Multivariate time sequence anomaly detection method and device, computer device and storage medium

Abstract

The application provides a multi-element time sequence anomaly detection method and device, computer equipment and a storage medium, and relates to the technical field of information. The application performs data preprocessing on a to-be-detected time sequence group in a target industrial scene, and for each normalized time sequence group processed, extracts the data correlation of multiple industrial sensors according to the normalized industrial time sequence segments of each of the multiple industrial sensors in the corresponding data collection time period. Then, the corresponding normalized industrial time sequence segments and the data correlation are input into a multi-element time sequence reconstruction model for time sequence reconstruction. Then, the to-be-detected normalized time sequence group and the corresponding reconstructed to-be-matched normalized time sequence group are compared in time sequence, and the time sequence anomaly detection result of the to-be-detected time sequence group is obtained. Thus, in a multi-element time sequence scene, the data correlation between multiple information variables is combined to achieve accurate detection of complex information anomalies from the time dimension level.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information technology, in particular to a multi-element time sequence anomaly detection method and device, computer equipment and a storage medium. BACKGROUND

[0002] With the rapid development of new generation information technologies such as cloud computing, big data, sensors and Internet of Things, many important information system facilities (for example, smart grid systems, water treatment systems, power distribution network systems, autonomous driving systems, etc.) based on cyber physical systems (CPS) pay more and more attention to information anomaly detection operations for the purpose of running safety, in order to continuously monitor basic control parameters or index parameters and timely discover any possible abnormal events.

[0003] It is worth noting that the existing information anomaly detection operation usually realizes point anomaly detection effect on the monitoring data of a single information variable, and does not consider the data correlation and data causality of the corresponding information variable in the time dimension, not to mention that the above important information system facilities often involve a large number of industrial sensors responsible for information variables in the same industrial scene during operation, and the information variables responsible for by different industrial sensors have more or less certain data correlation in the time dimension. Therefore, the existing information anomaly detection operation has poor anomaly detection accuracy when facing complex industrial scenes involving multi-element time series data (i.e., time series data obtained by multiple industrial sensors), and cannot effectively detect complex information anomalies. SUMMARY

[0004] Therefore, the purpose of the present application is to provide a multi-element time sequence anomaly detection method and device, computer equipment and a storage medium, which can realize accurate detection of complex information anomalies from the time dimension in combination with the data correlation between multiple information variables in a multi-element time sequence scene.

[0005] In order to achieve the above purpose, the technical solutions adopted by the embodiments of the present application are as follows:

[0006] In a first aspect, the present application provides a multi-element time sequence anomaly detection method, which comprises:

[0007] obtaining a to-be-detected time sequence group in a target industrial scene, wherein the to-be-detected time sequence group comprises industrial time sequence data corresponding to multiple industrial sensors respectively and having consistent data collection time;

[0008] performing data preprocessing on the to-be-detected time sequence group to obtain a plurality of to-be-detected normalized time sequence groups, wherein each to-be-detected normalized time sequence group corresponds to a data collection time period, and each to-be-detected normalized time sequence group includes normalized industrial time sequence segments of the plurality of industrial sensors in the corresponding data collection time period;

[0009] For each to-be-detected normalized time sequence group, data correlation relationships of the plurality of industrial sensors at the to-be-detected normalized time sequence group are extracted according to the normalized industrial time sequence segments of the plurality of industrial sensors included in the to-be-detected normalized time sequence group;

[0010] The normalized industrial time sequence segments and the data correlation relationships of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group are input into a pre-stored multivariate time sequence reconstruction model for time sequence reconstruction processing to obtain a corresponding to-be-matched normalized time sequence group;

[0011] The to-be-detected normalized time sequence group and the corresponding to-be-matched normalized time sequence group are compared in time sequence to obtain a time sequence anomaly detection result of the to-be-detected time sequence group corresponding to the to-be-detected normalized time sequence group.

[0012] In an optional implementation, the step of performing data preprocessing on the to-be-detected time sequence group to obtain a plurality of to-be-detected normalized time sequence groups includes:

[0013] A preset sliding window is called to slide on industrial time sequence data of various industrial sensors included in the to-be-detected time sequence group, and industrial time sequence segment data of the plurality of industrial sensors corresponding to a window position are collected to form a to-be-processed industrial time sequence group, wherein a data collection time period corresponding to each to-be-processed industrial time sequence group is consistent with a window length of the preset sliding window;

[0014] For each to-be-processed industrial time sequence group, maximum and minimum normalization processing is performed on industrial time sequence segment data of the plurality of industrial sensors included in the to-be-processed industrial time sequence group to obtain a to-be-detected normalized time sequence group corresponding to the to-be-processed industrial time sequence group.

[0015] In an optional implementation, for each to-be-detected normalized time sequence group, the step of extracting data correlation relationships of the plurality of industrial sensors at the to-be-detected normalized time sequence group includes:

[0016] Collection feature extraction processing is performed on normalized industrial time sequence segments of various industrial sensors included in the to-be-detected normalized time sequence group to obtain data collection feature vectors of the various industrial sensors in a data collection time period of the to-be-detected normalized time sequence group;

[0017] The data correlation degree between the data acquisition feature vectors of various industrial sensors in the data acquisition time period of the to-be-detected normalized time sequence group is calculated based on a graph structure learning principle to obtain a data correlation relationship of the various industrial sensors at the to-be-detected normalized time sequence group.

[0018] In an optional embodiment, the multi-element time sequence reconstruction model comprises a self-attention unit, an encoding unit and a decoding unit, wherein the encoding unit comprises a plurality of encoding modules connected in series with each other, each encoding module being composed of a long short-term memory network and a graph convolution network, and the decoding unit comprises a plurality of decoding modules connected in series with each other, each encoding module corresponding to a decoding module;

[0019] For each to-be-detected normalized time sequence group, the normalized industrial time sequence segments and the data correlation relationship of the various industrial sensors corresponding to the to-be-detected normalized time sequence group are input into a pre-stored multi-element time sequence reconstruction model for time sequence reconstruction processing to obtain a corresponding to-be-matched normalized time sequence group, comprising the following steps:

