Anomaly detection method and device, computer device, storage medium and program product

Abstract

The application relates to an anomaly detection method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: obtaining first time sequence data generated by a target device in a first running stage; training an initial anomaly recognition network based on the first time sequence data to obtain a target anomaly recognition network; obtaining second time sequence data generated by the target device in a second running stage; inputting the second time sequence data into the target anomaly recognition network, and determining whether the target device is abnormal according to the output of the target anomaly recognition network; wherein the first running stage is located before the second running stage, and the probability of the target device being abnormal in the first running stage is less than a first preset probability threshold. The method can reduce the cost of implementing the anomaly detection method.

Description

Technical Field

[0001] This application relates to the field of anomaly detection technology, and in particular to anomaly detection method, apparatus, computer equipment, storage medium and computer program product. Background Technology

[0002] Anomaly detection refers to the process of identifying abnormal events or behaviors from normal time series. It is one of the most mature applications of time series data analysis. Effective anomaly detection is widely used in many real-world fields, such as quantitative trading, cybersecurity detection, autonomous vehicles, and routine maintenance of large industrial equipment.

[0003] In related technologies, most of them use deep learning models based on neural networks to achieve the purpose of detecting device anomalies. This method requires the collection of a large amount of data in the early stage, including data on the device when it is working normally and data on the device when it is working abnormally. The deep learning model is trained based on the collected data.

[0004] However, since abnormal equipment conditions are relatively rare and abnormal data is relatively scarce, it is difficult to collect relevant abnormal data for this type of equipment in the early stages, which in turn makes training deep models more difficult and costly. Summary of the Invention

[0005] Therefore, it is necessary to provide an anomaly detection method, apparatus, computer equipment, computer-readable storage medium, and computer program product that can reduce implementation costs in response to the above-mentioned technical problems.

[0006] Firstly, this application provides an anomaly detection method. The method includes:

[0007] The process involves: acquiring first time-series data generated by the target device during a first operating phase; training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network; acquiring second time-series data generated by the target device during a second operating phase; inputting the second time-series data into the target anomaly detection network; and determining whether the target device has an anomaly based on the output of the target anomaly detection network. The first operating phase precedes the second operating phase, and the first operating phase is the phase where the probability of the target device having an anomaly is less than a first preset probability threshold.

[0008] This anomaly detection method is based on the prior knowledge that the probability of new equipment exhibiting abnormal states in the early stages after factory inspection is extremely low. It uses the first time-series data generated by the target equipment during the first operating phase as training data to train an initial anomaly recognition network. This allows the target anomaly recognition network to learn the characteristics of the target equipment's normal operating state. Then, during the second operating phase, the second time-series data is input into the target anomaly recognition network. The output of the target anomaly recognition network is used to determine whether the target equipment is in a normal operating state, thus achieving anomaly detection for the target equipment in the second operating phase. This avoids the problem that the difficulty of training the initial anomaly recognition network increases due to the difficulty of collecting data in the early stages, thereby reducing the cost of implementing the anomaly detection method.

[0009] In one embodiment, training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network includes: training the initial anomaly detection network based on the first time-series data with the training objective that the difference between the network input and the network output is less than a preset difference threshold, thereby obtaining the target anomaly detection network.

[0010] In the technical solution of this application embodiment, the training objective is to train an initial anomaly recognition network with the difference between the network input and the network output being less than a preset difference threshold. This can train a target anomaly recognition network that is more suitable for the target device, thereby effectively improving the accuracy of anomaly detection.

[0011] In one embodiment, determining whether the target device is abnormal based on the output of the target anomaly identification network includes: determining the target difference between the output of the target anomaly identification network and the second time-series data; and determining whether the target device is abnormal based on whether the target difference is greater than a preset difference threshold.

[0012] In the technical solution of this application embodiment, determining whether the target device is abnormal based on whether the target difference is greater than the preset difference threshold can effectively detect whether the target device is in normal working condition.

