A multivariate time series anomaly detection method and system based on graph neural network

Abstract

This paper proposes a multivariate time series anomaly detection method and system based on a graph neural network. The method includes: using sensors in a physical system as nodes in a probabilistic graph model and sensor-monitored data as time series to model multidimensional time series relationships and obtain a dynamic graph neural network model; obtaining the predicted value of each node at the next time point and generating an adjacency matrix for each node using a normalized time alignment measure; obtaining the true value of the node at the next time point, and constructing a loss function that introduces adjacency matrix reconstruction error based on the predicted and true values ​​to train and update the dynamic graph neural network model. The method also determines the outlier value of each node based on the loss function value of each node, the difference in the distribution of its neighboring nodes, and the adjacency matrix value; and generating an anomaly alarm when the error between the predicted and true values ​​of a node is greater than the outlier value. This method improves the stability of system outliers and the accuracy of slowly varying anomaly detection.

Description

Technical Field

[0001] The present invention relates to abnormality detection / stability detection of an industrial equipment system, and in particular to abnormality detection / stability detection of an equipment system in a process control. Background Art

[0002] A complex physical system, such as a power plant, data center, or smart factory, contains numerous different types of sensors (e.g., current, voltage, temperature, speed, and pressure) to monitor the operating status of various devices. A key task in managing such a complex physical system is real-time monitoring of system anomalies so that timely action can be taken to address the cause of the anomaly alarm.

[0003] Based on the presence of corresponding positive anomaly labels, multivariate time series anomaly detection models can be categorized into supervised, unsupervised, and semi-supervised models. Given the limited availability of anomaly data and the difficulty of labeling them in practical applications, unsupervised time series anomaly detection algorithms have become a research focus in recent years. Based on their principles, unsupervised multivariate time series anomaly detection can be divided into two main categories: those based on sequence similarity and those based on prediction models. For multivariate time series, directly calculating the similarity between two sequences is complex, so these algorithms are not often used in isolation. For multivariate time series, although the optimization process of dimensionality reduction algorithms aims to reduce the reconstruction error of each sequence, unsupervised sequence projection alone cannot guarantee the prediction error of the next sequence value. Therefore, current multivariate time series anomaly detection is primarily based on time series prediction models. For example, Jones et al. proposed constructing similarity between sequences using a sequence trajectory feature and addressing the correlation problem of long-period time series by superimposing trajectory features at different scales. This also increases the input sequence length of subsequent prediction models. Munir et al. proposed the DeepAnT model, which uses a CNN to construct a time series predictor to improve the forecasting performance of cyclical and seasonal time series. They also define outliers as the square root of the error between the predicted value and the true value. Deng et al. proposed a graph neural network (GDN) to detect anomalies in multidimensional time series. They also constructed an adjacency matrix using a graph attention mechanism to automatically discover correlations between fields.

[0004] Most of the above unsupervised high-dimensional time series anomaly detection models are still unable to effectively detect sequence anomalies. This is because:

[0005] 1) Since the data itself has time-domain dependencies, it is difficult to model the sequence temporal relationship based on simple distance or clustering algorithms.

[0006] 2) Considering the causal relationship in the process or mechanism, there is a potential correlation between the data collected by each sensor. Obviously, existing anomaly detection algorithms based on predictive models, although they have high processing efficiency, lack the ability to model the correlation between fields.

[0007] 3) Although the GDN model can automatically discover correlations between fields, the adjacency matrix varies greatly over time, and the fluctuation of system outliers is also large. This makes it difficult to determine the threshold for anomaly detection in actual use.