[0020] The normalized industrial time sequence segments and the data correlation relationship of the various industrial sensors corresponding to the to-be-detected normalized time sequence group are input into the encoding unit, each encoding module in the encoding unit extracts time dimension features from the received normalized time sequence data through the long short-term memory network, and then embeds the extracted time dimension features into the data correlation relationship of the various industrial sensors corresponding to the to-be-detected normalized time sequence group through the graph convolution network for time sequence encoding to obtain normalized encoding time sequence data output by the encoding module; wherein the normalized time sequence data received by the first encoding module in the encoding unit is the normalized industrial time sequence segments of the various industrial sensors corresponding to the to-be-detected normalized time sequence group, and the normalized time sequence data received by each encoding module other than the first encoding module in the encoding unit is the normalized encoding time sequence data output by the previous encoding module;

[0021] The self-attention unit is called to perform attention evaluation on the time dimension features extracted by each of the plurality of encoding modules at the last network architecture of the long short-term memory network to obtain attention weighted hidden state representations of each encoding module;

[0022] Each decoding module in the decoding unit respectively decodes and reconstructs based on the attention-weighted hidden state representation of the corresponding encoding module and the received normalized time series data to obtain a to-be-matched normalized time series group corresponding to the to-be-detected normalized time series group in the final output of the decoding unit; wherein the normalized time series data received by the decoding module at the head of the series in the decoding unit is the normalized encoding time series data output by the encoding module at the tail of the series in the encoding unit, and the normalized time series data received by each decoding module in the decoding unit except the decoding module at the head of the series is the decoding and reconstruction result of the previous decoding module.

[0023] In an optional embodiment, the to-be-matched normalized time series group includes normalized reconstructed time series segments of each of the plurality of industrial sensors within a corresponding data collection time period, and for each to-be-detected normalized time series group, the to-be-detected normalized time series group is time series compared with the corresponding to-be-matched normalized time series group to obtain a time series anomaly detection result of the to-be-detected time series group corresponding to the to-be-detected normalized time series group, and the step includes:

[0024] For each industrial sensor, an error anomaly score between the normalized industrial time series segment corresponding to the industrial sensor and the normalized reconstructed time series segment is calculated;

[0025] An anomaly score threshold of the industrial sensor in the data collection time period of the to-be-detected normalized time series group is determined;

[0026] The error anomaly score of the industrial sensor is compared with the corresponding anomaly score threshold;

[0027] In the case where the error anomaly score of the industrial sensor is greater than the corresponding anomaly score threshold, it is determined that the industrial time series segment data of the industrial sensor corresponding to the data collection time period of the to-be-detected normalized time series group at the to-be-detected time series group is abnormal.

[0028] In an optional embodiment, the method further includes:

[0029] Obtaining a plurality of normalized training time series groups each corresponding to data normal of at least one training industrial scene and a data association relationship of a plurality of industrial sensors corresponding to each normalized training time series group, wherein each normalized training time series group includes normalized training time series data of each of the plurality of industrial sensors within a corresponding data collection time period;

[0030] According to the data correlation relationship of the plurality of industrial sensors corresponding to each of the plurality of normalized training time series groups of at least one training industrial scene and each normalized training time series group, time series reconstruction model training is performed on the autoencoder ensemble learning model based on graph structure learning to obtain the multi-element time series reconstruction model.

[0031] In a second aspect, the present application provides a multi-element time series anomaly detection device, the device comprising:

[0032] A detection data acquisition module is configured to acquire a to-be-detected time series group in a target industrial scene, wherein the to-be-detected time series group comprises industrial time series data corresponding to a plurality of industrial sensors respectively and collected at a same data collection time;

[0033] A time series preprocessing module is configured to perform data preprocessing on the to-be-detected time series group to obtain a plurality of to-be-detected normalized time series groups, wherein each to-be-detected normalized time series group corresponds to a data collection time period, and each to-be-detected normalized time series group comprises normalized industrial time series segments of the plurality of industrial sensors respectively in the corresponding data collection time period;

[0034] An association relationship extraction module is configured to, for each to-be-detected normalized time series group, extract a data correlation relationship of the plurality of industrial sensors in the to-be-detected normalized time series group according to the normalized industrial time series segments of the plurality of industrial sensors respectively included in the to-be-detected normalized time series group;

[0035] A multi-element time series reconstruction module is configured to input the normalized industrial time series segments and the data correlation relationship of the plurality of industrial sensors corresponding to the to-be-detected normalized time series group into a pre-stored multi-element time series reconstruction model for time series reconstruction processing to obtain a corresponding to-be-matched normalized time series group;

[0036] A time series anomaly detection module is configured to perform time series comparison between the to-be-detected normalized time series group and the corresponding to-be-matched normalized time series group to obtain a time series anomaly detection result of the to-be-detected time series group corresponding to the to-be-detected normalized time series group.

[0037] In an optional embodiment, the device further comprises:

[0038] A training data acquisition module is configured to acquire a plurality of normalized training time series groups of data normality corresponding to each of at least one training industrial scene and a data correlation relationship of a plurality of industrial sensors corresponding to each normalized training time series group, wherein each normalized training time series group comprises normalized training time series data of the plurality of industrial sensors respectively in a corresponding data collection time period;

[0039] The reconstruction model training module is configured to train a time series reconstruction model on a graph structure learning-based autoencoder ensemble learning model according to the data correlation relationship of the plurality of normalized training time series groups corresponding to each of the at least one training industrial scene and the plurality of industrial sensors corresponding to each normalized training time series group, to obtain the multi-element time series reconstruction model.

[0040] In a third aspect, the present application provides a computer device, comprising a processor and a memory, wherein the memory stores a computer program capable of being executed by the processor, and the processor is capable of executing the computer program to implement the multi-element time series anomaly detection method according to any one of the preceding embodiments.

[0041] In a fourth aspect, the present application provides a storage medium having a computer program stored thereon, wherein the computer program is executed by a processor to implement the multi-element time series anomaly detection method according to any one of the preceding embodiments.

[0042] In this case, the beneficial effects of the embodiments of the present application include the following:

[0043] According to the embodiments of the present application, the data preprocessing is performed on the to-be-detected time series group in the target industrial scene to obtain a plurality of to-be-detected normalized time series groups, and for each to-be-detected normalized time series group, the data correlation relationship of the plurality of industrial sensors at the to-be-detected normalized time series group is extracted according to the normalized industrial time series segments of the plurality of industrial sensors in the corresponding data collection time period, then all the normalized industrial time series segments and the data correlation relationship involved in the to-be-detected normalized time series group are input into the pre-stored multi-element time series reconstruction model for time series reconstruction processing to obtain a corresponding to-be-matched normalized time series group, then the to-be-detected normalized time series group and the corresponding to-be-matched normalized time series group are compared in time series to obtain the time series anomaly detection result of the to-be-detected time series group corresponding to the to-be-detected normalized time series group, thereby achieving accurate detection of complex information anomalies from the time dimension in the multi-element time series scene in combination with the data correlation between the plurality of information variables.