[0013] In one embodiment, the target anomaly detection network includes a cascaded encoder and decoder, the encoder including a plurality of one-dimensional convolutional layers, and the decoder including the plurality of one-dimensional deconvolutional layers, wherein the number of the one-dimensional convolutional layers is equal to the number of the one-dimensional deconvolutional layers.

[0014] In the technical solution of this application embodiment, the number of one-dimensional convolutional layers is equal to the number of one-dimensional deconvolutional layers, so that the target anomaly recognition network will return an output with the same shape as the input shape.

[0015] In one embodiment, the second operating phase includes a main operating phase and a terminal operating phase, wherein the main operating phase precedes the terminal operating phase, and the terminal operating phase is the phase in which the probability of the target device malfunctioning is greater than a second preset probability threshold. The method further includes: using the target second time-series data generated by the target device during the main operating phase to train the target anomaly recognition network.

[0016] In the technical solution of this application embodiment, the target anomaly identification network is trained using the target second time-series data generated by the target device during the main operation phase of the device. This enables the target anomaly identification network to adapt to the offset of the second time-series data and learn the working state of the target device after wear and tear, thereby achieving the purpose of updating the target anomaly identification network and improving the accuracy of anomaly detection.

[0017] In one embodiment, the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0018] In the technical solution of this application embodiment, the gradient of weight parameter update when training the target anomaly identification network using the second time series data of the target is less than the gradient of weight parameter update when training the initial anomaly identification network using the first time series data. This setting method can offset the time series data offset caused by the wear and tear of industrial equipment or long-term changes such as seasons through the slow update of the target anomaly identification network.

[0019] In one embodiment, inputting the second time-series data into the target anomaly identification network includes: segmenting the second time-series data and performing data preprocessing; and inputting the preprocessed second time-series data into the target anomaly identification network.

[0020] In the technical solution of this application embodiment, inputting the second time-series data after data preprocessing into the target anomaly identification network can improve data quality and facilitate the target anomaly identification network to detect it.

[0021] Secondly, this application also provides an anomaly detection device. The device includes:

[0022] The first acquisition module is used to acquire the first time-series data generated by the target device in the first operating phase.

[0023] The training module is used to train the initial anomaly detection network based on the first time series data to obtain the target anomaly detection network;

[0024] The second acquisition module is used to acquire the second time-series data generated by the target device in the second operation phase;

[0025] The detection module is used to input the second time-series data into the target anomaly detection network and determine whether the target device has an anomaly based on the output of the target anomaly detection network.

[0026] The first operating phase occurs before the second operating phase, and the first operating phase is the phase in which the probability of the target device malfunctioning is less than a first preset probability threshold.

[0027] In one embodiment, the training module is specifically used to: train the initial anomaly recognition network based on the first time series data with the training objective being that the difference between the network input and the network output is less than a preset difference threshold, thereby obtaining the target anomaly recognition network.

[0028] In one embodiment, the detection module is specifically configured to: determine the target difference between the output of the target anomaly identification network and the second time-series data; and determine whether the target device has an anomaly based on whether the target difference is greater than a preset difference threshold.

[0029] In one embodiment, the target anomaly detection network includes a cascaded encoder and decoder, the encoder including a plurality of one-dimensional convolutional layers, and the decoder including the plurality of one-dimensional deconvolutional layers, wherein the number of the one-dimensional convolutional layers is equal to the number of the one-dimensional deconvolutional layers.

[0030] In one embodiment, the anomaly detection device further includes an update module. The second operating phase includes a main operating phase and a terminal operating phase, wherein the main operating phase precedes the terminal operating phase, and the terminal operating phase is the phase in which the probability of the target device exhibiting an anomaly is greater than a second preset probability threshold. The update module is used to: train the target anomaly recognition network using the second time-series data of the target device generated during the main operating phase.

[0031] In one embodiment, the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0032] In one embodiment, the anomaly detection device further includes a processing module, which is configured to: segment and preprocess the second time-series data; and input the preprocessed second time-series data into the target anomaly identification network.

