Time series anomaly detection method based on unscented Kalman filter

Abstract

The present invention relates to the field of network security technology and proposes a time series anomaly detection method based on an unscented Kalman filter, which includes the following steps: receiving time series data from one or more devices in an information-physical system and preprocessing the time series data; inputting the preprocessed time series data into a neural network model based on an unscented Kalman filter, and predicting the time series at time t to obtain a predicted sequence at time t+1; comparing the predicted sequence at time t+1 with the measured value sequence at time t+1, and if the error value exceeds a preset threshold, it is determined that the time series is abnormal; otherwise, it is determined that the time series is normal. By combining the expressive power of a neural network and the optimal estimation capability of an unscented Kalman filter, the present invention has the advantages of being able to maintain a stable error for a long time and accurately detect anomalies in sensor data in an information-physical fusion system.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and more particularly to a time series anomaly detection method based on unscented Kalman filtering. Background Art

[0002] Deep learning-based intrusion detection models have become a research hotspot in the field of network security. The goal of intrusion detection is to detect violations of security policies or system security by examining operating system audit data or network packet information, thereby instructing the operating system to take appropriate action. Intrusion detection methods are generally categorized into anomaly detection, misuse detection, and signature detection. Anomaly detection is a behavior-based intrusion detection technique that uses information about the normal behavior of the monitored system as a basis for detecting intrusions and abnormal activity within the system.

[0003] Traditional methods for detecting anomalies in time series processing include distance-based detection techniques, such as the k-adjacency matrix and Support Vector Machine (SVM) classification. However, with technological advancements, the number and types of sensors and devices in cyber-physical systems (CPS) are increasing, and the system feature dimensions or model dimensions are also increasing. Traditional time series anomaly detection methods are no longer effective in detecting time series anomalies. Meanwhile, methods based on recurrent neural networks (RNNs) are becoming popular in the field of time series anomaly detection. However, RNNs require high computing power and time, and their high cost makes ordinary RNNs unable to meet people's needs. Moreover, as CPSs become more complex, the impact of continuous noise becomes more prominent, and time series anomaly detection using RNNs suffers from low detection accuracy. Summary of the Invention

[0004] In order to overcome the defect of low detection accuracy of time series anomaly detection using RNNs described in the above-mentioned prior art, the present invention provides a time series anomaly detection method based on unscented Kalman filtering.

[0005] In order to solve the above technical problems, the technical solutions of the present invention are as follows:

[0006] The time series anomaly detection method based on unscented Kalman filtering includes the following steps:

[0007] S1. Receive time series data from one or more devices in the cyber-physical system and pre-process the time series data; the time series data includes the measurement value x of the device at time t t and execution state vector u t ;

[0008] S2. Input the preprocessed time series data into the neural network model based on the unscented Kalman filter to obtain the predicted sequence at time t+1;

[0009] Wherein, the neural network model includes:

[0010] The first subnetwork is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ;

[0011] The second subnetwork is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ;

[0012] The third sub-network is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ;

[0013] And, the unscented Kalman filter module is used to predict the measurement value X according to the t+1 , calculate the prediction sequence at time t+1 based on the unscented Kalman filter principle;

[0014] S3. Compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds the preset threshold, it is determined that the time series is abnormal; otherwise, it is determined that the time series is normal.

[0015] As a preferred solution, in the step S1, the step of preprocessing the time series data includes: performing missing distribution analysis on the time series data; and performing an interpolation operation on the time series data using an E2GAN network model according to the missing distribution of the time series data.

[0016] As a preferred solution, the convolutional neural network preset in the second sub-network includes a convolutional long short-term memory network based on an attention mechanism.

[0017] As a preferred solution, in the second sub-network, a sliding window with a length of l is used to select the measurement value x with a time series length of l. t-l+1；t and execution state vector u t-l+1；t As the input of the convolutional neural network, the measurement value x t -l+1；t , execution state vector u t-l+1；tThe superscript in represents the point set in the time interval [t-l+1,t].