[0008] When the inventors were conducting research on anomaly detection algorithms based on deep learning multidimensional time series, they found that the GDN model could only obtain its static model through training based on input data. As the input dimension increases, the fluctuations in the outliers and node correlations output by the model are also large, which is not conducive to anomaly detection and further analysis. The training process of the GDN model only optimizes the prediction error of the feature data, and lacks explicit supervision of the reconstruction error information related to the node network structure (such as the similarity of each node attribute). Therefore, the deviations of the graph embedding features and the related adjacency matrix obtained by training are large and cannot be directly used for subsequent root cause analysis. Moreover, the GDN model is still a static model, that is, it only predicts the current network structure based on the input data for reasoning. Although the reasoning process is simple to calculate, due to the lack of a module in the model that reflects the time domain correlation of variables, it is not suitable for modeling the ever-changing possible abnormal fields and their adjacency relationships. Summary of the Invention

[0009] The purpose of the present invention is to solve the problem of large variations in the outlier values ​​output by the existing multi-dimensional time series anomaly detection model based on graph neural networks, and to propose a multi-dimensional time series prediction model based on a dynamic time series model in combination with the probabilistic graph model theory. First, a time series model is constructed based on the probabilistic graph model theory to model the multi-dimensional time series relationship in order to realize a dynamic graph neural network; secondly, the improved multi-head attention mechanism is adopted to realize the aggregation of node features of the graph neural network by combining the characteristics of the multi-head attention mechanism and the static graph neural network; at the same time, the normalized time alignment measure (TAM) is used to approximate the adjacency matrix, and the reconstruction error of the adjacency matrix is ​​explicitly introduced in the loss function, so that the graph embedding representation contains the similarity of the node data itself in addition to the neighborhood structure. Subsequently, according to the difference in distribution between each node and its neighbors and the TAM value, the outlier of each node is defined, and its mean is used as the outlier of the system.

[0010] To address the shortcomings of the existing technology, this paper proposes a multivariate time series anomaly detection method based on graph neural network, which includes:

[0011] Step 1: Obtain the data collected by each sensor in the physical system to be detected for anomaly, use the sensors as nodes in the probabilistic graph model, use the data monitored by the sensors as time series, model the multidimensional time series relationship, and obtain a dynamic graph neural network model;

[0012] Step 2: A multi-head attention mechanism is used to aggregate the features of the nodes in the dynamic graph neural network model to obtain the predicted value of each node at the next time point, and the adjacency matrix of each node is measured using normalized time alignment;

[0013] Step 3: When the time reaches the next time point, the true value of the node is obtained. According to the predicted value and the true value, a loss function that introduces the adjacency matrix reconstruction error is constructed to train and update the dynamic graph neural network model. At the same time, the abnormal value of each node is obtained according to the difference in the loss function value of each node and the distribution of its neighboring nodes and the adjacency matrix value.

[0014] Step 4: Loop through steps 1 to 3. When the error between the predicted value and the true value of a node at the same time point is greater than the abnormal value, an abnormal alarm is generated for the corresponding node.

[0015] In the multivariate time series anomaly detection method based on graph neural network, the training and updating of the dynamic graph neural network model in step 2 includes:

[0016] For a sensor operating state sequence of length T, the time series error L is used. recon and fitting error L reg The mean square error is used as the loss function; where the time series error L recon is the predicted value of the data at time t and the true value s 1:T The average deviation of the fitting error L reg is the normalized adjacency matrix The fitting error with the adjacency matrix template A;

[0017] The adjacency matrix A is used to represent a directed graph, where the element A ij represents a directed edge from node i to node j, and Represents the neighborhood of node i. The dynamic graph neural network model uses the cosine measure e ji Represents the weight of the edge, that is, the dependency between nodes; the neighborhood size is K, and the top K neighbors are selected to define the adjacency matrix, that is:

[0018]

[0019] By minimizing the loss function, the dynamic graph neural network model is trained and updated, and during the training process, s t Predicted value The empirical distribution of is expressed as its probability:

[0020]

[0021] Among them, the time alignment measure method is used to obtain an approximate representation of the adjacency matrix, and the estimated value is obtained through the following steps based on GATv2 Will Normalize to get the similarity matrix e, and calculate the adjacency matrix A according to the above formula (1) t , according to the definition of GATv2, we get The following representation:

[0022]

[0023] For the new aggregated features of each node, its multi-head outputs are spliced ​​together, and the output of multiple cascaded fully connected layers is used as the estimated value of the current true value

[0024] The multivariate time series anomaly detection method based on graph neural network, wherein step 3 includes:

[0025] According to the most relevant first l neighbor nodes of each node, the consistency of each node and its neighbor nodes is obtained, and the average value of the consistency is used as the outlier value of the corresponding node.