[0033] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform any of the steps described in the first aspect above.

[0034] Fourthly, this application also provides a computer-readable storage medium. This computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs any of the steps described in the first aspect above.

[0035] Fifthly, this application also provides a computer program product. This computer program product includes a computer program that, when executed by a processor, implements any of the steps described in the first aspect above.

[0036] The above-mentioned anomaly detection method, apparatus, computer equipment, storage medium, and computer program product include the following steps: acquiring first time-series data generated by a target device in a first operating phase; training an initial anomaly recognition network based on the first time-series data to obtain a target anomaly recognition network; acquiring second time-series data generated by the target device in a second operating phase; inputting the second time-series data into the target anomaly recognition network; and determining whether the target device has an anomaly based on the output of the target anomaly recognition network; wherein the first operating phase is prior to the second operating phase, and the first operating phase is a phase in which the probability of the target device having an anomaly is less than a first preset probability threshold. The anomaly detection method provided in this application is based on the prior knowledge that the probability of new equipment exhibiting abnormal states in the early stages after factory inspection is extremely low. It uses the first time-series data generated by the target equipment during the first operating phase as training data to train an initial anomaly recognition network, enabling the network to learn the characteristics of the target equipment's normal operating state. Then, during the second operating phase, the second time-series data is input into the target anomaly recognition network, and the output of the network determines whether the target equipment is in a normal operating state. This achieves anomaly detection for the target equipment during the second operating phase. This avoids the problem that the difficulty of training the initial anomaly recognition network increases due to the difficulty of collecting data in the early stages, thereby reducing the cost of implementing the anomaly detection method. Attached Figure Description

[0037] Figure 1 This is a flowchart illustrating an anomaly detection method in one embodiment;

[0038] Figure 2 This is a schematic diagram of the target anomaly detection network in one embodiment;

[0039] Figure 3 This is a schematic diagram of the target recognition network encoding and decoding process in one embodiment;

[0040] Figure 4 This is a flowchart illustrating an anomaly detection method in another embodiment;

[0041] Figure 5 This is a flowchart illustrating an anomaly detection method in another embodiment;

[0042] Figure 6 This is a flowchart illustrating an anomaly detection method in another embodiment;

[0043] Figure 7 This is a structural block diagram of an anomaly detection device in one embodiment;

[0044] Figure 8 This is a structural block diagram of the anomaly detection device in another embodiment;

[0045] Figure 9 This is a schematic diagram illustrating the principle of an anomaly detection method in one embodiment;

[0046] Figure 10 This is an internal structural diagram of a computer device in one embodiment;

[0047] Figure 11 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0048] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0049] Anomaly detection refers to the process of identifying abnormal events or behaviors from normal time series. It is one of the most mature applications of time series data analysis. Effective anomaly detection is widely used in many real-world fields, such as quantitative trading, cybersecurity detection, autonomous vehicles, and routine maintenance of large industrial equipment.

[0050] In related technologies, most of them use deep learning models based on neural networks to achieve the purpose of detecting device anomalies. This method requires the collection of a large amount of data in the early stage, including data on the device when it is working normally and data on the device when it is working abnormally. Based on this data, a deep learning model is trained. However, since abnormal device states are relatively rare and abnormal data is relatively scarce, it is difficult to collect relevant abnormal data of this type of device in the early stage, which in turn makes it difficult to train a deep model and results in high implementation costs.

[0051] The anomaly detection method provided in this application is based on the prior knowledge that the probability of new equipment exhibiting abnormal states in the early stages after factory inspection is extremely low. It uses the first time-series data generated by the target equipment during the first operating phase as training data to train an initial anomaly recognition network, enabling the network to learn the characteristics of the target equipment's normal operating state. Then, during the second operating phase, the second time-series data is input into the target anomaly recognition network, and the output of the network determines whether the target equipment is in a normal operating state. This achieves anomaly detection for the target equipment during the second operating phase. This avoids the problem that the difficulty of training the initial anomaly recognition network increases due to the difficulty of collecting data in the early stages, thereby reducing the cost of implementing the anomaly detection method.