[0018] As a preferred solution, the method further includes optimizing and training the neural network model; wherein the expression of the neural network model is as follows:

[0019] z t+1 =(A*z t , B*u t )+ω t

[0020] x t+1 =H*z t+1 +v t+1

[0021] Where A is the state transfer matrix, B is the control input matrix, and H is the state measurement matrix; ω t represents the process noise at time t, v t+1 represents the measurement noise at time t+1, and the process noise ω t and measurement noise v t+1 The mean of is 0;

[0022] The neural network model is trained using a stochastic gradient descent algorithm, and the neural network model is converted to:

[0023]

[0024]

[0025]

[0026]

[0027] Where a_net(·), b_net(·), and c_net(·) represent the outputs of the first, second, and third subnetworks, respectively; (x,u) t-l+1；t The set of points representing the time interval [t-l+1,t] is one of the input values ​​of the second sub-network, and contains a sequence of measurement values ​​and execution state vectors; is the hidden state prediction error vector at time t+1, Reconstruct the error vector for the measurement at time t+1.

[0028] As a preferred solution, in the unscented Kalman filter module, the step of calculating the prediction sequence at time t+1 based on the unscented Kalman filter principle includes:

[0029] Step A: The posterior mean matrix of the predicted state vector distribution at time t and covariance matrix Input the unscented Kalman filter module and predict the mean weight set w at time t+1 through the sigma function m and variance weight set w c ; Its expression is as follows:

[0030]

[0031] Where Z is the sigma point set, the number of points in the point set is 2n+1, and n is the mean matrix The dimension of the Z point set is the mean matrix and covariance matrix of and approach;

[0032] Step B: Use the unscented transformation to predict the prior mean matrix of the distribution of the predicted state vector at time t+1 and covariance matrix Its expression is as follows:

[0033]

[0034]

[0035] Where, represents the mean weight set w m The i-th mean weight element in , represents the variance weight set w m The i-th variance weight element in Y i represents the i-th predicted state vector element in the predicted state vector Y output by the second sub-network, and Q is the covariance matrix of the hidden state prediction error vector;

[0036] Step C: Use the unscented transform to predict the mean μ and covariance Σ of the distribution of the predicted measurement value at time t+1, use the mean μ as the predicted measurement value at time t+1, obtain the predicted sequence at time t+1 and output it; its expression is as follows:

[0037]

[0038]

[0039] Where R is the covariance matrix of the predicted measurement error vector; X i Represents the i-th predicted measurement value element in the predicted measurement value sequence X;

[0040] Step D: Calculate the current Kalman gain K and predict the posterior mean matrix at time t+1 based on the current Kalman gain K and covariance matrix Its expression is as follows:

[0041]

[0042]

[0043]

[0044] Where T is the transposition symbol.

[0045] Furthermore, the present invention also proposes a time series anomaly detection system based on an unscented Kalman filter, which is applied to implement the time series anomaly detection method based on an unscented Kalman filter proposed in any of the above technical solutions. This includes:

[0046] A data acquisition module, configured to receive time series data from one or more devices in the cyber-physical system and pre-process the time series data;

[0047] The first sub-network module is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ;

[0048] The second sub-network module is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ;

[0049] The third sub-network module is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ;

[0050] Unscented Kalman filter module, used to predict the measured value X according to the t+1 , calculate the prediction sequence at time t+1 based on the unscented Kalman filter principle;

[0051] The anomaly detection module is used to compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds the preset threshold, the detection result of the time series anomaly is output; otherwise, the detection result of the time series normal is output.

[0052] As a preferred solution, the data acquisition module includes an E2GAN network model for performing interpolation operations on the collected time series data.

[0053] As a preferred solution, the convolutional neural network preset in the second sub-network module includes a convolutional long short-term memory network based on an attention mechanism.

[0054] As a preferred solution, in the second sub-network, a sliding window with a length of l is used to select the measurement value x with a time series length of l. t-l+1；t and execution state vector u t-l+1；t As the input of the convolutional neural network, the measurement value x t -l+1；t , execution state vector u t-l+1；t The superscript in represents the point set in the time interval [t-l+1,t].

