A multi-constraint anomaly detection method for time series data

Abstract

A multi-constraint-based time series data anomaly detection method addresses the low accuracy and reliability of anomaly detection results from sensor time series in induced draft fan systems. The method first obtains a multivariate time series and defines multiple constraints. The constraints are then used to inspect the multivariate time series to obtain its violation intervals, which are then divided into groups called violation interval subsets, resulting in multiple groups of violation interval subsets. The violation intervals in each group of violation interval subsets are then connected, and a time interval is defined for each connected group of violation interval subsets. All violation intervals within each violation interval subset are aligned based on their time intervals, resulting in each aligned group of violation interval subsets. The anomaly score for each univariate time series in each aligned group of violation interval subsets is calculated, and whether the univariate time series is abnormal is determined based on the anomaly score. This method relates to the field of data anomaly detection.

Description

Technical Field

[0001] The present invention relates to a data anomaly detection method, and belongs to the field of data anomaly detection. Background Art

[0002] An induced draft fan system is equipped with voltage, current, and temperature sensors. The deployment and operation of these sensors enables real-time awareness of the equipment's operating status and operating environment. By analyzing and mining the multivariate time series data collected by these sensors, valuable domain knowledge can be obtained, enabling analysis, control, decision-making, diagnosis, early warning, and fault detection of the induced draft fan system's operating status. Anomaly detection and fault analysis are crucial for intelligent manufacturing.

[0003] Currently, time series anomaly detection is based on statistical indicators. In specific domains such as industry, commerce, and healthcare, rule-based time series anomaly detection is also a major technical approach. This method is easy to use and can effectively detect anomalies in data through accumulated business knowledge rules. It can effectively detect abnormal data in a sequence, but such methods rely on a relatively complete domain business rule library. Without the accumulation of business rule knowledge, it is difficult for users to effectively detect anomalies using precise rule constraints. Furthermore, the descriptions of business rules are often not specific enough, and the parameter values ​​of the rules are not set accurately enough. Therefore, when the sensors in the induced draft fan system use rule-based time series anomaly detection methods, the time series anomaly detection results are low in accuracy and reliability. Currently, there is a lack of effective methods for modifying and improving inaccurate rule constraints. Summary of the Invention

[0004] In order to solve the problem that when each sensor in the induced draft fan system adopts a time series anomaly detection method based on rule constraints, it is necessary to rely on a rule base for anomaly detection, and the description of the rules is not specific enough, and the parameter value setting of the rules is not accurate, resulting in low accuracy and low reliability of the time series anomaly detection results, the present invention proposes a time series data anomaly detection method based on multiple constraints.

[0005] The technical solution adopted by the present invention is: aligning the detection results of multiple rules and revising the rule participation in the rule base based on manual feedback.

[0006] It includes the following steps:

[0007] S1. Obtain a multivariate time series of a group of sensors in an induced draft fan system, define the multivariate time series as consisting of multiple unary time series, and define multiple constraints, including a range constraint, a speed constraint, and a function constraint;

[0008] S2. Using the defined constraints, the multivariate time series is checked to obtain the violation intervals of the multivariate time series, and the violation intervals are divided into a group, which is called a violation interval subset, to obtain multiple groups of violation interval subsets;

[0009] S3, connecting the violation intervals in each group of violation interval subsets;

[0010] S4, defining the time interval of each group of violation interval subsets after connection;

[0011] S5. Align all violation intervals in each violation interval subset according to the time interval of the violation interval subset to obtain an aligned violation interval subset;

[0012] S6. Calculate the anomaly score of each univariate time series in each group of aligned violation interval subsets, and determine whether the univariate time series is abnormal based on the anomaly score.

[0013] Furthermore, in S1, a multivariate time series of a group of sensors in the induced draft fan system is obtained, the multivariate time series is defined to be composed of multiple unary time series, and multiple constraints are defined, including range constraints, speed constraints, and function constraints. The specific process is as follows:

[0014] Obtain a multivariate time series of a group of sensors in the induced draft fan system, and define the multivariate time series as consisting of multiple unary time series, each unary time series corresponding to one feature;

[0015] Range constraint: a univariate time series x f The observation value x corresponding to any time stamp t t Cannot exceed a certain range interval, the range constraint operation is O1(x t )=x f ;

[0016] Speed ​​constraint: Given a time window w, a univariate time series x f The data observation value x at any two moments in the time window w t The speed of change is within the speed constraint range, and the speed constraint operation is: Where t represents a timestamp, t' represents any other timestamp in the time window, and x t Represents a univariate time series x f The observation value at time stamp t, x t' Represents a univariate time series x f The observation value at time stamp t';

[0017] Function constraint: For a specified time series of a multivariate time series X The observation value corresponding to any time stamp t After a certain function transformation, the value falls within a certain range. The function transformation is to select multiple operators from a given operator set and perform any number of combinations. Given an operator set B = {+, -, *, / , (,)}, the operation of the function constraint

[0018] Furthermore, in S2, the defined constraints are used to check the multivariate time series to obtain the violation intervals of the multivariate time series, and the violation intervals are divided into a group, which is called a violation interval subset. Multiple groups of violation interval subsets are obtained. The specific process is as follows:

[0019] One or more constraints are used to check the multivariate time series to obtain the constrained multivariate time series. If the observation values ​​at each timestamp in a certain time interval of the constrained multivariate time series are all outside the corresponding constraint range, then the time interval is called a violation interval. Each violation interval contains the time interval and the original violation constraint. When the time intervals of multiple violation intervals are adjacent, intersecting, or containing each other, they are divided into a group of violation interval subsets, and multiple groups of violation interval subsets are obtained.

[0020] Furthermore, in S3, the illegal intervals in each illegal interval subset are connected. The specific process is as follows:

[0021] A constraint repair strategy is defined, and the constraint repair strategy is used to perform constraint repair on the violation intervals. The violation intervals after constraint repair are connected to obtain a subset of each group of violation intervals after connection.

[0022] Furthermore, the violation intervals determined by the speed constraint are not connected.