[0052] The anomaly detection method provided in this application can be executed by a computer device, which can be a server or a terminal.

[0053] In one embodiment, such as Figure 1 As shown, an anomaly detection method is provided, including the following steps:

[0054] Step 101: Obtain the first timing data generated by the target device during the first operating phase.

[0055] The target device refers to the object of anomaly detection, which can be industrial equipment in a factory.

[0056] The first operating phase is the phase where the probability of the target equipment malfunctioning is less than a first preset probability threshold. Optionally, the first operating phase can be the phase when the target equipment has just been put into use after undergoing factory inspection and has begun operation. The first preset probability threshold can be used to determine the magnitude of the probability of the target equipment malfunctioning.

[0057] Time series data, also known as time sequence data, can be a data series recorded in chronological order by a unified indicator. This time series data can be a certain physical signal recorded by different sensors within a certain period of time, such as voltage, audio, vibration, current, and temperature.

[0058] The first time-series data can be the time-series data generated by the target device during the first operating phase, collected by the sensor.

[0059] In one possible implementation, if the first time-series data is temperature data, then the first time-series data may be collected by a temperature sensor when the target device is in its first operating phase.

[0060] In another possible implementation, if the first timing data is audio data, then the first timing data may be collected by an audio sensor when the target device is in the first operating phase.

[0061] In an optional embodiment, the first time-series data will be fragmented and preprocessed before subsequent processing.

[0062] In this context, "slicing" refers to the decomposition of the first time-series data.

[0063] This data preprocessing refers to some processing performed on the data before the main processing, optionally such as downsampling and feature extraction of the first time series data.

[0064] Optionally, the data preprocessing can employ a downsampling algorithm to preprocess the second time-series data.

[0065] Optionally, the data preprocessing may also employ a feature extraction algorithm to extract features from the first time-series data. Optionally, the feature extraction algorithm may include principal component analysis (PCA) and linear discriminant analysis (LDA).

[0066] Step 102: Train the initial anomaly recognition network based on the first time series data to obtain the target anomaly recognition network.

[0067] The initial anomaly detection network can be an untrained autoencoder network in its initial state, while the target anomaly detection network can be a trained autoencoder network.

[0068] In an optional embodiment, such as Figure 2 and Figure 3 As shown, the target anomaly detection network includes a cascaded encoder and decoder. The encoder includes multiple one-dimensional convolutional layers, and the decoder includes multiple one-dimensional deconvolutional layers. The number of one-dimensional convolutional layers is equal to the number of one-dimensional deconvolutional layers. This configuration allows the target anomaly detection network to return an output with the same shape as the input shape.

[0069] The target anomaly detection network includes an activation function, which can optionally be a ReLU function.

[0070] In an optional embodiment, training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network includes: training the initial anomaly detection network based on the first time-series data with the training objective that the difference between the network input and the network output is less than a preset difference threshold, thereby obtaining the target anomaly detection network.

[0071] The difference between the network's input and output can be determined by a loss function, which can optionally be the MAE function.

[0072] This preset difference threshold can be set in advance by technicians and can be used to determine whether the target device is in normal working condition.

[0073] In one possible implementation, if the difference between the first time-series data input into the initial anomaly detection network and the output of the initial anomaly detection network is greater than the preset difference threshold, the structure of the initial anomaly detection network can be adjusted by an algorithm. Optionally, the adjustment process can be adjusting the weights.