[0026] The multivariate time series anomaly detection method based on graph neural network is described, wherein the physical system to be detected should be an information-physical system containing complex control logic, including power plants, data centers and smart factories, etc. The sensors include current, voltage, temperature, speed and pressure, torque, flow and displacement sensors.

[0027] The present invention also proposes a multivariate time series anomaly detection system based on graph neural network, which includes:

[0028] The initial module is used to obtain the data collected by each sensor in the physical system to be detected for anomalies, and uses the sensors as nodes in the probabilistic graph model and the data monitored by the sensors as time series to model the multidimensional time series relationship and obtain a dynamic graph neural network model;

[0029] The aggregation module is used to aggregate the features of the nodes in the dynamic graph neural network model using a multi-head attention mechanism to obtain the predicted value of each node at the next time point, and use normalized time alignment to measure the adjacency matrix of each node;

[0030] A training module is used to obtain the true value of the node when the time reaches the next time point, and construct a loss function that introduces the adjacency matrix reconstruction error based on the predicted value and the true value to train and update the dynamic graph neural network model. At the same time, based on the loss function value of each node and the difference in distribution of its neighboring nodes and the adjacency matrix value, the abnormal value of each node is obtained;

[0031] The alarm module is used to generate an abnormal alarm for the corresponding node when the error between the node prediction value and the true value at the same time point is greater than the abnormal value.

[0032] In the multivariate time series anomaly detection system based on graph neural network, training and updating the dynamic graph neural network model in the aggregation module includes:

[0033] For a sensor operating state sequence of length T, the time series error L is used. recon and fitting error L reg The mean square error is used as the loss function; where the time series error L recon is the predicted value of the data at time t and the true value s 1:T The average deviation of the fitting error L reg is the normalized adjacency matrix The fitting error with the adjacency matrix template A;

[0034] The adjacency matrix A is used to represent a directed graph, where the element A ij represents a directed edge from node i to node j, and Represents the neighborhood of node i. The dynamic graph neural network model uses the cosine measure e ji Represents the weight of the edge, that is, the dependency between nodes; the neighborhood size is K, and the top K neighbors are selected to define the adjacency matrix, that is:

[0035]

[0036] By minimizing the loss function, the dynamic graph neural network model is trained and updated, and during the training process, s t Predicted value The empirical distribution of is expressed as its probability:

[0037]

[0038] Among them, the time alignment measure method is used to obtain an approximate representation of the adjacency matrix, and the estimated value is obtained through the following process based on GATv2 Will Normalize to get the similarity matrix e, and calculate the adjacency matrix A according to the above formula (1) t , according to the definition of GATv2, we get The following representation:

[0039]

[0040] For the new aggregated features of each node, its multi-head outputs are spliced ​​together, and the output of multiple cascaded fully connected layers is used as the estimated value of the current true value

[0041] The multivariate time series anomaly detection system based on graph neural network, wherein the training module includes:

[0042] According to the first l most relevant neighbor nodes of each node, the consistency of each node and its neighbor nodes is obtained, and the average value of the consistency is used as the outlier.

[0043] The multivariate time series anomaly detection system based on graph neural network, wherein the physical system to be detected should be an information-physical system containing complex control logic, including power plants, data centers and smart factories, etc., and the sensors include current, voltage, temperature, speed and pressure, torque, flow, and displacement sensors.

[0044] The present invention also proposes a storage medium for storing a program for executing any one of the multivariate time series anomaly detection methods based on graph neural networks.