[0023] Furthermore, the constraint repair strategy includes a constraint tightening strategy and a constraint expansion strategy;

[0024] The constraint tightening strategy is to adjust the upper and lower limits of the constraint range to be close to the middle value of the range. The specific process is as follows;

[0025] 1) Use constraint C to constrain the multivariate time series X, and record the result set of constraints as Where c represents any one or more constraints; X t represents the set of observations of the multivariate time series X at timestamp t; T represents the timestamp set; O represents the operation corresponding to the constraint c;

[0026] 2) Repair the constraints according to the constraint tightening strategy expression to obtain the upper and lower limits of the range after the constraint tightening;

[0027] Constraint tightening strategy expression:

[0028] min(max(c)-max(c)')+(min(c)'-min(c))

[0029] st(res y -max(c)')*(res y -min(c)')≥0 res y ∈RES(c,X T )

[0030] max(c)'≤max(c)

[0031] min(c)≤min(c)'

[0032] Among them, max(c) represents the upper limit of the constraint range, and min(c) represents the lower limit of the constraint range;

[0033] max(c)' represents the upper limit of the range after the constraint is tightened, and min(c)' represents the lower limit of the range after the constraint is tightened;

[0034] res y represents the result obtained by constraint tightening;

[0035] 3) Determine whether the upper and lower limits of the range after constraint tightening are satisfied and update the original constraint range;

[0036] in, If the decision parameter is known, the constraint tightening strategy is performed, and the modification rate α is defined, α∈[0.05-0.2]. The upper limit of the range after constraint tightening is max(c)-α*(max(c)-max(c)'), and the lower limit of the range after constraint tightening is min(c)+α*(min(c)'-min(c)). Otherwise, the constraint tightening strategy is not performed and the original constraint is retained.

[0037] The constraint expansion strategy is to adjust the upper and lower limits of the constraint range away from the middle value of the range. The specific process is as follows;

[0038] 1) Use constraint C to constrain the multivariate time series X, and record the result set of constraints as

[0039] 2) Repair the constraint according to the constraint expansion strategy expression to obtain the upper and lower limits of the range after the constraint expansion;

[0040] Constrained expansion strategy expression:

[0041] min(max(c)″-max(c))+(min(c)-min(c)″)

[0042] st(res i -max(c)″)*(res i -min(c)″)≤0 res i ∈RES(c,X T )

[0043] max(c)≤max(c)″

[0044] min(c)″≤min(c)

[0045] Among them, max(c)″ represents the upper limit of the range after the constraint expansion, and min(c)″ represents the lower limit of the range after the constraint expansion;

[0046] res i represents the result obtained by constrained expansion;

[0047] 3) Determine whether the upper and lower limits of the range after the constraint expansion meet the requirements and update the original constraint range;

[0048] like Then the constraint expansion strategy is performed, and the modification rate α is defined, α∈[0.05-0.2], the upper limit of the range after constraint expansion is max(c)+α*(max(c)″-max(c)), and the lower limit of the range after constraint expansion is min(c)-α*(min(c)-min(c)″); otherwise, the constraint expansion strategy is not performed and the original constraint is retained.

[0049] Furthermore, the time interval of each group of violation interval subsets after connection is defined in S4, and the specific process is as follows:

[0050] Define start(T(Vc)) as the starting time interval of the time interval T(Vc) of the violation interval subset Vc, and end(T(Vc)) as the ending time interval of the time interval T(Vc) of the violation interval subset Vc;

[0051] The expression of start(T(Vc)) is:

[0052]

[0053] Among them, VC represents the set of violation intervals; T t-β+1,t represents the target variable;

[0054] if Then T t-β+1,t is the starting time interval of the violation interval subset Vc, δ represents the custom time interval threshold variable, δ∈[0,1], the smaller δ is, the more abnormal constraint modification will occur; otherwise, the starting time interval is considered uncertain;

[0055] The expression of end(T(Vc)) is:

[0056]

[0057] if Then T t-β+1,t It is the end timestamp of the violation interval subset Vc, otherwise the end time interval is considered uncertain.

[0058] Furthermore, in S5, all the violation intervals in each group of violation interval subsets are aligned according to the time interval of the subset to obtain each group of aligned violation interval subsets. The specific process is as follows:

[0059] Four time intervals are defined:

[0060] 1) A time interval formed by the distance from the start timestamp of a certain violation interval in the violation interval subset to the start time interval of the time interval of the violation interval subset;

[0061] 2) A time interval formed by the distance between the end time interval of the time interval of the violation interval subset and the start timestamp of a violation interval in the violation interval subset;

[0062] 3) A time interval formed by the distance from the end timestamp of a violation interval in the violation interval subset to the end time interval of the time interval of the violation interval subset;

[0063] 4) A time interval formed by the distance between the end time interval of the time interval of the violation interval subset and the end timestamp of a violation interval in the violation interval subset;

[0064] If the start timestamp of any violation interval in each group of violation interval subsets is greater than the start time interval of the defined time interval of the violation interval subset, the defined time interval is empty and no alignment is required; otherwise, a constraint repair strategy is performed on the defined time interval, a constraint expansion strategy is performed on time interval 1) and time interval 4), and a constraint tightening strategy is performed on time interval 2) and time interval 3), to obtain each group of violation interval subsets after alignment.

[0065] Furthermore, in S6, the anomaly score of each univariate time series in each group of aligned violation interval subsets is calculated, and whether the univariate time series is abnormal is determined based on the anomaly score. The specific process is as follows:

[0066] When the constraint is the range constraint c1, the anomaly score of each univariate time series is:

[0067]

[0068] Among them, T vc The time interval representing the violation interval vc;

[0069] max(c1) represents the upper limit of the range constraint c1;

[0070] min(c1) represents the lower limit of the range constraint c1;

[0071] When the constraint is the speed constraint c2, the anomaly score of each univariate time series is:

[0072]

[0073] Where t+h∈T vc ;

[0074] max(c2) represents the upper limit of the speed constraint c2;

[0075] min(c2) represents the lower limit of the speed constraint c2;

[0076] w represents the time window set by the speed constraint c2;

[0077] h represents the number of time windows;

[0078] When the constraint is function constraint c3, the characteristics of each univariate time series are used to establish a normal distribution, and the anomaly score of each univariate time series is calculated.