[0044] In order to make the above purposes, features and advantages of the present application more obvious and easy to understand, the following preferred embodiments are described in detail below, and the accompanying drawings are described as follows. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed in the embodiments. It should be understood that the following drawings only show some embodiments of the present application, and therefore should not be considered as limiting the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0046] Figure 1 A schematic diagram of the composition of a computer device provided in the embodiments of this application;

[0047] Figure 2 This is one of the flowcharts illustrating the multivariate temporal anomaly detection method provided in the embodiments of this application;

[0048] Figure 3 for Figure 2 A flowchart illustrating the sub-steps included in step S230;

[0049] Figure 4 A schematic diagram of the model composition of the multivariate temporal reconstruction model provided in the embodiments of this application;

[0050] Figure 5 for Figure 2 A flowchart illustrating the sub-steps included in step S240;

[0051] Figure 6 for Figure 2 A flowchart illustrating the sub-steps included in step S250;

[0052] Figure 7 The second schematic flowchart of the multivariate temporal anomaly detection method provided in the embodiments of this application;

[0053] Figure 8 This is one of the flowcharts of the multi-element timing anomaly detection device provided in the embodiments of this application;

[0054] Figure 9 This is a second schematic diagram of the multi-element timing anomaly detection device provided in the embodiments of this application.

[0055] Icons: 10-Computer equipment; 11-Memory; 12-Processor; 13-Communication unit; 100-Multivariate time series anomaly detection device; 110-Detection data acquisition module; 120-Time series preprocessing module; 130-Correlation extraction module; 140-Multivariate time series reconstruction module; 150-Time series anomaly detection module; 160-Training data acquisition module; 170-Reconstruction model training module. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0057] The following detailed description of embodiments of the application in the drawings attached hereto is included to provide a thorough understanding of the application. Descriptions of specific embodiments in one or more attachments does not restrict the scope of the application. Any alterations and further modifications in the described embodiments, which incorporate the principles of the application, are of course possible by one of ordinary skill in the art and are contemplated to be within the scope of the application.

[0058] It should be noted that like numerals and letters refer to like items throughout the drawings, and once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0059] In the description of the application, it should be understood that the terms "first" and "second" and the like such relational terms only serve to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "comprise", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such a process, method, article or device. Without more limitations, the element defined by the statement "comprises a" does not exclude the presence of additional identical elements in the process, method, article or device comprising the element. The specific meaning of the above terms in the application can be understood by the person of ordinary skill in the art.

[0060] Some embodiments of the application will be described in detail in the following with reference to the accompanying drawings. The following embodiments and features in the embodiments can be combined with each other without conflict.

[0061] Please refer to Figure 1 , Figure 1 is a schematic diagram of a computer device 10 provided by an embodiment of the application. In the embodiment of the application, the computer device 10 can perform accurate detection of complex information anomalies from the time dimension layer for time series data of a plurality of industrial sensors involved in a complex industrial scene, wherein the time series data of the plurality of industrial sensors each has the same data collection time. The computer device 10 can be, but is not limited to, a personal computer, a tablet computer, a server, etc. The sensor types of the plurality of industrial sensors can include temperature sensors, pressure sensors, flow sensors, water level sensors, water quality sensors, wind force sensors, etc.

[0062] In the embodiment of the present application, the computer device 10 can include a memory 11, a processor 12, a communication unit 13 and a multi-element timing anomaly detection apparatus 100. The memory 11, the processor 12 and the communication unit 13 are directly or indirectly electrically connected to each other to realize data transmission or interaction. For example, the memory 11, the processor 12 and the communication unit 13 can be electrically connected to each other through one or more communication buses or signal lines.

[0063] In the embodiment, the memory 11 can be, but is not limited to, a random access memory (RAM), a read only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) and the like. The memory 11 is configured to store a computer program. The processor 12 can execute the computer program after receiving an execution instruction.

[0064] In the embodiment, the processor 12 can be an integrated circuit chip with signal processing capability. The processor 12 can be a general-purpose processor, including a central processing unit (CPU), a graphics processing unit (GPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a ready programmable gate array (FPGA) or other programmable logic devices, a discrete gate or transistor logic device, a discrete hardware component, at least one of the above. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor or the like, which can realize or execute the disclosed methods, steps and logic block diagrams in the embodiments of the present application.

[0065] In this embodiment, the communication unit 13 is configured to establish a communication connection between the computer device 10 and other electronic devices through a network, and transmit and receive data through the network, wherein the network includes wired communication networks and wireless communication networks. For example, the computer device 10 can acquire industrial time series data collected by each industrial sensor (i.e., a plurality of sensor data arranged in the order of collection time points) from a plurality of industrial sensors that need to perform information anomaly detection operations through the communication unit 13, and feed back the final detected time series anomaly detection result to a user terminal through the communication unit 13, wherein the user terminal can be, but is not limited to, a mobile terminal, a tablet computer, etc.

[0066] In this embodiment, the multi-element time series anomaly detection apparatus 100 can include at least one software function module that can be stored in the memory 11 in the form of software or firmware or solidified in the operating system of the computer device 10. The processor 12 can be configured to execute the executable modules stored in the memory 11, such as the software function modules and computer programs included in the multi-element time series anomaly detection apparatus 100. The computer device 10 can achieve accurate detection of complex information anomalies from the time dimension level in the multi-element time series scenario by combining the data correlation between a plurality of information variables (i.e., sensor data respectively responsible for by a plurality of industrial sensors).

[0067] It can be understood that, Figure 1 The block diagram shown is only one constituent schematic diagram of the computer device 10, and the computer device 10 can further include more or fewer components than those shown in Figure 1 or have a different configuration than that shown in Figure 1 . Figure 1 The components shown in may be implemented in hardware, software, or a combination thereof.

[0068] In this application, in order to ensure that the computer device 10 can achieve accurate detection of complex information anomalies from the time dimension level in the multi-element time series scenario by combining the data correlation between a plurality of information variables, the present application embodiment provides a multi-element time series anomaly detection method to achieve the foregoing purpose. The multi-element time series anomaly detection method provided by the present application will be described in detail below.

[0069] Please refer to Figure 2 , Figure 2 is one of the flowcharts of the multi-element time series anomaly detection method provided by the present application embodiment. In this embodiment, the multi-element time series anomaly detection method can include steps S210-S250.