[0055] Compared with existing technologies, the technical solution of the present invention offers the following advantages: by combining the expressive power of neural networks with the optimal estimation capabilities of unscented Kalman filters, the present invention maintains long-term error stability and accurately detects anomalies in sensor data within cyber-physical fusion systems. Furthermore, because the present time series anomaly detection method is purely data-driven and does not require any specific domain knowledge, it exhibits excellent generalizability. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 This is a flowchart of the time series anomaly detection method based on unscented Kalman filtering in Example 1.

[0057] Figure 2 This is a flowchart of the time series anomaly detection method based on unscented Kalman filtering in Example 2.

[0058] Figure 3 This is a schematic diagram of the principle of the unscented Kalman filter module of Example 2.

[0059] Figure 4 This is an architectural diagram of the time series anomaly detection system based on unscented Kalman filtering in Example 3. DETAILED DESCRIPTION

[0060] The accompanying drawings are for illustrative purposes only and are not to be construed as limiting this patent;

[0061] In order to better illustrate this embodiment, some parts in the drawings may be omitted, enlarged, or reduced, and do not represent the actual product size;

[0062] It is understandable to those skilled in the art that some well-known structures and descriptions thereof may be omitted in the drawings.

[0063] The technical solution of the present invention is further described below with reference to the accompanying drawings and embodiments.

[0064] Example 1

[0065] This embodiment proposes a time series anomaly detection method based on unscented Kalman filtering, such as Figure 1 , which is a flow chart of the time series anomaly detection method based on unscented Kalman filtering in this embodiment.

[0066] The time series anomaly detection method based on unscented Kalman filtering proposed in this embodiment includes the following steps:

[0067] S1. Receive time series data from one or more devices in the cyber-physical system and pre-process the time series data; the time series data includes the measurement value x of the device at time t t and execution state vector u t .

[0068] S2. Input the preprocessed time series data into the neural network model based on the unscented Kalman filter to obtain the prediction sequence at time t+1.

[0069] S3. Compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds the preset threshold, it is determined that the time series is abnormal; otherwise, it is determined that the time series is normal.

[0070] In this embodiment, the neural network model based on the unscented Kalman filter includes:

[0071] The first subnetwork is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ;

[0072] The second subnetwork is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ;

[0073] The third sub-network is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ;

[0074] And, the unscented Kalman filter module is used to predict the measurement value X according to the t+1 , based on the unscented Kalman filter principle, the prediction sequence at time t+1 is calculated.

[0075] The first sub-network is a backward feedback network that converts the measured value x tEncoded into a lower dimensional hidden state vector z t , which facilitates feature analysis; the third sub-network is a feedforward network.

[0076] The unscented Kalman filter module uses the predicted measurement value X generated by the neural network model t+1 and the predicted state vector Y t +1 The mean and covariance of the predicted values, as well as the actual measured values, are used to calculate the predicted value sequence for the next moment, which is further used to compare the collected actual measured values ​​at the next moment to realize time series anomaly detection.

[0077] This embodiment takes into account the uncertainty of time series data prediction and adopts Bayesian filtering methods such as unscented Kalman filtering, which has a significant ability to track uncertainty and has a good effect on optimal system state estimation.

[0078] In this embodiment, anomaly detection for time series can be transformed into anomaly detection for system states. It's important to note that the unscented Kalman filter is applicable to linear discrete systems. Since most cyber-physical systems (CPSs) in reality contain white noise, CPSs are also linear discrete systems, making them particularly suitable for the unscented Kalman filter.

[0079] In an optional embodiment, in step S1, the step of preprocessing the time series data includes:

[0080] S1.1. Analyze the missing distribution of time series data;

[0081] S1.2. Based on the missing distribution of the time series data, the E2GAN network model is used to interpolate the time series data.

[0082] In this embodiment, when preprocessing the collected time series data, the missing distribution analysis is first performed on the time series data. Specifically, based on the missing distribution, the time series data is determined to be either completely random missing, random missing, or completely non-random missing. Then, based on the missing type of the time series data, the E2GAN network model is used to interpolate the time series data.

