An adaptive correlation-aware unsupervised deep learning anomaly detection method

Abstract

This invention proposes an adaptive correlation-aware unsupervised deep learning anomaly detection method, belonging to the field of Cyber-Physical Systems (CPS), such as smart living, industrial control, and digital healthcare. It also considers various security issues existing in the Internet and the Internet of Things within the context of CPS. Among these, unsupervised deep learning-based anomaly detection models have achieved good results in many CPS domains through latent feature learning. However, the correlation between data has not received sufficient attention, and the lack of adaptive training to uncover their implicit relationships is crucial for CPS security in more complex data environments. Therefore, this paper proposes an adaptive correlation-aware unsupervised deep learning method for CPS anomaly detection. A directed graph structure is constructed to represent the implicit correlations between data, and a dynamic graph adaptive update design is used to extract and reconstruct features, estimate the probability distribution and anomaly energy, and complete the anomaly detection.

Description

Technical fields:

[0001] This invention relates to an adaptive correlation-aware unsupervised deep learning anomaly detection method, which has excellent applications in the field of anomaly detection in cyber-physical systems. Background technology:

[0002] Anomaly detection rule learning mainly employs three strategies: supervised, semi-supervised, and unsupervised. Supervised methods require a large amount of labeled training data, while semi-supervised methods have high requirements for training data, and noisy data has a more significant negative impact on model training. Therefore, supervised and semi-supervised methods are not suitable for CPS data environments. Unsupervised methods are designed to train on large amounts of unlabeled data, which is more common in practical CPS applications. These methods can be viewed as estimations of the probability distribution of the data; anomalies often reside in subspaces with low probability density. Unsupervised methods are currently the most recommended approach for DLADMs. They can be categorized into four types: reconstruction-based, support domain-based, cluster-based, and hybrid, such as Deep Structure Energy Model (DSEBM) and Deep AE-based GMM (DAGMM). However, existing unsupervised methods primarily rely on raw features, ignoring the implicit correlations between data, thus weakening their practical performance in more complex CPS data. AE-based ADM (AE-ADM) is the most popular type of dl-ADM. Deep Algorithm (DAE), with its deeper network structure, has been applied in fields such as ICCS and smart wind power grids. However, DAE has low training efficiency and is prone to overfitting, neglecting latent distribution estimation. Dirac-Delta Variational Algorithm (DVAE) redefines KL divergence to reduce the reproduction error (RE) of variational AE. However, the improved KL divergence only reduces the similarity between normal latent features, leaving the distribution of anomalous latent features still highly dispersed. SAE adds a contraction regularization term to the loss function to constrain the latent distribution, but the constraint is insufficient. This is mainly because some normal latent features with large gradients are labeled as anomalous regions of the latent distribution. Dirac-Delta Variational Algorithm (DSEBM) can reduce training losses in information fusion and connect with regularized acoustic emission to complete the sampling and model training of complex data. It has been applied in ICCS and SHS. However, DSEBM requires significant differences between normal and anomalous data. Currently, the most popular probability density estimation method is Gaussian Mixture Model (GMM), which divides the entire object into multiple sub-objects based on a Gaussian distribution to obtain a more accurate latent distribution. Therefore, the proposed DAGMM model, another energy-based model, significantly outperforms other acoustic emission models. DAGMM has applications in traditional IoT security and SHS (Sound Emission System), where information loss can be compensated by calculating REs as part of latent features, but it requires a high-quality training set. Therefore, the proposed ACUDL leverages the advantages of the aforementioned models and is designed based on the DAGMM framework. GAN-ADM: As another important branch of dl-ADM, GAN-ADM excels in estimating the probability distribution of latent features. AnoGAN, the first GAN-ADM, has already been used in SHS. However, training on high-dimensional data is challenging.Adversarial learning-based anomaly detection (ALAD) methods, based on acoustic emission and bidirectional GANs, have been applied to environmental monitoring CPS and precision instrument monitoring. However, ALAD training is complex and insufficient for training on small datasets. Furthermore, the training instability of GANs weakens their practical application effectiveness. GNNs and dynamic graphs: Recently, GNNs and Graph Convolutional Networks (GCNs) have utilized graph structures to build pairwise relationship learning models and have been applied in social networks, recommender systems, and anomaly detection. The latest widely discussed method is OCGNN (OneClass GNN), which combines Deep-SVDD and GCN to enhance feature mining capabilities. Attention mechanisms are widely used in these methods. Graph Attention Networks (GATs) can effectively drive the model to focus on key parts of the data, resulting in more accurate training results. However, in various CPS application scenarios, some data characteristics still lack explicit graph relationships. Directly establishing graph structures is impossible. Furthermore, GCNs only fuse static structural information and cannot guarantee that the structural information is optimal. Dynamic graphs, primarily based on Direct-Generation Networks (DGCNs), can automatically update structural information and have been well-received in intelligent recommendation, social networks, and Social Relationships (SHS). However, in Cyber-Physical Systems (CPS), adaptive updates using dynamic graphs are rare, and complex CPS data requires an adaptive mechanism to capture the most effective latent features. Since graph structures are better suited for extracting relevant features, this paper proposes an adaptive relevance update using dynamic graphs and constructs a Direct-Aspect Relationship (D-AE) using Gaussian Arithmetic Arrays (GATs) to fully extract relevant features and original irrelevant features. Summary of the Invention:

[0003] To address the existing security and stability issues of Cyber-Physical Systems (CPS), this invention discloses an adaptive correlation-aware unsupervised deep learning anomaly detection method.

[0004] (I) Technical Solution

[0005] The CPS dataset is processed into directed graphs as samples and fed into the model. The model employs a dual-path autoencoder to reconstruct the samples. In the model architecture, the autoencoder consists of stacked graph neural layers, the estimation network is a Gaussian mixture model, the output layer is a fully connected layer, followed by activation layers. This structure is used to estimate the reconstructed and fused representation, and the results are used for anomaly analysis. The specific steps include:

[0006] 1. In the data preprocessing stage, in order to accurately analyze the correlation between complex CPS data, we constructed a directed graph structure to associate the samples in the feature space and used a dynamic graph for adaptive updates, continuously updating the feature space through the dynamic graph.

[0007] Step 1_1: Construct the graph using the KNN algorithm. We construct an initial correlated directed graph G0. For each sample X... i Choose K0 nearest neighbors, NB i ={X ik |k=1,2,…,K0}, using the KNN algorithm, KNN(X,K g ), g = 0, 1, 2, ..., is the number of iterations. Then, a straight edge from X ik Point to X i Finally, construct the directed graph G0.

[0008] Step 1_2 designs a simple and efficient dynamic graph based on G0 to adaptively update the correlation between samples. The key is to dynamically adjust K, under the constraint of training loss, based on K and the previous G. s Get the latest G0:

[0009]

[0010]

[0011] Graphical error GE g , is one of the loss functions in ACUDL, and is used as the objective function for adaptive correlation graph updates:

[0012] GE g =‖G g -G0‖2

[0013] 2. In the data input stage, the processed data is used as the input to the model and fed into the autoencoder for reconstruction. The representation features obtained from the dual encoders are concatenated, and finally the concatenated final representation is fed into the estimation network for anomaly detection through a Gaussian mixture model.

[0014] Step 2_1 employs a raw feature encoder, a graph encoder for relevant features, and a decoder for reconstructing the original samples. The key network modules are a multilayer perceptron (MLP) and a Gaussian Arithmetic Array (GAT). Raw Feature Encoder: An MLP composed of fully connected (FC) layers is used for nonlinear raw, irrelevant feature extraction.

[0015]

[0016] in It is the input data, W 0 With D 0 The data contained herein are the weight matrix and the bias matrix, both initialized with random parameters, where l represents the number of layers in the network. It is the initial input value, and It is the final output value obtained after passing through several neural layers.