[0070] In step S210, a time series group to be detected in a target industrial scene is obtained, where the time series group to be detected includes industrial time series data corresponding to each of a plurality of industrial sensors collected at a same data collection time.

[0071] In this embodiment, the target industrial scene is an operation scene of an information system facility performing a job requiring information anomaly detection, and the time series group to be detected includes industrial time series data actually collected by a plurality of industrial sensors included in the information system facility at the same data collection time in the target industrial scene, where the industrial time series data of each industrial sensor includes a plurality of sensor data collected by the industrial sensor in the target industrial scene in a time sequence.

[0072] In step S220, data preprocessing is performed on the time series group to be detected to obtain a plurality of normalized time series groups to be detected, where each normalized time series group to be detected corresponds to a data collection time period, and each normalized time series group to be detected includes normalized industrial time series segments of the plurality of industrial sensors in the corresponding data collection time period.

[0073] In this embodiment, after obtaining the time series group to be detected, the computer device 10 can directly separate a plurality of industrial time series groups to be processed from the time series group to be detected, and perform data normalization on industrial time series segment data of each industrial sensor in each industrial time series group to be processed to convert the corresponding industrial time series group to be processed into a normalized time series group to be detected. At this time, each normalized time series group to be detected includes normalized industrial time series segments of the plurality of industrial sensors in the corresponding data collection time period, where each normalized time series group to be detected corresponds to a data collection time period, and data collection time points corresponding to the industrial time series segment data of each industrial sensor in each industrial time series group to be processed are continuously distributed, and the data collection time periods of the plurality of normalized time series groups to be detected can partially overlap or not overlap.

[0074] In an embodiment of this embodiment, the time series group to be detected can be evenly segmented according to a preset time period length, so that the plurality of industrial time series groups to be processed separated correspondingly are continuously distributed in the time dimension, and the data collection time periods of the plurality of industrial time series groups to be processed do not overlap.

[0075] In another implementation of the embodiment, the preset sliding window can be called to slide on the industrial time series data of various industrial sensors included in the to-be-detected time series group, and the industrial time series segment data sets of the various industrial sensors corresponding to the same window position are collected into a to-be-processed industrial time series group. The data collection time period of each to-be-processed industrial time series group corresponds to the window length of the preset sliding window. The data collection time periods of adjacent to-be-processed industrial time series groups generated by the cutting have a part of overlap, that is, the industrial time series segment data of adjacent to-be-processed industrial time series groups generated by the cutting have a part of overlap, so as to avoid destroying the continuous distribution of the industrial time series data in the time dimension and ensure that the number of the to-be-processed industrial time series groups is large enough.

[0076] In the embodiment, when the computer device 10 obtains a to-be-processed industrial time series group, the computer device 10 performs maximum-minimum standardization processing on the industrial time series segment data of the various industrial sensors included in the to-be-processed industrial time series group, respectively, so as to map the corresponding industrial time series segment data to the interval range of [0, 1], and obtain a to-be-detected normalized time series group corresponding to the to-be-processed industrial time series group. At this time, a single to-be-detected normalized time series group includes normalized industrial time series segments of the various industrial sensors in the corresponding data collection time period. In the maximum-minimum standardization processing, the maximum sensor data and the minimum sensor data in the corresponding industrial time series segment data need to be determined, and the first data difference value between the maximum sensor data and the minimum sensor data is calculated. Then, the second data difference value between each sensor data in the industrial time series segment data and the corresponding minimum sensor data is calculated, and the ratio between the corresponding second data difference value and the first data difference value is calculated, that is, the normalized sensor data matched with the sensor data in the corresponding normalized industrial time series segment is obtained.

[0077] In the embodiment, when the computer device 10 obtains a to-be-detected normalized time series group, the computer device 10 performs analysis on the normalized industrial time series segments of the various industrial sensors included in the to-be-detected normalized time series group, and determines the data collection response correlation degree of the various industrial sensors to the target industrial scene in the data collection time period of the to-be-detected normalized time series group, that is, the data correlation relationship of the various industrial sensors at the to-be-detected normalized time series group is obtained.

[0078] In the embodiment, when the computer device 10 obtains a to-be-detected normalized time series group, the computer device 10 performs analysis on the normalized industrial time series segments of the various industrial sensors included in the to-be-detected normalized time series group, and determines the data collection response correlation degree of the various industrial sensors to the target industrial scene in the data collection time period of the to-be-detected normalized time series group, that is, the data correlation relationship of the various industrial sensors at the to-be-detected normalized time series group is obtained.

[0079] Optionally, please follow Figure 3 ,Figure 3 is Figure 2 The step S230 in the method 2000 comprises a flowchart of sub-steps. In the embodiment, the step S230 can comprise a sub-step S231 and a sub-step S232.

[0080] In the sub-step S231, the normalized industrial time series segments of various industrial sensors included in the to-be-detected normalized time series group are subjected to acquisition feature extraction processing, so as to obtain data acquisition feature vectors of the various industrial sensors in the data acquisition time period of the to-be-detected normalized time series group.

[0081] In the embodiment, the data acquisition feature vectors are used to represent the fluctuation characteristics of the corresponding industrial sensors in the specific data acquisition time period.

[0082] In the sub-step S232, data correlation degrees between the data acquisition feature vectors of the various industrial sensors in the data acquisition time period of the to-be-detected normalized time series group are calculated based on a graph structure learning principle, so as to obtain data correlation relationships of the various industrial sensors at the to-be-detected normalized time series group.

[0083] In the embodiment, the computer device 10 can calculate the cosine similarity between the data acquisition feature vectors of any two industrial sensors based on the graph structure learning principle, and call a softmax function to process the calculated cosine similarity, so as to obtain the data correlation degree between the data acquisition feature vectors of the two industrial sensors, and then integrate the data correlation degrees between the data acquisition feature vectors of all industrial sensors into the same matrix, so as to obtain a correlation relationship matrix representing the data correlation relationships of the various industrial sensors at the to-be-detected normalized time series group.

[0084] Thus, the present application can effectively determine the data correlation relationships of the various industrial sensors in the data acquisition time period of the to-be-detected normalized time series group in the target industrial scene by executing the above-mentioned sub-step S231 and sub-step S232.

[0085] In the step S240, the normalized industrial time series segments and the data correlation relationships of the various industrial sensors corresponding to the to-be-detected normalized time series group are input into a pre-stored multi-element time series reconstruction model for time series reconstruction processing, so as to obtain a corresponding to-be-matched normalized time series group.