[0083] Among them, the E2GAN network model is an end-to-end GAN-based interpolation model that not only simplifies the time series interpolation process but also generates more reasonable fill-in values. The E2GAN model adopts a compression and reconstruction strategy to avoid the "noise" optimization phase. First, in the generator, a random vector is added to the original sample and an attempt is made to map it to a low-dimensional vector. Then, it is reconstructed from the low-dimensional vector. The generator seeks to find a network structure that can not only best compress and reconstruct the multivariate time series but also deceive the discriminator. This method automatically learns the internal representation of the time series and reconstructs this time data as closely as possible. This architecture also improves interpolation performance by obtaining better sample feature representations. Finally, the reconstructed samples are used to interpolate missing values, resulting in the completed interpolated time series data.

[0084] In an optional embodiment, the convolutional neural network preset in the second sub-network includes a convolutional long short-term memory network convLSTM based on an attention mechanism.

[0085] Among them, the convolutional long short-term memory network convLSTM not only has the good feature extraction characteristics of convolutional neural networks, but also has the good characteristics of recording context information of the attention-based long short-term memory network and solving the RNN gradient disappearance problem to a certain extent, and can also solve the time dependency problem very well.

[0086] Furthermore, in the second sub-network, a sliding window with a length of l is used to select the measurement value x with a time series length of l. t-l+1；t and execution state vector u t-l+1；t As the input of the convolutional neural network, the measurement value x t-l+1；t , execution state vector u t-l+1；t The superscript in represents the point set in the time interval [t-l+1,t].

[0087] In an optional embodiment, the step S3 uses a point-adjust method to determine abnormalities in the time series.

[0088] By combining the expressive power of neural networks with the optimal estimation capabilities of unscented Kalman filtering, this embodiment maintains long-term error stability and accurately detects anomalies in sensor data within cyber-physical fusion systems. Furthermore, because this embodiment's time series anomaly detection method is purely data-driven and does not require any specific domain knowledge, it exhibits excellent generalizability.

[0089] Example 2

[0090] This embodiment further improves the time series anomaly detection method based on unscented Kalman filtering proposed in Example 1.

[0091] like Figure 2 , which is a flow chart of the time series anomaly detection method based on unscented Kalman filtering in this embodiment.

[0092] The time series anomaly detection method based on unscented Kalman filtering proposed in this embodiment includes the following steps:

[0093] S1. Receive time series data from one or more devices in the cyber-physical system and pre-process the time series data; the time series data includes the measurement value x of the device at time t t and execution state vector u t .

[0094] S2. Input the preprocessed time series data into the neural network model based on the unscented Kalman filter to obtain the prediction sequence at time t+1.

[0095] S3. Compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds the preset threshold, it is determined that the time series is abnormal; otherwise, it is determined that the time series is normal.

[0096] In this embodiment, the neural network model based on the unscented Kalman filter includes:

[0097] The first subnetwork is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ;

[0098] The second subnetwork is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ;

[0099] The third sub-network is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ;

[0100] And, the unscented Kalman filter module is used to predict the measurement value X according to the t+1 , based on the unscented Kalman filter principle, the prediction sequence at time t+1 is calculated.

[0101] Furthermore, step S2 of this embodiment further includes optimizing and training the neural network model. The expression of the neural network model of this embodiment is as follows:

[0102] z t+1 =(A*z t , B*u t )+ω t

[0103] x t+1 =H*z t+1 +v t+1

[0104] Where A is the state transfer matrix, B is the control input matrix, and H is the state measurement matrix; ω t represents the process noise at time t, v t+1 represents the measurement noise at time t+1.

[0105] The process noise ω in this embodiment t and measurement noise v t+1 The mean is 0, and the covariances are Q and R respectively, that is, P(ω)∈N(0,Q), P(v)∈N(0,R).

[0106] The collected data set is divided into a certain proportion to obtain training set data, the training set data is input into the neural network model, and the neural network model is trained using a stochastic gradient descent algorithm (such as Adam).

[0107] The neural network model is converted to:

[0108]

[0109]

[0110]

[0111]

[0112] Where a_net(·), b_net(·), and c_net(·) represent the outputs of the first, second, and third subnetworks, respectively; (x,u) t-l+1；t The set of points representing the time interval [t-l+1,t] is one of the input values ​​of the second sub-network, which contains a sequence of measurement values ​​and execution state vectors; is the hidden state prediction error vector at time t+1, Reconstruct the error vector for the measurement at time t+1.