[0074] Based on the prior knowledge that the probability of new equipment exhibiting abnormal states in the early stages after factory inspection is extremely low, and considering that the first time-series data is acquired by sensors when the target equipment is in its first operating phase, the initial anomaly detection network is trained using this first time-series data. This can be understood as the first time-series data being the time-series data generated when the target equipment is in normal operating condition. By inputting this first time-series data into the initial anomaly detection network, the network adjusts itself based on the difference between the first time-series data input into the network and the network's output. This process can be understood as the initial anomaly detection network learning the normal operating condition of the target equipment, i.e., training the initial anomaly detection network. This process continues until the first operating phase ends, completing the training of the initial anomaly detection network and yielding the target anomaly detection network.

[0075] As mentioned above, by acquiring the first time-series data generated by the target device in the first operating phase, and training the initial anomaly recognition network based on the first time-series data, the target anomaly recognition network is obtained. This process is only used to train the initial anomaly recognition network and does not perform detection processing on the first time-series data, i.e., to determine whether the target device is in normal working condition.

[0076] Step 103: Obtain the second timing data generated by the target device during the second operation phase.

[0077] The second operation phase follows the first operation phase and is the main phase for detecting anomalies in the target equipment.

[0078] The second time-series data can be the time-series data generated by the target device during the second operating phase, collected by the sensor.

[0079] In an optional embodiment, the second operating phase may include a primary operating phase and a late-life operating phase.

[0080] The main operating phase refers to the phase in which the target equipment is mainly working and operating. In the end-of-life operating phase, the probability of the target equipment malfunctioning is greater than the first preset probability threshold. Optionally, the end-of-life operating phase refers to the phase in which the target equipment is no longer suitable for use technically or economically and is about to be taken out of use.

[0081] Step 104: Input the second time series data into the target anomaly identification network, and determine whether the target device has an anomaly based on the output of the target anomaly identification network.

[0082] Whether the target device is abnormal can be determined based on the difference between the output of the target anomaly identification network and the second time-series data input to the target identification network. If the difference is large, the target device can be considered to be abnormal; if the difference is small, the target device can be considered not to be abnormal.

[0083] The above-mentioned anomaly detection method includes: acquiring first time-series data generated by the target device in a first operating phase; training an initial anomaly recognition network based on the first time-series data to obtain a target anomaly recognition network; acquiring second time-series data generated by the target device in a second operating phase; inputting the second time-series data into the target anomaly recognition network; and determining whether the target device has an anomaly based on the output of the target anomaly recognition network; wherein the first operating phase is located before the second operating phase, and the first operating phase is a phase in which the probability of the target device having an anomaly is less than a first preset probability threshold. This anomaly detection method is based on the prior knowledge that the probability of new equipment exhibiting abnormal states in the early stages after factory inspection is extremely low. It uses the first time-series data generated by the target equipment during the first operating phase as training data to train an initial anomaly recognition network. This allows the target anomaly recognition network to learn the characteristics of the target equipment's normal operating state. Then, during the second operating phase, the second time-series data is input into the target anomaly recognition network. The output of the target anomaly recognition network is used to determine whether the target equipment is in a normal operating state, thus achieving anomaly detection for the target equipment in the second operating phase. This avoids the problem that the difficulty of training the initial anomaly recognition network increases due to the difficulty of collecting data in the early stages, thereby reducing the cost of implementing the anomaly detection method.

[0084] In one embodiment, such as Figure 4 As shown, the determination of whether the target device is abnormal based on the output of the target anomaly detection network includes:

[0085] Step 401: Determine the target difference between the output of the target anomaly identification network and the second time series data.

[0086] In an optional embodiment of this application, the second time-series data can be input into the target anomaly identification network, and the target anomaly identification network will generate a corresponding output based on the second time-series data. There is a target difference between the input and output, and the target difference can also be determined by a loss function. Optionally, the loss function can be the MAE function.

[0087] Step 402: Determine whether the target device is abnormal based on whether the target difference is greater than the preset difference threshold.

[0088] In one possible implementation, if the target difference is less than or equal to the preset threshold, it indicates that the target device is in normal working condition.

[0089] In another possible implementation, if the target difference is greater than the preset threshold, it indicates that the target device is in an abnormal state and is in an abnormal working condition.