[0086] In the embodiment, after obtaining the normalized industrial time sequence segments of the plurality of industrial sensors corresponding to a certain to-be-detected normalized time sequence group and the data correlation of the plurality of industrial sensors, the computer device 10 can combine the normalized industrial time sequence segments of the plurality of industrial sensors included in the to-be-detected normalized time sequence group into the data correlation of the plurality of industrial sensors for time sequence reconstruction by calling a pre-stored multi-time sequence reconstruction model, to reconstruct a to-be-matched normalized time sequence group that can be regarded as normal data. The multi-time sequence reconstruction model is trained by using a plurality of normalized training time sequence groups with normal data and the data correlation of the plurality of industrial sensors corresponding to each normalized training time sequence group, to ensure that the multi-time sequence reconstruction model can reconstruct normal multi-time sequence data based on normal multi-time sequence data, and each normalized training time sequence group includes normalized training time sequence data of the plurality of industrial sensors respectively in a corresponding data collection time period.

[0087] Optionally, please refer to Figure 4 and Figure 5 , wherein Figure 4 is a model composition diagram of the multi-time sequence reconstruction model provided in the embodiment of the application, Figure 5 is Figure 2 , the step S240 includes a flowchart of sub-steps. In the embodiment, the multi-time sequence reconstruction model can include a self-attention unit, an encoding unit, and a decoding unit. The encoding unit includes a plurality of encoding modules connected in series with each other. The input data of each encoding module, except the encoding module arranged at the first position in series, is the output data of the previous encoding module. Each encoding module is composed of a long short-term memory network (LSTM) and a graph convolution network (GCN). The decoding unit includes a plurality of decoding modules connected in series with each other. The arrangement order of the encoding modules is arranged in reverse to the arrangement order of the decoding modules. Each encoding module corresponds to a decoding module (for example, the encoding module arranged at the first position in series corresponds to the decoding module arranged at the last position in series, and the encoding module arranged at the last position in series corresponds to the decoding module arranged at the first position in series). The input data of each decoding module, except the decoding module arranged at the first position in series, is the output data of the previous decoding module. Therefore, the step S240 can include sub-steps S241-S243.

[0088] In the sub-step S241, the normalized industrial time sequence segments of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group and the data correlation of the plurality of industrial sensors are input into the encoding unit. Each encoding module in the encoding unit extracts time dimension features from the received normalized time sequence data by the long short-term memory network, and then embeds the extracted time dimension features into the data correlation of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group by the graph convolution network for time sequence encoding, to obtain the normalized encoding time sequence data output by the encoding module.

[0089] In this embodiment, the encoding unit can be constructed from encoder modules included in an Autoencoder with Graph Structure Learning (AGL) ensemble learning model. The normalized time-series data received by the encoding module at the beginning of the cascade is the normalized industrial time-series segment of the various industrial sensors included in the normalized time-series group to be detected. The normalized time-series data of the various industrial sensors received by each encoding module other than the encoding module at the beginning of the cascade is the normalized coded time-series data of the various industrial sensors output by the previous encoding module. The time-dimensional features extracted by the i-th encoding module at its own Long Short-Term Memory network can be... The normalized coded timing data output by the i-th encoding module can be represented as x(E). i ) is used to represent.

[0090] Sub-step S242 calls the self-attention unit to perform attention evaluation on the temporal dimension features extracted by each of the multiple encoding modules at the last layer of the Long Short-Term Memory network architecture, and obtains the attention-weighted hidden state representation of each encoding module.

[0091] In this embodiment, the self-attention unit can be constructed from the self-attention module included in the Autoencoder with Graph Structure Learning (AGL) ensemble learning model. The self-attention unit is used to perform attention-weighted processing on the temporal features extracted from the last layer of the long short-term memory network architecture of each of the multiple encoding modules included in the encoding unit, to obtain the attention-weighted hidden state representations of each of the multiple decoding modules. Specifically, the temporal features extracted by the i-th encoding module at the last layer of its own long short-term memory network architecture can be represented by h... T (E i The representation is as follows (e.g., the temporal dimension feature h input to the self-attention unit by the encoding module at the beginning of the concatenation). T (E1), the encoding module at the end of the concatenation sequence is input to the time dimension feature h of the self-attention unit. T (E n The attention-weighted hidden state representation of the i-th encoding module can be represented using h' T (D i (e.g., the attention-weighted hidden state representation h' of the encoding module that is first in the concatenation) T (D1), the attention-weighted hidden state representation h' of the encoding module at the end of the concatenation.T (D n ))。

[0092] Sub-step S243, calling all decoding modules in the decoding unit to respectively decode and reconstruct based on the attention-weighted hidden state representation of the corresponding encoding module and the received normalized time series data to obtain the final output of the decoding unit, i.e., the to-be-matched normalized time series group corresponding to the to-be-detected normalized time series group.

[0093] In the embodiment, the decoding unit can be formed by decoding modules included in an Autoencoder with Graph Structure Learning (AGL) integrated learning model. Each decoding module included in the decoding unit can be composed of a vector inner-product network and a long short-term memory network (LSTM). For each decoding module included in the decoding unit, the decoding module can receive the normalized time series data to be processed by the vector inner-product network for vector inner-product processing, and receive the attention-weighted hidden state representation of the encoding module corresponding to the decoding module from the self-attention unit by the long short-term memory network. Then, the long short-term memory network takes the received attention-weighted hidden state representation as its initial hidden state, and takes the normalized time series data processed by the vector inner-product network as its decoding input data. Then, the decoding module decodes and reconstructs the initial hidden state and the decoding input data to obtain the decoding reconstruction result of the decoding module. The normalized time series data received by the decoding module at the head of the series is the normalized encoded time series data output by the encoding module at the tail of the series. The normalized time series data received by each decoding module in the decoding unit except the decoding module at the head of the series is the decoding reconstruction result of the previous decoding module (i.e., the normalized decoded time series data of the industrial sensors output by the previous decoding module). Thus, the final output of the decoding unit, i.e., the to-be-matched normalized time series group corresponding to the to-be-detected normalized time series group, is composed of the decoding reconstruction result output by the decoding module at the tail of the series (i.e., the normalized decoded time series data of the industrial sensors output by the decoding module at the tail of the series). The normalized time series data processed by the vector inner-product network of the jth decoding module can be represented as , the decoding reconstruction result output by the jth decoding module can be represented as y(D n+1-j , the attention-weighted hidden state of the encoding module corresponding to the jth decoding module can be represented as h' T (D n+1-j , and n represents the total number of encoding modules.