[0017] Step 2_2: A graph encoder for relevant features uses GAT to capture the correlation features between samples and implements shared attention α on each sample. i,j :

[0018] α i,j =ATT(x i ,x j )=ACT(ω T ·[W C x i [W C x j ])

[0019] Randomly initialized α i,j The nodes are adaptively updated through continuous training and used to represent node importance. Here, w and W are the coefficient vector and weight matrix of GAT, respectively, and are randomly initialized. The number of neurons in ATT() is also N. C The "||" operator is used for concatenation. The `ACT()` function is required in all levels except the last one.

[0020] Step 2_3 uses the Softmax function in GAT to normalize the importance of each node, and obtains the relevant features through a weighted sum function:

[0021]

[0022] The final representation matrix is ​​obtained.

[0023] Step 2_4 introduces feature fusion and decoder, and obtains fused features through FC layer, as shown in the following formula:

[0024]

[0025] in This represents the operator for element-wise addition of matrices. Then, the decoder uses Z... f The initial data X is reconstructed from the input to obtain the reconstructed data X, the reconstruction error RE, and the reconstructed features Z. r . MLP formula:

[0026] RE = Euc(X,X),

[0027] Zr = [Cos(X,X),Euc(X,X)]

[0028] Cos() is the cosine distance function, and Euc() is the Euclidean distance function.

[0029] Step 2_5: To estimate the data probability distribution, a GMM-based estimation network was constructed, consisting of multiple fully connected (FC) layers. r and Zf Combined into input, Z = [Z r Z f This preserves most of the data information. The mixture probability distribution coefficient matrix of the samples is obtained and estimated using an MLP. The final layer's ACT() is a Softmax() function. Here, M is the number of mixture probability distributions. The mean vector μ and covariance matrix ∑ of the GMM are represented by P:

[0030]

[0031]

[0032] Finally, the anomaly energy (energy) of the input sample is calculated based on P. The higher the energy, the greater the probability of the sample being anomaly.

[0033]

[0034] 3. During the formal training phase of the model, the dataset is split into training, validation, and test sets in a 6:2:2 ratio. The training data serves as the input for model training, and after training, the optimized model is obtained.

[0035] Step 3_1: Input the training data into the initialized model.

[0036] Step 3_2 involves multiple matrix multiplications in the dual-channel encoder layer to obtain multiple representation matrices.

[0037] Step 3_3 involves obtaining reconstructed features from the representation matrix through the decoder using the reconstruction error.

[0038] Step 3_4 involves concatenating the reconstructed features with the original features.

[0039] Step 3_5 involves feeding the concatenated final representation features into the estimation network.

[0040] Step 3_6 involves anomaly detection based on the anomalous energy of samples obtained by estimating the network distribution.

[0041] Step 3_7 optimizes the model for each generation using the defined loss function.

[0042] Step 3_8 involves iterative steps to obtain the optimized model.

[0043] (II) Beneficial Effects

[0044] 1. This invention addresses the security issues of Cyber-Physical System (CPS) datasets and the potential problems of gradient vanishing or exploding during training. It uses the KNN algorithm for graph construction and leverages the features of dynamic graphs to process the correlations between data and uncover their implicit relationships.

[0045] 2. This invention addresses the problem that existing Graph Neural Networks (GNN) models can only consider one of the global and local aspects, and cannot take both into account. It utilizes dynamic graph adaptive updates, then designs a dual autoencoder to extract the original irrelevant features, relevant features, and reconstructed features, and uses a Gaussian mixture model (GMM) to construct an estimation network to estimate the probability distribution and anomaly energy, thereby completing anomaly analysis. Attached image description:

[0046] Figure 1 This is a flowchart of the method of the present invention.

[0047] Figure 2 This is a diagram of the formal training model described in this invention. Detailed implementation method:

[0048] To more clearly and completely illustrate the technical solution of the present invention, the present invention will be further described below in conjunction with the accompanying drawings and examples.