[0079] Furthermore, when the constraint is the function constraint c3, the normal distribution is established using the characteristics of each univariate time series, and the anomaly score of each univariate time series is calculated. The specific process is:

[0080] a. Construct normal statistical feature space distribution:

[0081] Obtain a multivariate time series within one day that is in the same season as the time interval of the sensor in S1 and the violation interval, and obtain statistical feature values ​​of the time series using a statistical feature extraction method. The statistical feature extraction method is a sliding window method, and a statistical feature value is obtained in each window. The statistical feature values ​​of multiple windows constitute a normal statistical feature spatial distribution;

[0082] b. Use the normal distribution function to model the normal statistical feature space distribution and obtain the normal distribution:

[0083] The mean of the statistical characteristics in the normal statistical characteristic space distribution is μ f,fe , with a standard deviation of σ f,fe , then the normal distribution is N(μ f,fe , (K f,fe σf,fe ) 2 ), the standard normal distribution function is Φ; where K f,fe is a variable constant;

[0084] c. Use statistical feature extraction to extract multiple statistical features cv of each unary time series f,fe , calculate the abnormal probability of each statistical feature separately:

[0085]

[0086] d. Sum the abnormal probabilities of all statistical features:

[0087]

[0088] e. The anomaly score of each univariate time series is as follows:

[0089]

[0090] Beneficial effects:

[0091] The present invention defines three kinds of constraints, namely, range constraint, speed constraint and function constraint. The constraints are used to check the multivariate time series of the sensors in the induced draft fan system. The multivariate time series is composed of multiple unary time series, and the violation intervals of the multivariate time series are obtained. The violation intervals are divided according to whether they are the same equipment abnormality. Multiple constraints are used to complement each other in the description of the same equipment abnormality event, and the parameters of the constraints are made to conform to the dynamic changes of the time series data rules. The violation intervals that are divided into a group are called violation interval subsets, and multiple groups of violation interval subsets are obtained; each group of violation intervals is divided into a group of violation interval subsets. The method comprises the following steps: connecting the violation intervals in the time subsets; defining the time intervals of each group of violation interval subsets after the connection; aligning all the violation intervals in the violation interval subset according to the time intervals of each group of violation interval subsets to obtain each aligned group of violation interval subsets; and calculating the anomaly score of each univariate time series in each aligned group of violation interval subsets. Specifically, the method comprises the following steps: establishing a normal distribution using the statistical feature distribution, calculating the anomaly score of the statistical feature based on the feature distribution of each time series, determining whether the univariate time series is abnormal based on the anomaly score, and completing the anomaly detection of the time series of the sensor in the induced draft fan system. That is, the present invention utilizes multiple constraints to detect abnormal data in time series data, can timely discover abnormal data, report possible abnormal data or situations of the equipment, and avoid these anomalies causing losses to the enterprise.

[0092] The present invention designs a constraint repair strategy in the violation interval connection and violation interval alignment stages. The constraint repair strategy is used to repair the original violation constraints of the violation interval, specifically to modify the parameter values ​​of the original violation constraints. The constraint repair strategy includes a constraint tightening strategy and a constraint expansion strategy. The constraint tightening strategy is to adjust the upper and lower limits of the constraint range to be close to the middle value of the range; the constraint expansion strategy is to adjust the upper and lower limits of the constraint range away from the middle value of the range. Through the preliminary anomaly detection results, it is possible to effectively modify and improve the existing inaccurate constraints. After the time series anomaly pattern changes, the previous constraints may no longer be accurate. The present invention can automatically correct the constraints through the constraint repair strategy to adapt to the changes in the anomaly pattern, thereby improving the accuracy and reliability of subsequent anomaly detection results.

[0093] This method connects and aligns the identified violation intervals, then uses constraints to scan the data for violation within a time window to obtain the violation intervals. This allows for more accurate localization of the specific time series in which the anomaly occurred, as well as the corresponding timestamp. This method also proposes adding user feedback to the anomaly detection process, allowing for manual feedback on the detection results. Based on this feedback, incorrect constraints and built-in parameters can be automatically modified, enhancing existing automatic anomaly detection techniques and optimizing subsequent detection tasks. BRIEF DESCRIPTION OF THE DRAWINGS

[0094] Figure 1 is a flow chart of the present invention;

[0095] Figure 2 It is a display diagram adjacent to the violation interval;

[0096] Figure 3 It is a display diagram of the intersection of the violation intervals;

[0097] Figure 4 It is a display diagram of the violation interval; DETAILED DESCRIPTION

[0098] Specific implementation method 1: Combination Figure 1-Figure 4 This embodiment describes a method for detecting anomalies in time series data based on multiple constraints, which includes the following steps:

[0099] S1. Obtain a multivariate time series of a set of sensors in the induced draft fan system, define the multivariate time series as consisting of multiple unary time series, and define multiple constraints, including range constraints, speed constraints, and function constraints. The specific process is as follows:

[0100] Get the multivariate time series of a set of sensors in the induced draft fan system and define the multivariate time series There are n univariate time series x fBecause a sensor can only receive a single time series x f The received time series is a voltage time series or a current time series. For example, a sensor is a unary voltage time series x f , the other sensor is the univariate time series x of the current f Each univariate time series x f Each of them has its own unique feature f, that is, the feature set of the multivariate time series X is F = {f1,f2,...,f g}. define Features(x f )=f, then Features(X)={f1,f2,...,f g}.

[0101] The timestamp set T is the timestamp set of all data points in the multivariate time series X. Where K represents the timestamp length of the multivariate time series X; t represents the timestamp; when t∈T, the observation value of the multivariate time series X is in, Indicates feature f at timestamp t a Observed values.

[0102] Assume X truth is the real sequence corresponding to the multivariate time series X, then when the timestamp is t, the feature f a The true value of the corresponding univariate time series is

[0103] Define the time interval T i,j is a set of continuous timestamps T i,j ={t i ,....,t j}, by timestamp t i Start, to timestamp t j End, and For the multivariate time series X in time interval T i,j All univariate time series x on f Collection, will It is called a subsequence of the multivariate time series X, that is, the multivariate time series X contains n univariate time series subsequences with the same start and end points.

[0104] The present invention adopts the following three types of constraints to perform anomaly detection of multivariate time series of sensors, abstracting multiple constraints into a unified definition, and different constraints have their own unique parts.