[0094] Thus, the application can perform the above-mentioned sub-steps S241-S243 to reconstruct time series data in combination with the data correlation between multiple information variables in a multi-time series scenario, ensuring that the reconstructed time series data can effectively represent the data correlation between multiple industrial sensors.

[0095] In step S250, the to-be-detected normalized time series group is compared with the corresponding to-be-matched normalized time series group to obtain a time series anomaly detection result of the to-be-detected time series group corresponding to the to-be-detected normalized time series group.

[0096] In this embodiment, the to-be-matched normalized time series group includes normalized reconstructed time series segments of each of the multiple industrial sensors within a corresponding data collection time period. When comparing the to-be-detected normalized time series group and the to-be-matched normalized time series group with each other, the computer device 10 needs to select normalized industrial time series segments of the same type of industrial sensor in the to-be-detected normalized time series group and normalized reconstructed time series segments of the same type of industrial sensor in the to-be-matched normalized time series group for comparison to determine whether there is an abnormality in the collected data of the industrial sensor in the to-be-detected normalized time series group within the data collection time period of the target industrial scene, i.e., to obtain a time series anomaly detection result of the to-be-detected time series group corresponding to the to-be-detected normalized time series group.

[0097] Optionally, please refer to Figure 6 , Figure 6 is Figure 2 the flowchart of the sub-steps included in step S250 in

[0098] In this embodiment, step S250 can include sub-steps S251-S254.

[0099] In this embodiment, the mean square error loss function (MSE Loss) value between the normalized industrial time series segment and the normalized reconstructed time series segment of the corresponding industrial sensor can be calculated as the error anomaly score between the normalized industrial time series segment and the normalized reconstructed time series segment of the corresponding industrial sensor.

[0100] In sub-step S252, the anomaly score threshold of the industrial sensor in the data collection time period of the to-be-detected normalized time series group is determined.

[0101] In this embodiment, a value between 0.96 and 0.99 can be selected as the anomaly score threshold of the industrial sensor in the data collection time period of the to-be-detected normalized time series group based on a normal distribution.

[0102] Sub-step S253, compare the error anomaly score of the industrial sensor with the corresponding anomaly score threshold.

[0103] Sub-step S254, in the case that the error anomaly score of the industrial sensor is greater than the corresponding anomaly score threshold, it is determined that the industrial time sequence segment data of the industrial sensor at the to-be-detected time sequence group corresponding to the data acquisition time period of the to-be-detected normalized time sequence group is abnormal, otherwise it is determined that the industrial time sequence segment data of the industrial sensor at the to-be-detected time sequence group corresponding to the data acquisition time period of the to-be-detected normalized time sequence group is normal.

[0104] Therefore, the present application can quickly realize the abnormal detection operation of the industrial time sequence segment of the to-be-detected time sequence group by executing the above-mentioned sub-step S251 to sub-step S254.

[0105] Therefore, the present application can achieve precise detection effect of complex information anomaly from the time dimension level by combining the data correlation between multiple information variables in the multi-element time sequence scene by executing the above-mentioned step S210 to step S250.

[0106] Optionally, please refer to Figure 7 , Figure 7 is a flowchart of a multi-element time sequence anomaly detection method provided by an embodiment of the present application. In the embodiment of the present application, the multi-element time sequence anomaly detection method can further include step S260 and step S270.

[0107] Step S260, obtain a plurality of normalized training time sequence groups each corresponding to data normal of at least one training industrial scene and a data correlation relationship of a plurality of industrial sensors corresponding to each normalized training time sequence group, wherein each normalized training time sequence group includes normalized training time sequence data of the plurality of industrial sensors respectively in a corresponding data acquisition time period.

[0108] In the embodiment, the data correlation relationship of the plurality of industrial sensors corresponding to each normalized training time sequence group can be obtained by processing the normalized training time sequence data included in the normalized training time sequence group by using the same means as step S230, and the normalized training time sequence group can be obtained by processing the training time sequence group by using the data normalization means in step S220, wherein a single training time sequence group includes training industrial time sequence data of the plurality of industrial sensors respectively in a corresponding data acquisition time period.

[0109] Step S270, according to at least one training industrial scene respectively corresponding to a plurality of normalized training time series groups and the data correlation relationship of each normalized training time series group corresponding to a plurality of industrial sensors, the time series reconstruction model training is carried out on the autoencoder integrated learning model based on the graph structure learning, and a multivariate time series reconstruction model is obtained.

[0110] Therefore, the application can train a multivariate time series reconstruction model that combines the data correlation between multiple information variables to perform time series reconstruction by executing steps S260-S270.

[0111] In the present application, in order to ensure that the computer device 10 can execute the above-mentioned multivariate time series anomaly detection method through the multivariate time series anomaly detection device 100, the present application realizes the above-mentioned functions by means of function module division of the multivariate time series anomaly detection device 100. The specific composition of the multivariate time series anomaly detection device 100 provided by the present application is described as follows.

[0112] Please refer to Figure 8 , Figure 8 is one of the flowcharts of the multivariate time series anomaly detection device 100 provided by the embodiments of the present application. In the embodiments of the present application, the multivariate time series anomaly detection device 100 can include a detection data acquisition module 110, a time series preprocessing module 120, an association relationship extraction module 130, a multivariate time series reconstruction module 140, and a time series anomaly detection module 150.

[0113] The detection data acquisition module 110 is configured to acquire a to-be-detected time series group in a target industrial scene, wherein the to-be-detected time series group includes industrial time series data corresponding to each of a plurality of industrial sensors with consistent data collection time.

[0114] The time series preprocessing module 120 is configured to perform data preprocessing on the to-be-detected time series group to obtain a plurality of to-be-detected normalized time series groups, wherein each to-be-detected normalized time series group corresponds to a data collection time period, and each to-be-detected normalized time series group includes normalized industrial time series segments of the plurality of industrial sensors in the corresponding data collection time period.

[0115] The association relationship extraction module 130 is configured to, for each to-be-detected normalized time series group, extract a data correlation relationship of the plurality of industrial sensors at the to-be-detected normalized time series group according to the normalized industrial time series segments of each of the plurality of industrial sensors included in the to-be-detected normalized time series group.

[0116] The multi-element time sequence reconstruction module 140 is configured to input the normalized industrial time sequence segments and the data association relationship of the plurality of industrial sensors corresponding to the normalized time sequence group to be detected into a pre-stored multi-element time sequence reconstruction model for time sequence reconstruction processing, to obtain a corresponding normalized time sequence group to be matched.