[0113] Further, if Figure 3 As shown, in the unscented Kalman filter module, the step of calculating the prediction sequence at time t+1 based on the unscented Kalman filter principle includes:

[0114] Step A: The posterior mean matrix of the predicted state vector distribution at time t and covariance matrix Input the unscented Kalman filter module and predict the mean weight set w at time t+1 through the sigma function m and variance weight set w c ; Its expression is as follows:

[0115]

[0116] Where Z is the sigma point set, the number of points in the point set is 2n+1, and n is the mean matrix The dimension of the Z point set is the mean matrix and covariance matrix of and approach;

[0117] Step B: Use the unscented transformation to predict the prior mean matrix of the distribution of the predicted state vector at time t+1 and covariance matrix Its expression is as follows:

[0118]

[0119]

[0120] Where, represents the mean weight set w m The i-th mean weight element in , represents the variance weight set w m The i-th variance weight element in Y i represents the i-th predicted state vector element in the predicted state vector Y output by the second sub-network, and Q is the covariance matrix of the hidden state prediction error vector;

[0121] Step C: Use the unscented transform to predict the mean μ and covariance Σ of the distribution of the predicted measurement value at time t+1, use the mean μ as the predicted measurement value at time t+1, obtain the predicted sequence at time t+1 and output it; its expression is as follows:

[0122]

[0123]

[0124] Where R is the covariance matrix of the predicted measurement error vector; X i Represents the i-th predicted measurement value element in the predicted measurement value sequence X;

[0125] Step D: Calculate the current Kalman gain K and predict the posterior mean matrix at time t+1 based on the current Kalman gain K and covariance matrix Its expression is as follows:

[0126]

[0127]

[0128]

[0129] Where T is the transposition symbol.

[0130] In the step S3, the step S2 is looped until the predicted sequence of all moments is obtained, and then the step S3 is executed to compare the predicted sequence with the actual measurement value. If the error value exceeds the preset threshold, it is determined that the time series is abnormal; otherwise, it is determined that the time series is normal.

[0131] Example 3

[0132] This embodiment proposes a time series anomaly detection system based on unscented Kalman filtering, such as Figure 4 , which is an architecture diagram of the time series anomaly detection system of this embodiment.

[0133] The time series anomaly detection system based on unscented Kalman filtering proposed in this embodiment includes:

[0134] Data acquisition module 1, used to receive time series data from one or more devices in the cyber-physical system and pre-process the time series data;

[0135] The first sub-network module 2 is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ;

[0136] The second sub-network module 3 is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ;

[0137] The third sub-network module 4 is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ;

[0138] Unscented Kalman filter module 5, for predicting the measured value X t+1, calculate the prediction sequence at time t+1 based on the unscented Kalman filter principle;

[0139] The anomaly detection module 6 is used to compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds a preset threshold, the detection result of the time series anomaly is output; otherwise, the detection result of the time series normal is output.

[0140] In an optional embodiment, the data acquisition module 1 includes an E2GAN network model for performing interpolation operations on the collected time series data.

[0141] In an optional embodiment, the convolutional neural network preset in the second sub-network module 3 includes a convolutional long short-term memory network based on an attention mechanism.

[0142] In an optional embodiment, in the second sub-network module 3, a sliding window with a length of l is used to select the measurement value x with a time series length of l. t-l+1；t and execution state vector u t-l+1；t As the input of the convolutional neural network, the measurement value x t-l+1；t , execution state vector u t-l+1；t The superscript in represents the point set in the time interval [t-l+1,t].

[0143] In a specific implementation process, the data acquisition module 1 receives time series data from one or more devices in the cyber-physical system and preprocesses the time series data. The data acquisition module 1 performs a missing distribution analysis on the collected time series data, and interpolates the time series data using the E2GAN network model based on the missing distribution of the time series data, and outputs the preprocessed time series data. The time series data includes the measurement value x of the device at time t t and execution state vector u t .

[0144] The first sub-network module 2 receives the measurement value x from the data acquisition module 1 t And encode it into a low-dimensional hidden state vector z t The first sub-network module 2 converts the encoded hidden state vector z t Output to the second sub-network module 3.