[0105] Constraint: Given a time series range interval [X min ,Xmax ], and an operation O, then the constraint C is This means that for any timestamp t in the timestamp set T of the multivariate time series X, X t The result value obtained by the operation O of the observation value within [X min ,X max ], the operation O is a function composed of four arithmetic operations on the observations of the multivariate time series X. The difference between different types of constraints lies in the difference in the operation O. Define Features(C) as the features participating in the operation O. For example, if a constraint represents the ratio of the concentration of methane gas to the concentration of carbon dioxide gas, then the features corresponding to the concentration of methane gas and the concentration of carbon dioxide gas are the features participating in the operation corresponding to the constraint. At this time, the univariate time series x f It is called the time series associated with the constraint, max(C) is the upper limit of the range interval of constraint C, and similarly min(C) is the lower limit of the range interval of constraint C.

[0106] Range constraint c1: a univariate time series x f The observation value x corresponding to any time stamp t t Cannot exceed a certain range interval, the operation form of the range constraint is O1(x t )=x f , at this time x f Represents a univariate time series subject to constraints.

[0107] Speed ​​constraint c2: Given a time window w, a univariate time series x f The data observation value x at any two moments in the time window w t The speed of change is within the speed constraint range, and the speed constraint operation form is It means the rate of change of the observed value of a univariate time series at any two moments in the time window, where t represents the timestamp, t' represents any other timestamp in the time window, and x t represents the observation value of a univariate time series at timestamp t, x t' Represents the observation value of a univariate time series at timestamp t'.

[0108] Function constraint c3: For a specified time series A (A>1) on the multivariate time series X The observation value corresponding to any time stamp t The value after a certain function transformation belongs to a certain range. The function transformation is to select multiple operators from a given operator set and combine them any number of times. For example, addition can be regarded as a function transformation. Given an operator set B = {+, -, *, / , (,)}, the form of the function constraint operation is Among them B d ∈B.

[0109] In summary, range constraints and speed constraints only restrict a single time series, while function constraints restrict the relationship between multiple time series. Since time series data has continuity when anomalies occur, the multivariate time series anomaly detection problem of the present invention can be defined as: for each unary time series x in the multivariate time series X, f , find the time interval T i,j , calculate x f At timestamp t i To timestamp t j Is there any anomaly in the data, that is, to find all abnormal subsequences

[0110] S2. Use the defined constraints to check the multivariate time series of a group of sensors in the induced draft fan system, obtain the violation intervals of the multivariate time series, and divide the violation intervals into a group called violation interval subsets. Multiple groups of violation interval subsets are obtained. The specific process is as follows:

[0111] Use one or more of the constraints C proposed above to check the multivariate time series X of a group of sensors in the induced draft fan system, and obtain the constrained multivariate time series X. If the constrained multivariate time series X is within a certain time interval T i,j The observation value X at each time stamp t t are all outside the corresponding constraint range, which means that the multivariate time series will participate in the violation of constraint C, then the time interval T i,j The violation interval of constraint C is abbreviated as vc. Each violation interval vc contains two pieces of information: time interval T(vc) = T i,j and the original violation constraint C(vc)=c, denoted as the tuple vc=<T i,j ,c>, for example, the violation interval detected by speed constraint contains <time interval, speed constraint>, but the speed constraint can be detailed to a specific constraint. By using all constraints for all unary time series x f By checking, we can get the set of illegal intervals VC={vc1,vc2,...,vc nThe multiple violation intervals vc in the violation interval set VC are related to each other, so the violation interval set VC needs to be divided. Since the data anomaly caused by the device anomaly should have a time interval, if the time intervals of multiple violation intervals vc are adjacent, intersecting, or containing each other, they should belong to the same anomaly. Therefore, when the violation interval set VC is divided, they should belong to the same subset. If they are divided into a group of violation interval subsets Vc, multiple groups of violation interval subsets are obtained. That is, after the violation interval set VC is divided, a set Vc′ of multiple groups of violation interval subsets Vc is obtained.

[0112] 1) If Figure 2 As shown, when the time interval T(vc1) of the violation interval vc1 is T i,j The time interval with the violation interval vc2 is T(vc2)=T m,n When they are adjacent, that is, when j=m, then when the violation interval set VC is divided, the two violation intervals belong to the same subset.

[0113] 2) If Figure 3 As shown, when the time interval T(vc1) of the violation interval vc1 is T i,j The time interval with the violation interval vc2 is T(vc2)=T m,n When they intersect, that is, when i>m>j>n, then when the violation interval set VC is divided, the two violation intervals belong to the same subset.

[0114] 3) If Figure 4 As shown, when the time interval T(vc1) of the violation interval vc1 is T i,j The time interval with the violation interval vc2 is T(vc2)=T m,n When there is an inclusion relationship, that is, i>m>n>j, then when the violation interval set VC is divided, the two violation intervals belong to the same subset.

[0115] S3. Connect the illegal intervals in each illegal interval subset. The specific process is as follows:

[0116] A constraint repair strategy is defined, and the constraint repair strategy is used to perform constraint repair on the violation intervals. The violation intervals after constraint repair are connected to obtain a subset of each group of violation intervals after connection.

[0117] The constraint repair strategy includes a constraint tightening strategy and a constraint expansion strategy.

[0118] After partitioning the violation interval set VC, all violation intervals vc belonging to the same subset should represent the same device anomaly, and the violation constraint C(vc) for each violation interval vc should be different. However, if the violation constraint C(vc) for different violation intervals vc is the same, it indicates that the two violation intervals vc belong to the same device anomaly, but their time intervals are disconnected, meaning they are not considered the same anomaly. Therefore, a constraint tightening or expansion operation is required to connect the two violation intervals vc into a single violation interval subset Vc under the constraint C(vc). Due to the special nature of speed constraints, violation intervals determined using speed constraints are generally not connected.