[0045] The present invention also proposes a client for use in any of the multivariate time series anomaly detection systems based on graph neural networks.

[0046] It can be seen from the above scheme that the advantages of the present invention are: compared with the existing technology, the present invention realizes the automatic discovery of the adjacency relationship between fields and the time domain prediction of the correlation between fields, improves the performance of multidimensional time series prediction, reduces the fluctuation of system outliers, and improves the accuracy of detecting sudden and slow-changing anomalies in complex systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] Figure 1 Schematic diagram of the probability graph model used in the present invention. DETAILED DESCRIPTION

[0048] In order to make the above features and effects of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings.

[0049] First, based on the theory of probabilistic graphical models, a time series model is constructed to model the multi-dimensional time series relationship in order to realize a dynamic graph neural network. Secondly, by combining the characteristics of the multi-head attention mechanism and the static graph neural network, the improved multi-head attention mechanism is used to realize the aggregation of the node features of the graph neural network. At the same time, the normalized time alignment measure (TAM) is used to approximate the adjacency matrix, and the reconstruction error of the adjacency matrix is ​​explicitly introduced in the loss function, so that the graph embedding representation contains the similarity of the node data itself in addition to the neighborhood structure. Subsequently, according to the difference in distribution between each node and its neighbors and the TAM value, the following Define the outlier value for each node and use its mean as the system's outlier value. The nodes in the diagram correspond one-to-one with sensors to model sensor dependencies. "Field" will also refer to sensors in the following text.

[0050] There is the following probabilistic generation relationship between the node variable v, the adjacency matrix A, and the observation variable s:

[0051]

[0052] Among them, the real adjacency matrix is ​​also a random variable, the node variable represents the measurement value of the sensor, the observed variable is the opposite of the latent variable, which can be directly measured by the sensor. On the contrary, the latent variable is the variable assumed to exist in the theoretical model and cannot be directly measured without the corresponding sensor. The probability graph model corresponding to the above probability generation relationship is expressed as follows Figure 1 As shown in Figure A t represents the adjacency matrix at time t, p(A t |v t ,s 1:t-1 ) represents the distribution of the current adjacency matrix. The present invention adopts the normalized time alignment measure (TAM) Probabilistic representation as an adjacency matrix And p(s t |A t ,s 1:t-1 ) represents the prediction of current data based on historical data and current network structure.

[0053] Model training process:

[0054] For a sequence of length T, based on the above assumptions, in order to improve the model's prediction performance for time series and the degree of fitting of key information, the present invention mainly adopts the prediction error L recon and fitting error L reg Two types of loss functions are used to construct optimization objectives. Time series error L recon , that is, the predicted value of the data at time t and the true value s 1:TThe present invention mainly uses the mean square error of the two array deviations as the loss function. At this time, the prediction error is equivalent to p(s 1:T ,A 1:T ,v 1:T ) Maximum likelihood estimation. The fitting error L reg Refers to the normalized adjacency matrix The fitting error of the adjacency matrix template A obtained from the following formula 1 can be expressed as the mean absolute error. The introduction of the fitting error helps to improve the stability of model training.

[0055] The adjacency matrix template A can be used to represent a directed graph, where the element A ij represents a directed edge from node i to node j, and Represents the neighborhood of node i. The model uses the cosine measure e of the embedding representation ji Represents the weight of the edge, that is, the dependency between nodes. Assume that the neighborhood size is K, and select the top K neighbors to define the adjacency matrix, that is

[0056]

[0057] To optimize the neural network model parameters, we only need to minimize the loss function L recon +L reg That's it.