[0117] The time sequence anomaly detection module 150 is configured to perform time sequence comparison between the normalized time sequence group to be detected and the corresponding normalized time sequence group to be matched, to obtain a time sequence anomaly detection result of the time sequence group to be detected corresponding to the normalized time sequence group to be detected.

[0118] Optionally, please refer to Figure 9 , Figure 9 is a second flowchart of the multi-element time sequence anomaly detection device 100 provided in the embodiments of the present application. In the embodiments of the present application, the multi-element time sequence anomaly detection device 100 can further include a training data acquisition module 160 and a reconstruction model training module 170.

[0119] The training data acquisition module 160 is configured to acquire a plurality of normalized training time sequence groups each corresponding to a data normal training industrial scene of at least one training industrial scene and a data association relationship of a plurality of industrial sensors corresponding to each normalized training time sequence group, wherein each normalized training time sequence group includes normalized training time sequence data of the plurality of industrial sensors respectively in a corresponding data collection time period.

[0120] The reconstruction model training module 170 is configured to perform time sequence reconstruction model training on a self-encoder integrated learning model based on graph structure learning according to the plurality of normalized training time sequence groups each corresponding to the data normal training industrial scene of the at least one training industrial scene and the data association relationship of the plurality of industrial sensors corresponding to each normalized training time sequence group, to obtain a multi-element time sequence reconstruction model.

[0121] It should be noted that the multi-element time sequence anomaly detection device 100 provided in the embodiments of the present application has the same basic principles and technical effects as the multi-element time sequence anomaly detection method described above. For brevity, some parts of the present embodiments are not mentioned, and the description of the multi-element time sequence anomaly detection method described above can be referred to.

[0122] In the embodiments of the present application, it should be understood that the disclosed apparatus and method can also be implemented in other manners. The embodiments described above are merely exemplary. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architectures, functions and operation of the apparatus, method and computer program product according to the embodiments of the present application. In this regard, each block in the flowcharts and block diagrams can represent a module, a segment or a portion of code which comprises one or more executable instructions for implementing the specified logic function. It should also be noted that in some alternative implementations, the functions noted in the blocks can occur in a different order than that noted in the accompanying drawings. For example, two consecutive blocks can actually be executed in parallel or in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts and combinations thereof can be implemented by a dedicated hardware-based system that performs specified functions or actions, or can be implemented by a combination of special-purpose hardware and computer instructions.

[0123] In addition, the various functional modules in the embodiments of the present application can be integrated together to form a separate part, or can exist independently, or two or more modules can be integrated to form a separate part. When the functions are realized in the form of software functional modules and sold or used as independent products, they can be stored in a readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a readable storage medium, including a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned readable storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0124] In summary, in the multi-element time sequence anomaly detection method and device, the computer device and the storage medium provided by the embodiments of the present application, the present application obtains a plurality of to-be-detected normalized time sequence groups by performing data preprocessing on the to-be-detected time sequence group in the target industrial scene, and for each to-be-detected normalized time sequence group, according to the normalized industrial time sequence segments of each of the plurality of industrial sensors in the corresponding data collection time period included in the to-be-detected normalized time sequence group, extracts the data correlation relationship of the plurality of industrial sensors at the to-be-detected normalized time sequence group, then inputs all the normalized industrial time sequence segments and the data correlation relationship involved in the to-be-detected normalized time sequence group into the pre-stored multi-element time sequence reconstruction model for time sequence reconstruction processing to obtain the corresponding to-be-matched normalized time sequence group, then performs time sequence comparison on the to-be-detected normalized time sequence group and the corresponding to-be-matched normalized time sequence group to obtain the time sequence anomaly detection result of the to-be-detected time sequence group corresponding to the to-be-detected normalized time sequence group, thereby realizing accurate detection of complex information anomalies from the time dimension level in the multi-element time sequence scene in combination with the data correlation between the plurality of information variables.

[0125] The above merely describes various embodiments of the present application, but the protection scope of the present application is not limited thereto, and any person skilled in the art can easily think of changes or replacements within the technical scope disclosed by the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A multi-variate time series anomaly detection method, characterized in that, The method comprises: acquiring a to-be-detected time sequence group in a target industrial scene, wherein the to-be-detected time sequence group comprises industrial time sequence data corresponding to each of a plurality of industrial sensors and collected at a same data collection time; performing data preprocessing on the to-be-detected time sequence group to obtain a plurality of to-be-detected normalized time sequence groups, wherein each to-be-detected normalized time sequence group corresponds to a data collection time period, and each to-be-detected normalized time sequence group comprises normalized industrial time sequence segments of the plurality of industrial sensors in the corresponding data collection time period; wherein the step of performing data preprocessing on the to-be-detected time sequence group to obtain a plurality of to-be-detected normalized time sequence groups comprises: calling a preset sliding window to slide on the industrial time sequence data of various industrial sensors included in the to-be-detected time sequence group, and collecting industrial time sequence segment data of the plurality of industrial sensors corresponding to a same window position into a to-be-processed industrial time sequence group; the data collection time period corresponding to each to-be-processed industrial time sequence group is consistent with the window length of the preset sliding window; for each to-be-processed industrial time sequence group, maximum and minimum normalization processing is performed on the industrial time sequence segment data of the plurality of industrial sensors included in the to-be-processed industrial time sequence group, respectively, to obtain a to-be-detected normalized time sequence group corresponding to the to-be-processed industrial time sequence group; for each to-be-detected normalized time sequence group, data correlation relationships of the plurality of industrial sensors at the to-be-detected normalized time sequence group are extracted according to the normalized industrial time sequence segments of the plurality of industrial sensors included in the to-be-detected normalized time sequence group; wherein for each to-be-detected normalized time sequence group, the step of extracting the data correlation relationships of the plurality of industrial sensors at the to-be-detected normalized time sequence group comprises: performing collection feature extraction processing on the normalized industrial time sequence segments of various industrial sensors included in the to-be-detected normalized time sequence group to obtain data collection feature vectors of the various industrial sensors in the data collection time period of the to-be-detected normalized time sequence group; based on a graph structure learning principle, data correlation degrees between the data collection feature vectors of the various industrial sensors in the data collection time period of the to-be-detected normalized time sequence group are calculated to obtain the data correlation relationships of the plurality of industrial sensors at the to-be-detected normalized time sequence group; the normalized industrial time sequence segments of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group and the data correlation relationships are input into a pre-stored multivariate time sequence reconstruction model for time sequence reconstruction processing to obtain a corresponding to-be-matched normalized time sequence group; the to-be-detected normalized time sequence group and the corresponding to-be-matched normalized time sequence group are compared in time sequence to obtain a time sequence anomaly detection result of the to-be-detected time sequence group corresponding to the to-be-detected normalized time sequence group. The multi-element time sequence reconstruction model comprises a self-attention unit, an encoding unit and a decoding unit, wherein the encoding unit comprises a plurality of encoding modules connected in series, each encoding module being composed of a long short-term memory network and a graph convolution network, the decoding unit comprises a plurality of decoding modules connected in series, each encoding module corresponding to a decoding module; for each to-be-detected normalized time sequence group, the normalized industrial time sequence segments and data association relationships of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group are input into the pre-stored multi-element time sequence reconstruction model for time sequence reconstruction processing to obtain a corresponding to-be-matched normalized time sequence group, comprising: The normalized industrial time sequence segments and data association relationships of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group are input into the encoding unit, each encoding module in the encoding unit extracts time dimension features from the received normalized time sequence data through the long short-term memory network, and then embeds the extracted time dimension features into the data association relationships of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group through the graph convolution network for time sequence encoding to obtain normalized encoding time sequence data output by the encoding module; wherein the normalized time sequence data received by the first encoding module in the series is the normalized industrial time sequence segments of the plurality of industrial sensors corresponding to the to-be-detected normalized time sequence group, and the normalized time sequence data received by each encoding module other than the first encoding module in the series is the normalized encoding time sequence data output by the previous encoding module; The self-attention unit is called to perform attention evaluation on the time dimension features extracted by each of the plurality of encoding modules at the last network architecture of the long short-term memory network to obtain attention weighted hidden state representations of each encoding module; All decoding modules in the decoding unit are called to perform decoding reconstruction based on the attention weighted hidden state representations of the corresponding encoding module and the normalized time sequence data received by the decoding module itself to obtain a to-be-matched normalized time sequence group corresponding to the to-be-detected normalized time sequence group finally output by the decoding unit; wherein the normalized time sequence data received by the first decoding module in the series is the normalized encoding time sequence data output by the last encoding module in the encoding unit, and the normalized time sequence data received by each decoding module other than the first decoding module in the series is the decoding reconstruction result of the previous decoding module.