[0119] The final result of the constraint tightening strategy is to modify the upper limit max(c) and lower limit min(c) of the range of constraint C to be closer to the center of the range. The specific process is:

[0120] The upper and lower limits of the constraint refer to the values ​​obtained after the data in the time series is subjected to the constraint operation O, and the values ​​should be within the upper and lower limits of the constraint. For example: electric power / current = voltage should be maintained between 210V-230V, then 210V and 230V are the upper and lower limits of the constraint. The present invention defines the search for the upper limit max(c)' and the lower limit min(c)' of the new range after the constraint C is tightened as a combinatorial optimization problem. The multivariate time series X is constrained by the constraint C, and the multivariate time series X is constrained by the corresponding operation O in the constraint C. p The calculated result set is recorded as Where c represents any one or more constraints; X t represents the set of observations of the multivariate time series X at timestamp t; T represents the timestamp set; O represents the operation corresponding to constraint c; this set is not a violation interval, but only the time series data after operation O p The values ​​obtained after the above calculations are completed, the set of values ​​that exceed the upper and lower limits of the constraints can constitute the violation interval. y =O y (X t ). Constraint tightening strategy expression:

[0121] min(max(c)-max(c)')+(min(c)'-min(c))

[0122] st(res y -max(c)')*(res y -min(c)')≥0 res y ∈RES(c,X T )

[0123] max(c)'≤max(c)

[0124] min(c)≤min(c)'

[0125] Among them, max(c)' represents the upper limit of the modified range; min(c)' represents the lower limit of the modified range, max(c)' and min(c)' are variables when solving the problem, max(c) and min(c) are parameters known according to the constraints, res y It is the result value obtained by the constraint calculation. By looping through the data in the set RES, the optimal solution of the above problem is obtained, that is, the degree of modification to the constraint range is minimized.

[0126] The present invention does not simply replace the upper limit max(c) or the lower limit min(c) of the range of constraint C, but needs to determine whether the above-obtained max(c)' and min(c)' can update the original constraint range. The determination conditions are as follows:

[0127] like in If the decision parameter (known or customizable) is present, a constraint tightening strategy is implemented. To be conservative, we set a modification rate α (a reasonable value is between 0.05 and 0.2). This results in an upper bound of max(c)-α*(max(c)-max(c)') and a lower bound of min(c)+α*(min(c)'-min(c)). Otherwise, no constraint tightening strategy is implemented, and the original constraints are not modified (retained).

[0128] The final result of the constraint expansion strategy is to modify the upper limit max(c) and lower limit min(c) of the range of constraint C to be away from the center of the range. The value of is opposite to the constraint tightening strategy. The specific process is:

[0129] Use constraint C to constrain the multivariate time series X, and use the operation O within constraint C to transform the multivariate time series X into p The calculated result set is recorded as The formal definition is as follows:

[0130] min(max(c)″-max(c))+(min(c)-min(c)″)

[0131] st(res i -max(c)″)*(res i -min(c)″)≤0 res i ∈RES(c,X T )

[0132] max(c)≤max(c)″

[0133] min(c)″≤min(c)

[0134] Where max(c)″ and min(c)″ are variables used to solve the problem. By looping through the data in the set RES, the optimal solution to the above problem is obtained. Determine whether the max(c)″ and min(c)″ obtained above can update the original constraint range. The judgment conditions are as follows:

[0135] if in, If α represents the judgment parameter, a constraint expansion strategy is implemented, and a modification rate α is set (a reasonable value is between 0.05 and 0.2). The upper limit of the constraint range after the expansion strategy is max(c)+α*(max(c)″-max(c)), and the lower limit of the constraint range is min(c)-α*(min(c)-min(c)″). Otherwise, the constraint expansion strategy is not implemented, and the original constraints are not modified (retained).

[0136] S4. Define the time interval of each group of violation interval subsets after connection. The specific process is as follows:

[0137] Before aligning the violation intervals vc, the start and end times for the subset of violation intervals vc must be obtained. These start and end times are collectively referred to as endpoint times. Because it's difficult to accurately determine the start and end times of each induced draft fan system equipment anomaly, a tolerance interval β is assigned to minimize anomalies during alignment. The obtained time interval is only used for aligning the subset of time violation intervals vc and does not directly determine the start and end times of the anomaly subsequence.

[0138] Define start(T(Vc)) as the starting time interval of the time interval T(Vc) of the violation interval subset Vc, and end(T(Vc)) as the ending time interval of the time interval T(Vc) of the violation interval subset Vc, such as start(T i,j )=i,end(T i,j The problem of obtaining the start time interval of the violation interval subset Vc alignment is formalized as follows:

[0139]

[0140] Among them, T t-β+1,t Indicates the target variable. This formula expresses: when the start time interval needs to be obtained, by solving The maximum value of the violation interval subset Vc is determined by the start (T (Vc)) of each violation interval subset Vc. The biggest. Got the biggest At the same time, we get the required start(T(Vc)), that is, the starting time interval. This problem can be simplified to finding an interval with a length of β from the starting time interval to the ending time interval and containing the largest number of elements. This problem can be solved in linear time. If Then T t-β+1,t is the starting time interval of the violation interval set VC, δ represents the custom endpoint time interval threshold variable, δ∈[0,1]. The smaller δ is, the more likely it is that an abnormal constraint modification will occur. Otherwise, the starting time interval is considered to be undetermined, indicating that the violation interval vc in the violation interval subset Vc cannot be aligned at this time, which will result in no abnormalities being reported for these violation intervals vc. The abnormalities that should exist in these violation intervals vc will be discovered in the manual feedback stage and used to modify the constraint parameters. Then, these violation intervals vc can be aligned in the next round of iteration. This judgment is to avoid incorrect alignment operations and incorrect constraint modifications caused by confusion in the starting time interval of the violation interval vc. Similarly, the problem of solving the end time interval of the alignment of the violation interval subset Vc can be defined:

[0141]

[0142] if Then T t-β+1,t It is the end timestamp of the violation interval subset Vc, otherwise the end time interval is considered uncertain.

[0143] S5. Align all the violation intervals in each violation interval subset according to the time interval of the violation interval subset to obtain each violation interval subset after alignment. The specific process is as follows:

[0144] In the case of an abnormality in the induced draft fan system, the time intervals of all violation intervals vc should overlap and be aligned. The misalignment of the time intervals of the violation interval vc is due to inaccurate constraints. Therefore, when this occurs, the constraint parameters need to be modified to conform to the actual data patterns. In order to achieve the alignment requirement, four time intervals that may be empty need to be defined. The time intervals are used to detect whether the alignment requirement is met:

[0145] 1) The time interval is formed by the distance from the start timestamp of a violation interval in the violation interval subset to the start time interval of the time interval of the violation interval subset. For example, if the start timestamp of a violation interval is 10 and the start time interval of the time interval of the violation interval subset is (15, 20), then Indicates (10-15).