[0058] In order to simplify the training process, the present invention will s t Predicted value The empirical distribution of is expressed as its probability, that is

[0059]

[0060] Different from the prior art, the present invention adopts the TAM algorithm to obtain an approximate representation of the adjacency matrix, and obtains the estimated value through the following three steps based on the definition of the graph attention mechanism GATv2: First, the TAM-based Normalize to get the similarity matrix e, the elements of the matrix e are e in formula (1) ki ; Similarly, the elements of A are A ji And calculate the adjacency matrix A according to formula (1) t Then, according to the definition of GATv2, we get The following representation:

[0061]

[0062] The adjacency matrix estimation at each moment can be achieved through the message passing algorithm of the graph neural network. Finally, for the new aggregated features of each node, its multi-head outputs are spliced ​​together and the output of multiple cascaded fully connected layers is used as the estimate of the current true value.

[0063] Similarly, for the prior distribution p(v 1:T ), the present invention assumes And use the standard normal distribution to initialize it. Due to the calculation and update and The neural networks used in the process are all differentiable, so the model is trainable.

[0064] Model inference process:

[0065] Although the above training process The calculation of contains the information of the previous t moments, but in order to further increase the smoothness of the reasoning result and improve the stability of causal reasoning, the present invention combines the k-order power matrix Perform exception reasoning. k is a constant preset for the scenario, preferably 2 to 5.

[0066] For a specific time series, the error between its predicted value and the current value can be used as the basis for anomaly detection. When the prediction error exceeds a given threshold, it can be considered that the sequence at the current moment is abnormal. Calculate the high-order power matrix of the subsequent k (<<T) long sequence, that is,

[0067]

[0068] At this point, define Estimates Available Considering the normalized adjacency matrix The i-th row represents node v i The greater the similarity to other nodes, the higher the correlation between nodes. It reflects the adjacency relationship of the adjacency matrix at time t after k-step transfer. At this time, since it has not been normalized row by row, if the correlation on a certain edge is small, the strength of the path where the edge is located after k-step transfer is smaller, so it can be obtained by Further suppressing this path results in stronger correlations between nodes and a more stable adjacency matrix. By combining the correlation of edges in the time domain, some neighbors with sudden changes are filtered out from the neighborhood to reduce the sudden changes in system outliers and improve the stability of the alarm threshold.

[0069] At this time, according to It can be seen that the most relevant first l neighbor nodes of each node The present invention defines weighted TAM distance It is expressed as follows:

[0070]

[0071] This distance reflects the consistency of the node data with its neighboring nodes. The smaller the consistency, the greater the possibility of anomaly. At the same time, the average value of the anomaly degree of all nodes is the system anomaly value.

[0072] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiment.

[0073] The present invention also proposes a multivariate time series anomaly detection system based on graph neural network, which includes:

[0074] The initial module is used to obtain the data collected by each sensor in the physical system to be detected for anomalies, and use each sensor as a node in the probabilistic graph model. The data monitored by the sensor is used as the time series. The time series collected by each sensor are combined to obtain a multidimensional time series, and the multidimensional time series relationship is modeled to obtain a dynamic graph neural network model.

[0075] The aggregation module is used to aggregate the features of the nodes in the dynamic graph neural network model using a multi-head attention mechanism to obtain the predicted value of each node at the next time point, and use normalized time alignment to measure the adjacency matrix of each node;

[0076] A training module is used to obtain the true value of the node when the time reaches the next time point, and construct a loss function that introduces the adjacency matrix reconstruction error based on the predicted value and the true value to train and update the dynamic graph neural network model. At the same time, based on the loss function value of each node and the difference in distribution of its neighboring nodes and the adjacency matrix value, the abnormal value of each node is obtained;

[0077] The alarm module is used to generate an abnormal alarm for the corresponding node when the error between the node prediction value and the true value at the same time point is greater than the abnormal value.