2. The method of claim 1, wherein, The to-be-matched normalized time sequence group comprises normalized reconstructed time sequence segments of the plurality of industrial sensors in the corresponding data collection time period, and for each to-be-detected normalized time sequence group, the to-be-detected normalized time sequence group is compared with the corresponding to-be-matched normalized time sequence group to obtain a time sequence anomaly detection result of the to-be-detected time sequence group corresponding to the to-be-detected normalized time sequence group, comprising: For each industrial sensor, calculate the error anomaly score between the normalized industrial time series segment corresponding to the industrial sensor and the normalized reconstructed time series segment; Determine the anomaly score threshold of the industrial sensor in the data collection time period of the to-be-detected normalized time series group; Compare the error anomaly score of the industrial sensor with the corresponding anomaly score threshold; If the error anomaly score of the industrial sensor is greater than the corresponding anomaly score threshold, it is determined that the industrial sensor has an anomaly in the industrial time series segment data corresponding to the data collection time period of the to-be-detected normalized time series group in the to-be-detected time series group.

3. The method according to claim 1 or 2, characterized in that, The method further comprises: Obtaining a plurality of normalized training time series groups each corresponding to a data normal training industrial scene and a data correlation relationship of a plurality of industrial sensors corresponding to each normalized training time series group, wherein each normalized training time series group comprises normalized training time series data of the plurality of industrial sensors in a corresponding data collection time period; According to the plurality of normalized training time series groups each corresponding to a data normal training industrial scene and the data correlation relationship of the plurality of industrial sensors corresponding to each normalized training time series group, performing time series reconstruction model training on a graph structure learning-based autoencoder ensemble learning model to obtain the multi-element time series reconstruction model.

4. A multi-variate time series anomaly detection apparatus, characterized by, The device is used to implement the multi-element time series anomaly detection method of any one of claims 1-3, and the device comprises: A detection data acquisition module is configured to acquire a to-be-detected time series group in a target industrial scene, wherein the to-be-detected time series group comprises industrial time series data of a plurality of industrial sensors each corresponding to a data collection time period; A time series preprocessing module is configured to perform data preprocessing on the to-be-detected time series group to obtain a plurality of to-be-detected normalized time series groups, wherein each to-be-detected normalized time series group corresponds to a data collection time period, and each to-be-detected normalized time series group comprises normalized industrial time series segments of the plurality of industrial sensors in the corresponding data collection time period; An association relationship extraction module is configured to, for each to-be-detected normalized time series group, extract a data correlation relationship of the plurality of industrial sensors at the to-be-detected normalized time series group according to the normalized industrial time series segments of the plurality of industrial sensors included in the to-be-detected normalized time series group; A multi-element time series reconstruction module is configured to input the normalized industrial time series segments and the data correlation relationship of the plurality of industrial sensors corresponding to the to-be-detected normalized time series group into a pre-stored multi-element time series reconstruction model for time series reconstruction processing to obtain a corresponding to-be-matched normalized time series group; A time series anomaly detection module is configured to perform time series comparison between the to-be-detected normalized time series group and the corresponding to-be-matched normalized time series group to obtain a time series anomaly detection result of the to-be-detected time series group corresponding to the to-be-detected normalized time series group.

5. The apparatus of claim 4, wherein, The device further comprises: The training data acquisition module is configured to acquire a plurality of normalized training time sequence groups corresponding to normal data of at least one training industrial scene respectively and a data correlation relationship of a plurality of industrial sensors corresponding to each normalized training time sequence group, wherein each normalized training time sequence group comprises normalized training time sequence data of the plurality of industrial sensors respectively in a corresponding data collection time period. The reconstruction model training module is configured to perform time sequence reconstruction model training on a self-encoder ensemble learning model based on graph structure learning according to the plurality of normalized training time sequence groups corresponding to the at least one training industrial scene respectively and the data correlation relationship of the plurality of industrial sensors corresponding to each normalized training time sequence group, to obtain the multi-element time sequence reconstruction model.

6. A computer device, comprising: The computer program is executed by the processor to implement the multi-element time sequence anomaly detection method in any one of claims 1-3.

7. A storage medium having stored thereon a computer program, characterized in that The computer program is executed by the processor to implement the multi-element time sequence anomaly detection method in any one of claims 1-3.

Images