[0146] 2) The time interval formed by the distance from the end time interval of the time interval of the violation interval subset to the start timestamp of a violation interval in the violation interval subset. For example, if the end time interval of the time interval of the violation interval subset is (20, 25) and the start timestamp of a violation interval is 30, then Indicates (25-30).

[0147] 3) The time interval is formed by the distance from the end timestamp of a violation interval in the violation interval subset to the end time interval of the time interval of the violation interval subset. For example, if the end timestamp of a violation interval is 30 and the end time interval of the time interval of the violation interval subset is (25,40), then Indicates (30-40).

[0148] 4) The time interval formed by the distance between the end time interval of the time interval of the violation interval subset and the end timestamp of a violation interval in the violation interval subset. For example, if the end time interval of the time interval of the violation interval subset is (30, 40), and the end timestamp of a violation interval is 50, then Indicates (40-50).

[0149] If the start timestamp of any violation interval within each violation interval subset is greater than the start time interval of the defined violation interval subset time interval, the defined time interval is empty, and alignment of the violation intervals is meaningless and unnecessary. Otherwise, a constraint repair strategy is applied to the defined time intervals, a constraint expansion strategy is applied to time intervals 1) and 4), and a constraint contraction strategy is applied to time intervals 2) and 3), to obtain the aligned violation interval subsets. For example, suppose that in a violation interval subset (anomaly), a total of four violation intervals are detected: [10, 20], [15, 25], [20, 30], and [30, 35]. The final alignment start time interval for the violation interval subset is determined to be [12.5, 17.5], and the alignment end time interval is [27.5, 32.5]. For the first violating interval, its starting endpoint 10 is before the alignment start time interval 12.5. Therefore, of the four intervals defined for this violating interval, intervals 1), 3), and 4) are meaningful, while interval 2) is empty. Therefore, only these three intervals need to be considered for alignment. Similarly, four intervals can be defined for the other three violating intervals, and alignment can be attempted for the non-empty intervals. The constraint repair strategy involves modifying the violating intervals to align them.

[0150] S6. Calculate the anomaly score of each univariate time series in each group of aligned violation interval subsets, and determine whether the univariate time series is abnormal based on the anomaly score. The specific process is as follows:

[0151] When constraint C is the range constraint c1, each unary time series x f Anomaly score:

[0152]

[0153] When the constraint C is the range constraint c1, |Features(c1)|=1, according to the time interval T of each violation interval vc vc And the feature set Features(c1) in the corresponding violation interval vc associated with the range constraint c1 can be obtained in the time interval T vc Intrinsic univariate time series x f The anomaly score of feature f, where f∈Features(c1), is a univariate time series x f In the time interval T vc The average value of the deviation of the data value at each time point from the median value, that is, if the univariate time series x f Most of the data in the range exceeds the upper and lower limits given by the range constraint c1, and must be far away from the middle value of the upper and lower limits. f The range constraint c1 has been violated. The more this sequence violates the range constraint, the more the data deviates from the middle value.

[0154] When constraint C is the speed constraint c2, each unary time series x f Anomaly score:

[0155]

[0156] Where t+h∈T vc ;h represents the number of time windows;

[0157] When constraint C is speed constraint c2, |Features(c2)|=1, according to the time interval T of each violation interval vc error And the feature set Features(c2) in the corresponding violation interval vc associated with the speed constraint c2 can be obtained in the time interval T error The anomaly score of the internal feature f, where f∈Features(c2), the anomaly score of feature f is a one-element time series x f In the time interval T error The average value of the deviation of the speed value from the standard value at each time point in the window w.

[0158] When the constraint is function constraint c3, the normal distribution is established using the characteristics of each univariate time series, and the anomaly score of each univariate time series is calculated. The specific process is as follows:

[0159] Since the number of associated features of the function constraint is greater than 1, defining the anomaly score based on the degree of deviation is no longer applicable. In this case, statistical features are used to calculate the anomaly score of each feature's time series subsequence.

[0160] a. Construct normal statistical feature space distribution:

[0161] For feature f in the multivariate time series X, the corresponding statistical feature extraction method set is defined as FE(f). Before calculating the anomaly score for feature f, it is necessary to establish a normal statistical feature spatial distribution. Modeling the normal statistical feature spatial distribution requires the use of multivariate time series when the equipment is operating normally (there are no anomalies in the equipment data). When selecting these multivariate time series, it is necessary to select multivariate time series with the same season and similar time within the same day as the sensor and the violation interval described in S1 to avoid seasonality of the multivariate time series. When modeling normal multivariate time series, the statistical feature values ​​are obtained in the form of a sliding window. The data in a window gives a statistical feature value, and the statistical feature values ​​of multiple windows constitute the normal statistical feature spatial distribution.

[0162] b. Use the normal distribution function to model the normal statistical feature space distribution and obtain the normal distribution:

[0163] The normal statistical feature space distribution obtained by the feature extraction method fe∈FE(f) is modeled using the normal distribution function. The statistical feature mean in the normal statistical feature space is μ f,fe , with a standard deviation of σ f,fe , obtain the normal distribution N(μ f,fe , (K f,fe σ f,fe ) 2 ), the standard normal distribution function is Φ; where K f,fe is a variable constant that varies according to the characteristics f and fe. i,j And the constraint-associated feature set Features(c3), get The anomaly score of , where f∈Features(c3):

[0164] c. Use statistical feature extraction method fe to extract each unary time series Multiple statistical features cv f,fe , calculate the abnormal probability of each statistical feature separately:

[0165]

[0166] Many statistical features can be extracted from a single feature, and each statistical feature follows a normal distribution. Therefore, to determine whether a feature is abnormal, you only need to calculate the abnormality probability of all its statistical features and then sum them up.