[0078] In the multivariate time series anomaly detection system based on graph neural network, training and updating the dynamic graph neural network model in the aggregation module includes:

[0079] For a sensor operating state sequence of length T, the time series error L is used. recon and fitting error L reg The mean square error is used as the loss function; where the time series error L recon is the predicted value of the data at time t and the true value s 1:T The average deviation of the fitting error L reg is the normalized adjacency matrix The fitting error with the adjacency matrix template A;

[0080] The adjacency matrix A is used to represent a directed graph, where the element A ij represents a directed edge from node i to node j, and Represents the neighborhood of node i. The dynamic graph neural network model uses the cosine measure e ji Represents the weight of the edge, that is, the dependency between nodes; the neighborhood size is K, and the top K neighbors are selected to define the adjacency matrix, that is:

[0081]

[0082] By minimizing the loss function, the dynamic graph neural network model is trained and updated, and during the training process, s t Predicted value The empirical distribution of is expressed as its probability:

[0083]

[0084] Among them, the time alignment measure method is used to obtain an approximate representation of the adjacency matrix, and the estimated value is obtained through the following process based on GATv2 Will Normalize to get the similarity matrix e, and calculate the adjacency matrix A according to the above formula (1) t , according to the definition of GATv2, we get The following representation:

[0085]

[0086] For the new aggregated features of each node, its multi-head outputs are spliced ​​together, and the output of multiple cascaded fully connected layers is used as the estimated value of the current true value

[0087] The multivariate time series anomaly detection system based on graph neural network, wherein the training module includes:

[0088] According to the first l most relevant neighbor nodes of each node, the consistency of each node and its neighbor nodes is obtained, and the average value of the consistency is used as the outlier.

[0089] The multivariate time series anomaly detection system based on graph neural network, wherein the physical system to be detected should be an information-physical system containing complex control logic, including power plants, data centers and smart factories, etc., and the sensors include current, voltage, temperature, speed and pressure, torque, flow, and displacement sensors.

[0090] The present invention also proposes a storage medium for storing a program for executing any one of the multivariate time series anomaly detection methods based on graph neural networks.

[0091] The present invention also proposes a client for use in any of the multivariate time series anomaly detection systems based on graph neural networks.

Claims

1. A multivariate time series anomaly detection method based on graph neural network, characterized by: include: Step 1: Obtain the data collected by each sensor in the physical system to be detected for anomaly, use the sensors as nodes in the probabilistic graph model, use the data monitored by the sensors as time series, model the multidimensional time series relationship, and obtain a dynamic graph neural network model; Step 2: A multi-head attention mechanism is used to aggregate the features of the nodes in the dynamic graph neural network model to obtain the predicted value of each node at the next time point, and the adjacency matrix of each node is measured using normalized time alignment; Step 3: When the time reaches the next time point, the true value of the node is obtained. According to the predicted value and the true value, a loss function that introduces the adjacency matrix reconstruction error is constructed to train and update the dynamic graph neural network model. At the same time, the abnormal value of each node is obtained according to the difference in the loss function value of each node and the distribution of its neighboring nodes and the adjacency matrix value. Step 4: Execute steps 1 to 3 repeatedly. When the error between the predicted value and the true value of a node at the same time point is greater than the abnormal value, an abnormal alarm of the corresponding node is generated. Training and updating the dynamic graph neural network model in step 3 includes: For a sensor operating state sequence of length T, the time series error L is used. recon and fitting error L reg The mean square error is used as the loss function; where the time series error L recon is the predicted value of the data at time t and the true value s 1:T The average deviation of the fitting error L reg is the normalized adjacency matrix The fitting error with the adjacency matrix template A; The adjacency matrix A is used to represent a directed graph, where the element A ij represents a directed edge from node i to node j, and Represents the neighborhood of node i. The dynamic graph neural network model uses the cosine measure e ji Represents the weight of the edge, that is, the dependency between nodes; the neighborhood size is K, and the top K neighbors are selected to define the adjacency matrix, that is: By minimizing the loss function, the dynamic graph neural network model is trained and updated, and during the training process, s t Predicted value The empirical distribution of is expressed as its probability: Among them, the time alignment measure method is used to obtain an approximate representation of the adjacency matrix, and the estimated value is obtained through the following steps based on GATv2 Will Normalize to get the similarity matrix e, and calculate the adjacency matrix A according to the above formula (1) t , according to the definition of GATv2, we get The following representation: For the new aggregated features of each node, its multi-head outputs are spliced ​​together, and the output of multiple cascaded fully connected layers is used as the estimated value of the current true value 2. The multivariate time series anomaly detection method based on graph neural network according to claim 1, characterized in that This step 3 includes: According to the most relevant first l neighbor nodes of each node, the consistency of each node and its neighbor nodes is obtained, and the average value of the consistency is used as the outlier value of the corresponding node.