[0145] The second sub-network module 3 receives the measurement value x from the data acquisition module 1 t and execution state vector u t , the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector ht Then the intermediate hidden state vector h t The hidden state vector z output by the first sub-network module 2 t Combine them to get the predicted state vector Y at the next moment t+1 t+1 And output to the third sub-network module 4 and the unscented Kalman filter module 5.

[0146] The third sub-network module 4 outputs the predicted state vector Y of the second sub-network module 3 t+1 Decode and get the predicted measurement value X t+1 , and output to the unscented Kalman filter module 5.

[0147] The unscented Kalman filter module 5 receives the predicted state vector Y t+1 and the predicted measured value X t+1 , based on the unscented Kalman filter principle, the prediction sequence at time t+1 is calculated.

[0148] Specifically, the posterior mean matrix of the predicted state vector distribution at time t is and covariance matrix Input the unscented Kalman filter module 5 and predict the mean weight set w at time t+1 through the sigma function m and variance weight set w c , then combined with the mean weight set w m and variance weight set w c , use the unscented transformation to predict the prior mean matrix of the distribution of the predicted state vector at time t+1 and covariance matrix Further combined with the prior mean matrix and covariance matrix The unscented transform is used to predict the mean μ and covariance Σ of the distribution of the predicted measurement value at time t+1, and the mean μ is used as the predicted measurement value at time t+1 to obtain the predicted sequence at time t+1 and output it.

[0149] At the same time, the unscented Kalman filter module 5 calculates the current Kalman gain K and predicts the posterior mean matrix at time t+1 based on the current Kalman gain K and covariance matrix Used for the next filtering prediction.

[0150] The anomaly detection module 6 uses the adjust-point method to compare the predicted sequence at time t+1 output by the unscented Kalman filter module 5 with the actual measurement value at time t+1 collected by the data acquisition module 1. If the error value exceeds the preset threshold, the detection result of the time series anomaly is output; otherwise, the detection result of the time series normal is output.

[0151] The same or similar reference numerals correspond to the same or similar components;

[0152] The terms used in the drawings to describe positional relationships are for illustrative purposes only and should not be construed as limiting this patent;

[0153] Obviously, the above embodiments of the present invention are merely examples for the purpose of clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. Those skilled in the art will appreciate that other variations or modifications can be made based on the above description. It is not necessary and impossible to enumerate all embodiments here. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention shall be included within the scope of protection of the claims of the present invention.

Claims

1. A time series anomaly detection method based on unscented Kalman filtering, characterized in that: The following steps are involved: S1. Receive time series data from one or more devices in the cyber-physical system and pre-process the time series data; the time series data includes the measurement value x of the device at time t t and execution state vector u t ; S2. Input the preprocessed time series data into the neural network model based on the unscented Kalman filter to obtain the predicted sequence at time t+1; Wherein, the neural network model includes: The first subnetwork is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ; The second subnetwork is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ; The third sub-network is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ; And, the unscented Kalman filter module is used to predict the measurement value X according to the t+1 , calculate the prediction sequence at time t+1 based on the unscented Kalman filter principle; The method further includes training the neural network model using a stochastic gradient descent algorithm, wherein the neural network model is converted to: Where a_net(·), b_net(·), and c_net(·) represent the outputs of the first, second, and third subnetworks, respectively; (x,u) t-l+1；t The set of points representing the time interval [t-l+1,t] is one of the input values ​​of the second sub-network, and contains a sequence of measurement values ​​and execution state vectors; is the hidden state prediction error vector at time t+1, Reconstruct the error vector for the measurement at time t+1; S3. Compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds the preset threshold, it is determined that the time series is abnormal; otherwise, it is determined that the time series is normal.

2. The time series anomaly detection method according to claim 1, characterized in that: In step S1, the step of preprocessing the time series data includes: Perform missing distribution analysis on time series data; According to the missing distribution of time series data, the E2GAN network model is used to perform interpolation operations on the time series data.

3. The time series anomaly detection method according to claim 1, characterized in that: The convolutional neural network preset in the second sub-network includes a convolutional long short-term memory network based on an attention mechanism.