[0049] The following selections are the cardiac arrhythmia dataset and the ECG5000 dataset. These are high-dimensional, multi-type time-series databases. The purpose of the cardiac arrhythmia dataset is to distinguish between the presence and absence of arrhythmias and classify them into one of 16 groups. The ECG5000 data is preprocessed, extracting each heartbeat and interpolating to make each heartbeat equal in length. The difference is that cardiac arrhythmias are small-scale, while ECG5000 is large-scale. For example... Figure 1 As shown:

[0050] Step 1 as follows Figure 1 As shown in the flowchart, the first step of the method is to input data and perform data preprocessing. The specific steps of data preprocessing are as follows:

[0051] Step 1_1: Load the Arrhythmia and ECG5000 data files in the data folder. After loading, you will get 20,000 data entries for Arrhythmia and 5,000 data entries for ECG5000.

[0052] Step 1_2: Design a simple and efficient dynamic graph and split the dataset into training, validation and test sets in a 6:2:2 ratio.

[0053] Step 2, the data input stage, involves inputting the data into the model. The input image data is processed by a dual-channel autoencoder and a Gaussian mixture model to obtain the detection results.

[0054] Step 2_1 employs a raw feature encoder, a graph encoder for related features, and a decoder for reconstructing the raw samples. The key network modules are a multilayer perceptron (MLP) and a GAT.

[0055] Step 2_2: Graphical encoder for relevant features, using GAT to capture the correlation features between samples.

[0056] Step 2_3 uses Softmax() in GAT to normalize the importance of each node.

[0057] Step 2_4 introduces feature fusion and decoder, and obtains fused features through FC layer.

[0058] Step 2_5: Construct an estimation network to estimate the probability distribution of the data.

[0059] Step 3: Formal model training phase. The formally trained model is as follows: Figure 2 As shown, the dataset is split into training, validation, and test sets in a 6:2:2 ratio. The specific steps are as follows:

[0060] Step 3_1: Input 20,000 data points of Arrhythmia and 5,000 data points of ECG5000 into the initialized model.

[0061] Step 3_2 involves multiple matrix multiplications in the dual-channel encoder layer to obtain multiple representation matrices.

[0062] Step 3_3 involves obtaining reconstructed features from the representation matrix through the decoder using the reconstruction error.

[0063] Step 3_4 involves concatenating the reconstructed features with the original features.

[0064] Step 3_5 involves feeding the concatenated final representation features into the estimation network.

[0065] Step 3_6 involves anomaly detection based on the anomalous energy of samples obtained by estimating the network distribution.

[0066] Step 3_7 outputs the detection results for each iteration. The current generation is updated by analyzing the error between the detection results and the actual results.

[0067] Step 3_8 involves iterative steps to obtain the optimized model.

[0068] The adaptive correlation-aware unsupervised deep learning anomaly detection method in this invention constructs a directed graph structure to represent the implicit correlation between data and uses dynamic graph adaptive updates. Then, a dual autoencoder is designed to extract the original irrelevant features, relevant features, and reconstructed features. An estimation network is constructed using a Gaussian mixture model (GMM) to estimate the probability distribution and anomaly energy, and anomaly analysis is completed, which has good performance.

[0069] The above description, in conjunction with the accompanying drawings, provides a detailed account of the embodiments of the present invention. The specific implementation methods described herein are merely illustrative of the invention. Those skilled in the art will recognize that variations and modifications can be made to the specific implementation methods and applications based on the principles of this invention; therefore, this document should not be construed as limiting the scope of the invention.