[0090] In an optional embodiment, if the above-mentioned abnormal situation occurs multiple times and consecutively, the abnormal status alarm module of the target device will be triggered. The abnormal status alarm module of the target device can notify the upper-level server through network communication and trigger the alarm light set on the target device to flash so as to inform the user.

[0091] In one possible implementation, if the number of consecutive abnormal situations is less than a preset number, the abnormal situation will be determined to be invalid. The abnormal situation may be caused by the offset of time-series data, and the abnormal state alarm module will not be triggered.

[0092] The method described above, which inputs the second time-series data into the target anomaly detection network and determines whether the target device is abnormal based on the output of the target anomaly identification network, can detect anomalies in target devices that are in operation, detect whether they are in an abnormal working state, and notify the user through the anomaly alarm module after an anomaly is detected, so that the user can repair the target device in a timely manner to avoid accidents.

[0093] In an optional embodiment, the target anomaly identification network can also be trained using the second time-series data of the target device generated during the main operation phase of the device.

[0094] In practical applications, time-series data may shift during the main operating phase of the equipment. For example, the target equipment may experience wear and tear due to long-term operation during the main operating phase, which could lead to time-series data shift. Another example is that the time-series data shift could be caused by long-term periodic variations such as seasonal changes.

[0095] As mentioned above, since the timing data of the equipment may be offset during the main operation phase, it is necessary not only to detect anomalies in the target equipment during the main operation phase, but also to train the target anomaly recognition network using the target's second timing data. This allows the target anomaly recognition network to adapt to the offset of timing data during the main operation phase of the equipment, learn the working state of the target equipment after wear and tear or changes in working state caused by long-term changes such as seasonality, and achieve the purpose of updating the target anomaly recognition network, thereby improving the accuracy of anomaly detection.

[0096] In one embodiment, the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0097] In one possible implementation, the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is one-hundredth of the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data. This setting method can offset the time-series data offset caused by wear and tear of industrial equipment or long-term changes such as seasonality through the slow update of the target anomaly detection network.

[0098] In an optional embodiment, anomaly detection and network training are performed alternately while the target device is in its main operational phase.

[0099] In one possible implementation, the same target device can be subjected to anomaly detection by two execution entities. During the main operation phase, while one execution entity is training the target anomaly recognition network using the target's second time-series data, the other execution entity can continue anomaly detection. Furthermore, the target recognition networks of the two execution entities can be updated synchronously through a communication connection. This avoids the situation where, due to the presence of only one execution entity, anomaly detection cannot be performed while the execution entity is training the target anomaly recognition network using the target's second time-series data, which could lead to an accident caused by abnormal operation of the target device.

[0100] In addition, in an optional embodiment of this application, when the target device is in the end-of-life operation stage, the second time series data collected at the end of the life will only be used for anomaly detection and will not be used to train the target anomaly recognition network. This is mainly because the probability of anomalies occurring in the target device in the end-of-life operation stage may be relatively high. If the second time series data in the end-of-life operation stage is used to train the target anomaly recognition network, the accuracy of anomaly detection will be reduced.

[0101] In one embodiment, such as Figure 5As shown, the second time-series data is input into the target anomaly detection network, including:

[0102] Step 501: Segment and preprocess the second time series data.

[0103] In this context, "slicing" refers to the decomposition of the second time-series data.

[0104] This data preprocessing refers to some processing performed on the data before the main processing, optionally, such as downsampling and feature extraction of the second time series data.

[0105] Optionally, the data preprocessing can employ a downsampling algorithm to preprocess the second time-series data.

[0106] Optionally, the data preprocessing may also employ a feature extraction algorithm to extract features from the second time-series data. Optionally, the feature extraction algorithm may include principal component analysis (PCA) and linear discriminant analysis (LDA).

[0107] Step 502: Input the second time-series data after data preprocessing into the target anomaly identification network.

[0108] If the second time series data is collected during the end-of-life operation of the target device, the second time series data is preprocessed and then input into the target anomaly identification network, which will perform anomaly detection on the preprocessed second time series data.