3. The multivariate time series anomaly detection method based on graph neural network according to claim 1, characterized in that The physical system to be detected for anomalies should be an information-physical system containing complex control logic, including power plants, data centers and smart factories; the sensors include current, voltage, temperature, speed and pressure, torque, flow and displacement sensors.

4. A multivariate time series anomaly detection system based on graph neural network, characterized by: include: The initial module is used to obtain the data collected by each sensor in the physical system to be detected for anomalies, and uses the sensors as nodes in the probabilistic graph model and the data monitored by the sensors as time series to model the multidimensional time series relationship and obtain a dynamic graph neural network model; The aggregation module is used to aggregate the features of the nodes in the dynamic graph neural network model using a multi-head attention mechanism to obtain the predicted value of each node at the next time point, and use normalized time alignment to measure the adjacency matrix of each node; The training module is used to obtain the true value of the node when the time reaches the next time point, and construct a loss function that introduces the adjacency matrix reconstruction error based on the predicted value and the true value to train and update the dynamic graph neural network model. At the same time, the abnormal value of each node is obtained based on the loss function value of each node and the difference in the distribution of its neighboring nodes and the adjacency matrix value; The alarm module is used to generate an abnormal alarm for the corresponding node when the error between the predicted value and the actual value of the node at the same time point is greater than the set threshold; The training module includes the following steps to update the dynamic graph neural network model: For a sensor operating state sequence of length T, the time series error L is used. recon and fitting error L reg The mean square error is used as the loss function; where the time series error L recon is the predicted value of the data at time t and the true value s 1:T The average deviation of the fitting error L reg is the normalized adjacency matrix The fitting error with the adjacency matrix template A; The adjacency matrix A is used to represent a directed graph, where the element A ij represents a directed edge from node i to node j, and Represents the neighborhood of node i. The dynamic graph neural network model uses the cosine measure e ji Represents the weight of the edge, that is, the dependency between nodes; the neighborhood size is K, and the top K neighbors are selected to define the adjacency matrix, that is: By minimizing the loss function, the dynamic graph neural network model is trained and updated, and during the training process, s t Predicted value The empirical distribution of is expressed as its probability: Among them, the time alignment measure method is used to obtain an approximate representation of the adjacency matrix, and the estimated value is obtained through the following process based on GATv2 Will Normalize to get the similarity matrix e, and calculate the adjacency matrix A according to the above formula (1) t , according to the definition of GATv2, we get The following representation: For the new aggregated features of each node, its multi-head outputs are spliced ​​together, and the output of multiple cascaded fully connected layers is used as the estimated value of the current true value 5. The multivariate time series anomaly detection system based on graph neural network according to claim 4, characterized in that This training module includes: According to the most relevant first l neighbor nodes of each node, the consistency of each node and its neighbor nodes is obtained, and the average value of the consistency is used as the outlier value of the corresponding node.

6. The multivariate time series anomaly detection system based on graph neural network according to claim 4, characterized in that The physical system to be detected for anomalies should be an information-physical system containing complex control logic, including power plants, data centers and smart factories. The sensors include current, voltage, temperature, speed and pressure, torque, flow and displacement sensors.

7. A storage medium for storing a program for executing any one of the multivariate time series anomaly detection methods based on graph neural networks as described in claims 1 to 3.

8. A client for use in any one of the graph neural network-based multivariate time series anomaly detection systems of claims 4 to 6.

Images