[0167] d. Sum the abnormal probabilities of all statistical features:

[0168]

[0169] e. The anomaly score of each univariate time series is as follows:

[0170]

[0171] Human feedback

[0172] Manual feedback needs to provide the abnormal feature set F in the abnormal instance of the multivariate time series of a group of sensors in the induced draft fan system identified by the present invention. error Feedback, abnormal feature set F error It is obtained by the anomaly score. When a feature anomaly score exceeds the threshold, the feature f is added to the anomaly feature set F. error If the detection result of the present invention is wrong, it is necessary to provide the true abnormal feature set F′ of this abnormal instance. error , that is, manually provide the correct abnormal feature set. Through manual feedback results, both the constraints can be repaired and the parameter K can be adjusted. f,fe There are two cases for fixing constraints:

[0173] 1. This means that in the time interval T error There is an anomaly in the internal feature f, but the violation constraint set ∑ error In this case, there must be a constraint c that satisfies f∈Features(c): the scope of constraint c is too large, which leads to the failure of the constraint violation to be detected. Therefore, a constraint tightening strategy is needed to tighten the constraint so that it can be detected within the time interval T. error Constraint violations can be detected within.

[0174] 2. This means that none of the features f in constraint c is abnormal, but the time interval T error The observation value within the time interval T leads to the detection of the violation of this constraint c. At this time, the range of constraint c is small, which leads to over-detection. Therefore, a constraint expansion strategy is needed to make the time interval T error The observations in no longer violate constraint c.

[0175] Parameter Kf,fe Modification: Define the loss function of the anomaly score of feature f where out f Represents the ideal anomaly score, score f Represents the anomaly score of feature f calculated using function constraints. Modify parameter K f,fe Need to minimize the loss function E f This modification can be achieved through the least squares method.

Claims

1. A method for detecting anomalies in time series data based on multiple constraints, characterized by: It includes the following steps: S1. Obtain a multivariate time series of a group of sensors in an induced draft fan system, define the multivariate time series as consisting of multiple unary time series, and define multiple constraints, including a range constraint, a speed constraint, and a function constraint; S2. Using the defined constraints, the multivariate time series is checked to obtain the violation intervals of the multivariate time series, and the violation intervals are divided into a group, which is called a violation interval subset, to obtain multiple groups of violation interval subsets; S3, connecting the violation intervals in each group of violation interval subsets; S4, defining the time interval of each group of violation interval subsets after connection; S5. Align all violation intervals in each violation interval subset according to the time interval of the violation interval subset to obtain an aligned violation interval subset; S6. Calculate the anomaly score of each univariate time series in each group of aligned violation interval subsets, and determine whether the univariate time series is abnormal based on the anomaly score.

2. The method for detecting anomalies in time series data based on multiple constraints according to claim 1, characterized in that: In S1, a multivariate time series of a set of sensors in the induced draft fan system is obtained, the multivariate time series is defined as consisting of multiple unary time series, and multiple constraints are defined. The constraints include range constraints, speed constraints, and function constraints. The specific process is as follows: Obtain a multivariate time series of a group of sensors in the induced draft fan system, and define the multivariate time series as consisting of multiple unary time series, each unary time series corresponding to one feature; Range constraint: a univariate time series x f The observation value x corresponding to any time stamp t t Cannot exceed a certain range interval, the range constraint operation is O1(x t )=x f ; Speed ​​constraint: Given a time window w, a univariate time series x f The data observation value x at any two moments in the time window w t The speed of change is within the speed constraint range, and the speed constraint operation is: Where t represents a timestamp, t' represents any other timestamp in the time window, and x t Represents a univariate time series x f The observation value at time stamp t, x t' Represents a univariate time series x f The observation value at time stamp t'; Function constraint: For a specified time series of a multivariate time series X The observation value corresponding to any time stamp t After a certain function transformation, the value falls within a certain range. The function transformation is to select multiple operators from a given operator set and perform any number of combinations. Given an operator set B = {+, -, *, / , (,)}, the operation of the function constraint 3. The method for detecting anomalies in time series data based on multiple constraints according to claim 2, characterized in that: In S2, the defined constraints are used to check the multivariate time series to obtain the violation intervals of the multivariate time series, and the violation intervals are divided into a group, which is called a violation interval subset. Multiple groups of violation interval subsets are obtained. The specific process is as follows: One or more constraints are used to check the multivariate time series to obtain the constrained multivariate time series. If the observation values ​​at each timestamp in a certain time interval of the constrained multivariate time series are all outside the corresponding constraint range, then the time interval is called a violation interval. Each violation interval contains the time interval and the original violation constraint. When the time intervals of multiple violation intervals are adjacent, intersecting, or containing each other, they are divided into a group of violation interval subsets, and multiple groups of violation interval subsets are obtained.

4. The method for detecting anomalies in time series data based on multiple constraints according to claim 3, characterized in that: In S3, the illegal intervals in each illegal interval subset are connected. The specific process is as follows: A constraint repair strategy is defined, and the constraint repair strategy is used to perform constraint repair on the violation intervals. The violation intervals after constraint repair are connected to obtain a subset of each group of violation intervals after connection.

5. The method for detecting anomalies in time series data based on multiple constraints according to claim 4, characterized in that: Violating intervals determined using speed constraints are not connected.