[0109] If the second time-series data is collected during the main operating phase of the target device, it is preprocessed before being input into the target anomaly detection network. In one possible implementation, the target anomaly detection network performs anomaly detection on the preprocessed second time-series data. In another possible implementation, the preprocessed second time-series data is simultaneously used to train the target anomaly detection network, thereby updating the network.

[0110] The above-mentioned preprocessing of the second time series data before inputting it into the target anomaly detection network can improve the data quality and facilitate the target anomaly detection network to detect it.

[0111] like Figure 6 As shown in the embodiment of this application, an anomaly detection method is provided, the method comprising:

[0112] Step 601: Obtain the first timing data generated by the target device in the first operating phase.

[0113] Step 602: Using the difference between the network input and the network output being less than a preset difference threshold as the training objective, train the initial anomaly recognition network based on the first time series data to obtain the target anomaly recognition network.

[0114] The target anomaly detection network includes a cascaded encoder and decoder. The encoder includes multiple one-dimensional convolutional layers, and the decoder includes multiple one-dimensional deconvolutional layers, wherein the number of one-dimensional convolutional layers is equal to the number of one-dimensional deconvolutional layers.

[0115] Step 603: Obtain the second timing data generated by the target device during the second operation phase.

[0116] Step 604: Segment and preprocess the second time series data.

[0117] Step 605: Input the second time series data into the target anomaly identification network, and determine whether the target device has an anomaly based on the output of the target anomaly identification network.

[0118] The first operating phase occurs before the second operating phase, and the first operating phase is the phase in which the probability of the target device malfunctioning is less than a first preset probability threshold.

[0119] Step 606: Use the second time-series data of the target generated by the target device during the main operation phase of the device to train the target anomaly identification network.

[0120] Specifically, the gradient of weight parameter update when training the target anomaly detection network using the second time series data of the target is less than the gradient of weight parameter update when training the initial anomaly detection network using the first time series data.

[0121] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0122] In one embodiment, such as Figure 7As shown, an anomaly detection device 700 is provided, including: a first acquisition module 701, a training module 702, a second acquisition module 703, and a detection module 704, wherein:

[0123] The first acquisition module 701 is used to acquire the first timing data generated by the target device in the first operation phase.

[0124] Training module 702 is used to train an initial anomaly recognition network based on the first time series data to obtain a target anomaly recognition network.

[0125] The second acquisition module 703 is used to acquire the second timing data generated by the target device during the second operation phase.

[0126] The detection module 704 is used to input the second time-series data into the target anomaly identification network and determine whether the target device has an anomaly based on the output of the target anomaly identification network. The first operating phase occurs before the second operating phase, and the first operating phase is the phase where the probability of the target device having an anomaly is less than a first preset probability threshold.

[0127] In one embodiment, the training module 702 is specifically used to: train the initial anomaly recognition network based on the first time series data with the training objective that the difference between the network input and the network output is less than a preset difference threshold, thereby obtaining the target anomaly recognition network.

[0128] In one embodiment, the detection module 704 is specifically used to: determine the target difference between the output of the target anomaly identification network and the second time-series data; and determine whether the target device has an anomaly based on whether the target difference is greater than the preset difference threshold.

[0129] In one embodiment, the target anomaly detection network includes a cascaded encoder and decoder, the encoder including a plurality of one-dimensional convolutional layers, and the decoder including the plurality of one-dimensional deconvolutional layers, wherein the number of the one-dimensional convolutional layers is equal to the number of the one-dimensional deconvolutional layers.

[0130] In one embodiment, such as Figure 8 As shown, another anomaly detection device 800 is provided, which, in addition to the modules included in the anomaly detection device 700, also includes an update module 705 and a processing module 706.