Claims

1. An adaptive correlation-aware unsupervised deep learning anomaly detection method, characterized in that The method comprises the following steps: Step 1: data preprocessing stage, in order to accurately analyze the correlation between complex CPS data, a directed graph structure is constructed to associate the samples in the feature space, and the dynamic graph is used for adaptive update, and the feature space is updated by continuously updating the dynamic graph; Step 2: data input stage, using the processed data as the input of the model, putting it into the autoencoder for reconstruction, splicing the representation features obtained by the double-channel encoder, and finally putting the spliced final representation into the estimation network, and performing anomaly detection through the Gaussian mixture model; Step 3: model formal training stage, the data set data is divided into training set, validation set and test set in the ratio of 6:2:2, the training data is used as the input of the model training, and the optimized model is obtained after the training of the model; The data preprocessing module in step 1, the specific steps are: Step 1_1 Construct a graph from KNN algorithm, construct an initial correlation directed graph G0, for each sample X i , select K0 nearest neighbors, NB i = {X ik |k= 1,2,…, K0}, adopt KNN algorithm, KNN(X, K g ), g = 0,1,2,…,for iteration times, then a straight edge from X ik points to X i , finally construct a directed graph G0; Step 1_2 A simple and efficient dynamic graph is designed based on G0, which adaptively updates the correlation between samples, and the key is to dynamically adjust K, according to K and the previous G s Get the latest G0: Graph error GE g is one of the loss functions of ACUDL, used as the objective function of adaptive correlation graph update: GE g =‖G g -G0‖2. 2.The self-adaptive correlation-aware unsupervised deep learning anomaly detection method of claim 1, wherein, The data input module in step 2, the specific steps are: Step 2_1 adopts an original feature encoder, a related feature graph encoder and a decoder for reconstructing the original sample, and the key network module is a multilayer perceptron MLP and a GAT, the original feature encoder: the MLP composed of fully connected FC layers is used for nonlinear original non-related feature extraction: wherein is the input data, W 0 and D 0 are the weight matrix and bias matrix, respectively, which are initialized by random parameters, denotes the number of layers of the network = X is the initial input value, and is the final output value after passing through several neural layers. Step 2_2 Graphical encoder of relevant features, uses GAT to capture relevant features between samples and implement shared attention a on each sample i,j : randomly initialized adaptively updated by continual training and used to represent the importance of nodes, wherein with are the coefficient vector and weight matrix of GAT, respectively, and are randomly initialized, and ACT() is required in all layers except the last one; Step 2_3 uses a Softmax function in GAT to normalize the importance of each node, and obtains related features through a weighted sum function: Finally, the representation matrix is obtained; Step 2_4 introduces feature fusion and decoder, and obtains fusion features through FC layer, and the formula is as follows: wherein denotes the element-wise addition operator, then the decoder reconstructs the initial data X from the reconstructed data X f , the reconstruction error RE and the reconstruction feature Z r , the MLP formula: , Wherein Cos() is the cosine distance function, and Euc() is the Euclidean distance function; Step 2_5 To estimate the data probability distribution, a gmm-based estimation network is constructed, which consists of multiple fc layers, Z r and Z f are merged as input, Z = [Z r , Z f ], which retains most of the data information, and obtains the mixture probability distribution coefficient matrix of the sample, which is estimated by MLP, and the ACT() of the last layer is Softmax(), where M is the number of mixture probability distributions, the mean vector of GMM is μ, and the covariance matrix is∑: , Finally, according to P, the higher the abnormal energy energy of the input sample, the greater the possibility of sample anomaly: 。 3.The self-adaptive correlation-aware unsupervised deep learning anomaly detection method of claim 1, wherein, The formal training module in step 3, the specific steps are: Step 3_1 inputs the training data into the initialized model; Step 3_2 obtains a plurality of representation matrices through multiple matrix multiplications in the double-channel encoder layer; Step 3_3 obtains reconstruction features through the reconstruction error of the representation matrix through the decoder; Step 3_4 splices the reconstruction features and the original features; Step 3_5 puts the spliced final representation features into the estimation network; Step 3_6 performs anomaly detection on the abnormal energy of the sample obtained through the estimation network distribution; Step 3_7 performs model optimization of each generation through the defined loss function; Step 3_8 obtains the optimized model through continuous iteration.

Images