6. The method for detecting anomalies in time series data based on multiple constraints according to claim 5, characterized in that: The constraint repair strategy includes a constraint tightening strategy and a constraint expansion strategy; The constraint tightening strategy is to adjust the upper and lower limits of the constraint range to be close to the middle value of the range. The specific process is as follows; 1) Use constraint C to constrain the multivariate time series X, and record the result set of constraints as Where c represents any one or more constraints; X t represents the set of observations of the multivariate time series X at timestamp t; T represents the timestamp set; O represents the operation corresponding to the constraint c; 2) Repair the constraints according to the constraint tightening strategy expression to obtain the upper and lower limits of the range after the constraint tightening; Constraint tightening strategy expression: min(max(c)-max(c)')+(min(c)'-min(c)) s.t.(res y -max(c)')*(res y -min(c)')≥0 res y ∈RES(c,X T ) max(c)'≤max(c) min(c)≤min(c)' Among them, max(c) represents the upper limit of the constraint range, and min(c) represents the lower limit of the constraint range; max(c)' represents the upper limit of the range after the constraint is tightened, and min(c)' represents the lower limit of the range after the constraint is tightened; res y represents the result obtained by constraint tightening; 3) Determine whether the upper and lower limits of the range after constraint tightening are satisfied and update the original constraint range; like in, If the decision parameter is known, the constraint tightening strategy is performed, and the modification rate α is defined, α∈[0.05-0.2]. The upper limit of the range after constraint tightening is max(c)-α*(max(c)-max(c)'), and the lower limit of the range after constraint tightening is min(c)+α*(min(c)'-min(c)). Otherwise, the constraint tightening strategy is not performed and the original constraint is retained. The constraint expansion strategy is to adjust the upper and lower limits of the constraint range away from the middle value of the range. The specific process is as follows; 1) Use constraint C to constrain the multivariate time series X, and record the result set of constraints as 2) Repair the constraint according to the constraint expansion strategy expression to obtain the upper and lower limits of the range after the constraint expansion; Constrained expansion strategy expression: min(max(c)″-max(c))+(min(c)-min(c)″) s.t.(res i -max(c)″)*(res i -min(c)″)≤0 res i ∈RES(c,X T ) max(c)≤max(c)″ min(c)″≤min(c) Among them, max(c)″ represents the upper limit of the range after the constraint expansion, and min(c)″ represents the lower limit of the range after the constraint expansion; i represents the result obtained by constrained expansion; 3) Determine whether the upper and lower limits of the range after the constraint expansion meet the requirements and update the original constraint range; like Then the constraint expansion strategy is performed, and the modification rate α is defined, α∈[0.05-0.2], the upper limit of the range after constraint expansion is max(c)+α*(max(c)″-max(c)), and the lower limit of the range after constraint expansion is min(c)-α*(min(c)-min(c)″); otherwise, the constraint expansion strategy is not performed and the original constraint is retained.

7. The method for detecting anomalies in time series data based on multiple constraints according to claim 6, characterized in that: The time interval of each group of violation interval subsets after connection is defined in S4. The specific process is as follows: Define start(T(Vc)) as the starting time interval of the time interval T(Vc) of the violation interval subset Vc, and end(T(Vc)) as the ending time interval of the time interval T(Vc) of the violation interval subset Vc; The expression of start(T(Vc)) is: Among them, VC represents the set of violation intervals; T t-β+1,t represents the target variable; if Then T t-β+1,t is the starting time interval of the violation interval subset Vc, δ represents the custom time interval threshold variable, δ∈[0,1], the smaller δ is, the more abnormal constraint modification will occur; otherwise, the starting time interval is considered uncertain; The expression of end(T(Vc)) is: if Then T t-β+1,t It is the end timestamp of the violation interval subset Vc, otherwise the end time interval is considered uncertain.

8. The method for detecting anomalies in time series data based on multiple constraints according to claim 7, characterized in that: In S5, all the violation intervals in each group of violation interval subsets are aligned according to the time interval of the subset to obtain each group of violation interval subsets after alignment. The specific process is as follows: Four time intervals are defined: 1) A time interval formed by the distance from the start timestamp of a certain violation interval in the violation interval subset to the start time interval of the time interval of the violation interval subset; 2) A time interval formed by the distance between the end time interval of the time interval of the violation interval subset and the start timestamp of a violation interval in the violation interval subset; 3) A time interval formed by the distance from the end timestamp of a violation interval in the violation interval subset to the end time interval of the time interval of the violation interval subset; 4) A time interval formed by the distance between the end time interval of the time interval of the violation interval subset and the end timestamp of a violation interval in the violation interval subset; If the start timestamp of any violation interval in each group of violation interval subsets is greater than the start time interval of the defined time interval of the violation interval subset, the defined time interval is empty and no alignment is required; otherwise, a constraint repair strategy is performed on the defined time interval, a constraint expansion strategy is performed on time interval 1) and time interval 4), and a constraint tightening strategy is performed on time interval 2) and time interval 3), to obtain each group of violation interval subsets after alignment.

9. The method for detecting anomalies in time series data based on multiple constraints according to claim 8, characterized in that: In S6, the anomaly score of each univariate time series in each group of aligned violation interval subsets is calculated, and whether the univariate time series is abnormal is determined based on the anomaly score. The specific process is as follows: When the constraint is the range constraint c1, the anomaly score of each univariate time series is: Among them, T vc The time interval representing the violation interval vc; max(c1) represents the upper limit of the range constraint c1; min(c1) represents the lower limit of the range constraint c1; When the constraint is the speed constraint c2, the anomaly score of each univariate time series is: Where t+h∈T vc ; max(c2) represents the upper limit of the speed constraint c2; min(c2) represents the lower limit of the speed constraint c2; w represents the time window set by the speed constraint c2; h represents the number of time windows; When the constraint is function constraint c3, the characteristics of each univariate time series are used to establish a normal distribution, and the anomaly score of each univariate time series is calculated.

10. The method for detecting anomalies in time series data based on multiple constraints according to claim 9, characterized in that: When the constraint is the function constraint c3, the normal distribution is established using the characteristics of each univariate time series, and the anomaly score of each univariate time series is calculated. The specific process is: a. Construct normal statistical feature space distribution: Obtain a multivariate time series within one day that is in the same season as the time interval of the sensor in S1 and the violation interval, and obtain statistical feature values ​​of the time series using a statistical feature extraction method. The statistical feature extraction method is a sliding window method, and a statistical feature value is obtained in each window. The statistical feature values ​​of multiple windows constitute a normal statistical feature spatial distribution; b. Use the normal distribution function to model the normal statistical feature space distribution and obtain the normal distribution: The mean of the statistical characteristics in the normal statistical characteristic space distribution is μ f,fe , with a standard deviation of σ f,fe , then the normal distribution is N(μ f,fe , (K f,fe σ f,fe ) 2 ), the standard normal distribution function is Φ; where K f,fe is a variable constant; c. Use statistical feature extraction to extract multiple statistical features cv of each unary time series f,fe , calculate the abnormal probability of each statistical feature separately: d. Sum the abnormal probabilities of all statistical features: e. The anomaly score of each univariate time series is as follows:

Images