4. The time series anomaly detection method according to claim 3, characterized in that: In the second sub-network, a sliding window with a length of l is used to select the measurement value x with a time series length of l. t-l+1；t and execution state vector u t-l+1；t As the input of the convolutional neural network, the measurement value x t-l+1；t , execution state vector u t-l+1；t The superscript in represents the point set in the time interval [t-l+1,t].

5. The time series anomaly detection method according to claim 4, characterized in that: The expression of the neural network model is as follows: z t+1 =(a*z t ,B*u t )+ω t x t+1 =H*z t+1 +v t+1 Where A is the state transfer matrix, B is the control input matrix, and H is the state measurement matrix; ω t represents the process noise at time t, v t+1 represents the measurement noise at time t+1, and the process noise ω t and measurement noise v t+1 The mean of is 0.

6. The time series anomaly detection method according to any one of claims 1 to 5, characterized in that: In the unscented Kalman filter module, the step of calculating the prediction sequence at time t+1 based on the unscented Kalman filter principle includes: Step A: The posterior mean matrix of the predicted state vector distribution at time t and the covariance matrix Input the unscented Kalman filter module and predict the mean weight set w at time t+1 through the sigma function m and variance weight set w c ; Its expression is as follows: Where Z is the sigma point set, the number of points in the point set is 2n+1, and n is the mean matrix The dimension of the Z point set is the mean matrix and covariance matrix of and approach; Step B: Use the unscented transformation to predict the prior mean matrix of the distribution of the predicted state vector at time t+1 and the covariance matrix Its expression is as follows: Where, represents the mean weight set w m The i-th mean weight element in , represents the variance weight set w m The i-th variance weight element in Y i represents the i-th predicted state vector element in the predicted state vector Y output by the second sub-network, and Q is the covariance matrix of the hidden state prediction error vector; Step C: Use the unscented transform to predict the mean μ and covariance Σ of the distribution of the predicted measurement value at time t+1, use the mean μ as the predicted measurement value at time t+1, obtain the predicted sequence at time t+1 and output it; its expression is as follows: Where R is the covariance matrix of the predicted measurement error vector; X i Represents the i-th predicted measurement value element in the predicted measurement value sequence X; Step D: Calculate the current Kalman gain K and predict the posterior mean matrix at time t+1 based on the current Kalman gain K and the covariance matrix Its expression is as follows: Where T is the transposition symbol.

7. A time series anomaly detection system based on an unscented Kalman filter, applied to the time series anomaly detection method based on an unscented Kalman filter according to any one of claims 1 to 6, characterized in that: include: A data acquisition module, configured to receive time series data from one or more devices in the cyber-physical system and pre-process the time series data; The first sub-network module is used to convert the measured value x t Encoded as a low-dimensional hidden state vector z t ; The second sub-network module is used to convert the measured value x t and execution state vector u t The preset convolutional neural network is encoded into an intermediate hidden state vector h t , and the intermediate hidden state vector h t With the hidden state vector z t Combined to get the predicted state vector Y at the next moment t+1 t+1 ; The third sub-network module is used to predict the state vector Y t+1 Decode and get the predicted measurement value X t+1 ; Unscented Kalman filter module, used to predict the measured value X according to the t+1 , calculate the prediction sequence at time t+1 based on the unscented Kalman filter principle; The anomaly detection module is used to compare the predicted sequence at time t+1 with the measured value sequence at time t+1. If the error value exceeds the preset threshold, the detection result of the time series anomaly is output; otherwise, the detection result of the time series normal is output.

8. The time series anomaly detection system according to claim 7, characterized in that: The data acquisition module includes an E2GAN network model, which is used to perform interpolation operations on the collected time series data.

9. The time series anomaly detection system according to claim 7, characterized in that: The convolutional neural network preset in the second sub-network module includes a convolutional long short-term memory network based on an attention mechanism.

10. The time series anomaly detection system according to claim 7, characterized in that: In the second sub-network module, a sliding window with a length of l is used to select the measurement value x with a time series length of l. t-l+1；t and execution state vector u t-l+1；t As the input of the convolutional neural network, the measurement value x t-l+1；t , execution state vector u t-l+1；t The superscript in represents the point set in the time interval [t-l+1,t].

Images