset S ∪ {k} that contains feature k on the sub-sample x S∪{k} The output result is 0 or 1. The sub-sample x S∪{k} is the sample data extracted from the real-time sub-sample that is the same as the features included in the feature subset S ∪ {k}, S∪{k} S∪{k} represents the feature subset S that does not contain feature k.

[0070]

[0071] S43. Diagnose abnormal features according to the feature confidence, that is, locate the abnormal devices in the industrial system.

[0071] First, use the Sigmoid function to normalize all feature confidences to obtain weight scores. The absolute value of the weight score indicates the influence value of the feature on the final detection result. Based on the influence value, use the SHAP interpretation model to interpret the detection result.

[0072] The abnormal judgment of this application is based on the SHAP interpretation model, and the SHAP interpretation model is implemented based on the Shapley value. Therefore, the calculation of feature confidence in this embodiment is equivalent to the calculation of the Shapley value. Based on the finally obtained influence values, abnormal features are obtained (for example, the influence value is higher than the set threshold). Since the features correspond to devices, the devices that may cause abnormalities in the industrial system can also be directly located.

[0073] For the convenience of observation, this embodiment further visualizes the diagnostic results. Refer to Figure 4 and Figure 5 , where f(x) in the figure represents the probability that the output of the classification model is an abnormal result. The left side of f(x) indicates a positive correlation with the abnormal detection result, and the right side indicates a negative correlation with the abnormal result. The larger the width of the feature area, the higher the weight score of the feature, and thus the cause of the abnormality is diagnosed. For example, Figure 4 in, the influence values of features such as f4, f6, f1 (corresponding to the labels of the devices) are relatively high, indicating that the most likely cause of the abnormality is the devices corresponding to these features.

[0074] The technical features of the above-described embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered to be within the scope described in this specification.

[0075] The above-described embodiments only represent several implementation manners of the present invention. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present invention, several modifications and improvements can still be made, and these all belong to the protection scope of the present invention. Therefore, the protection scope of the present invention should be subject to the appended claims.

Claims

1. An industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data, characterized in that, The industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data includes: S1. Preprocess the multi-dimensional sensing data samples, and use a sliding window to divide the preprocessed multi-dimensional sensing data samples into several sub-samples, where the sub-samples include normal sub-samples and abnormal sub-samples; Given a multi-dimensional sensing data sample s ∈ R N×T , s is a two-dimensional matrix, where N is the feature dimension of s, that is, the number of devices included in the industrial system, and T is the data duration of s, that is, the number of sampling points of the sensor; Use a sliding window with a window size of W to divide the multi-dimensional sensing data sample s, and obtain M consecutive sub-samples ss ∈ R N×W ; S2. Use an autoencoder to train an anomaly detection model in an unsupervised training manner based on normal sub-samples. S3. Train a classification model according to the anomaly detection model, including: Step 31. Use the anomaly detection model to detect sub-samples containing normal sub-samples and abnormal sub-samples, and add labels to the sub-samples according to the detection results to obtain a labeled sub-sample set. Step 32. Assume that F is a set of N features. Each time, take n features from the set F according to the combination of features to obtain 2 N -1 feature subsets S, where n = 1, 2, …, N. Generate a training subset that only contains the features in the feature subset from the labeled sub-sample set according to each feature subset. On each training subset, use the XGBoost classifier to train a classification model in a supervised manner, and a total of 2 N -1 classification models are obtained; S4. Perform real-time detection and diagnosis of industrial system production anomalies based on the anomaly detection model and the classification model, including: Obtain real-time sub-samples to be detected. If the detection result of the real-time sub-samples by the anomaly detection model is a normal sub-sample, end; otherwise, use the classification model to calculate the feature confidence corresponding to each of the N feature dimensions in turn according to the real-time sub-samples, and diagnose abnormal features based on the feature confidence, that is, locate abnormal devices in the industrial system.

2. The method for detecting and diagnosing production anomalies in an industrial system based on multi-dimensional sensing data according to claim 1, wherein, The preprocessing of the multi-dimensional sensing data sample includes: For missing values in the multi-dimensional sensing data sample s, fill them with the average value of the front and back data. Perform standardization processing on the multi-dimensional sensing data sample s so that the data is within the range of [0, 1].

3. The industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data according to claim 1, characterized in that, The network structure of the autoencoder includes an input layer, an encoding layer, a semantic layer, a decoding layer, and an output layer, where: The input layer: The input is a sub-sample ss ∈ R N×W ; The encoding layer: Two layers of LSTM are used as the encoder. The N-dimensional feature vectors x1, x2, …, x at W moments in the subsample ss are input into each unit of the first layer of LSTM in sequence. The W hidden vectors obtained are then input into each unit of the second layer of LSTM in sequence, obtaining W hidden vectors h1, h2, …, h W ; W ; The semantic layer: take the hidden vector h W as the encoded low-dimensional semantic vector; The decoding layer: Using two-layer LSTM as the decoder, the hidden vector h W is repeated W times and sequentially input into each cell of the first-layer LSTM. The W obtained hidden vectors are then sequentially input into each cell of the second-layer LSTM to obtain W hidden vectors g1, g2, …, g W ; The output layer: uses a fully connected layer to convert W hidden vectors g1, g2, …, g W into vectors y1, y2, …, y that are consistent with the dimension of the subsample ss W , and the vectors y1, y2, …, y W serve as the output data rss.

4. The industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data according to claim 3, characterized in that, In the training of the anomaly detection model, the mean square error between the output data rss and the sub-sample ss is used as the loss function, and the gradient descent method is used for optimization iteration.

5. The method for detecting and diagnosing production anomalies in an industrial system based on multi-dimensional sensing data according to claim 1, wherein The calculation of the feature confidence corresponding to each of the N feature dimensions in turn according to the real-time sub-samples includes: Calculate the feature confidence for feature k as follows: Where, φ k is the feature confidence of feature k, k = 1, 2, …, N, CM S (x S ) is the output result of the classification model CM trained using the training subset corresponding to the feature subset S that does not contain feature k S on the subsample x S , and the output result is 0 or 1. The subsample x S is the sample data extracted from the real-time subsample and having the same features as those included in the feature subset S, CM S∪{k} (x S∪{k} ) is the output result of the classification model CM trained using the training subset corresponding to the feature subset S ∪ {k} that contains feature k S∪{k} on the subsample x S∪{k} , and the output result is 0 or 1. The subsample x S∪{k} is the sample data extracted from the real-time subsample and having the same features as those included in the feature subset S ∪ {k}, denotes the feature subset S that does not contain feature k.

6. The industrial system production anomaly detection and diagnosis method based on multi-dimensional sensing data according to claim 1, characterized in that The diagnosis of abnormal features based on the feature confidence includes: First, use the Sigmoid function to normalize all feature confidences to obtain weight scores. The absolute value of the weight score indicates the influence value of the feature on the final detection result. Based on the influence value, use the SHAP interpretation model to interpret the detection result.

Images