[0131] In one embodiment, the second operating phase includes a main operating phase and a terminal operating phase, wherein the main operating phase precedes the terminal operating phase, and the terminal operating phase is the phase in which the probability of the target device exhibiting an anomaly is greater than a second preset probability threshold. The update module 705 is used to: train the target anomaly recognition network using the target second time-series data generated by the target device during the main operating phase.

[0132] In one embodiment, the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0133] In one embodiment, the processing module 706 is configured to: segment and preprocess the second time-series data; and input the preprocessed second time-series data into the target anomaly identification network.

[0134] To facilitate readers' better understanding of the technical solutions provided in the embodiments of this application, the following will be combined with... Figure 9 The following explanation uses the program and related hardware deployed on the edge gateway as an example.

[0135] In this embodiment, the target device is in its main operating phase, and the time-series data is audio. The data preprocessing algorithm uses downsampling and short-time average amplitude feature extraction algorithms. The data acquisition module first collects audio data from the industrial equipment through the time-series data sensor on the edge gateway and performs data preprocessing. The preprocessed data can be input into the data storage module in the self-trainer module. The oldest data in the data storage module will be processed, and the latest data will be stored. The model training module in the self-trainer model will use the data in the data storage module to train the model, so that the model is continuously updated. The updated model is synchronously transmitted to the model inference module. Alternatively, the preprocessed data can be input into the abnormal state detection module, and the model inference module will infer whether it is in an abnormal state. If an abnormality occurs, it can be sent to the abnormal state alarm module through the abnormal recording tool. The abnormal alarm module can notify the upper-level server through network communication, i.e., network upload, and can also control the indicator lights on the device to flash or the alarm to sound to notify the user, i.e., sound and light signals. It should be noted that in this embodiment, the model training module updates the model and the abnormal state detection module detects whether the device is abnormal, which are performed alternately. The preprocessed data can only enter the self-trainer module or the abnormal state detection module.

[0136] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 10 As shown, this computer device includes a processor, memory, input / output interfaces (I / O), and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs stored in the non-volatile storage media. The database stores data. The I / O interfaces are used for exchanging information between the processor and external devices. The communication interface is used for communicating with external terminals via a network connection. When executed by the processor, the computer program implements an anomaly detection method.

[0137] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 11 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When executed by the processor, the computer program implements an anomaly detection method. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0138] Those skilled in the art will understand that Figure 10 as well as Figure 11The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0139] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0140] The process involves: acquiring first time-series data generated by the target device during a first operating phase; training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network; acquiring second time-series data generated by the target device during a second operating phase; inputting the second time-series data into the target anomaly detection network; and determining whether the target device has an anomaly based on the output of the target anomaly detection network. The first operating phase precedes the second operating phase, and the first operating phase is the phase where the probability of the target device having an anomaly is less than a first preset probability threshold.

[0141] In one embodiment, an initial anomaly detection network is trained based on the first time-series data to obtain a target anomaly detection network. When the processor executes the computer program, it further implements the following steps: with the difference between the network input and the network output being less than a preset difference threshold as the training target, the initial anomaly detection network is trained based on the first time-series data to obtain the target anomaly detection network.

[0142] In one embodiment, the processor determines whether the target device is abnormal based on the output of the target anomaly identification network. When executing the computer program, the processor further performs the following steps: determining the target difference between the output of the target anomaly identification network and the second time-series data; and determining whether the target device is abnormal based on whether the target difference is greater than a preset difference threshold.

[0143] In one embodiment, the target anomaly detection network includes a cascaded encoder and decoder, the encoder including a plurality of one-dimensional convolutional layers, and the decoder including the plurality of one-dimensional deconvolutional layers, wherein the number of the one-dimensional convolutional layers is equal to the number of the one-dimensional deconvolutional layers.

[0144] In one embodiment, the second operating phase includes a main operating phase and a terminal operating phase, wherein the main operating phase precedes the terminal operating phase, and the terminal operating phase is the phase in which the probability of the target device malfunctioning is greater than a second preset probability threshold. When the processor executes the computer program, it also implements the following steps: using the target second time-series data generated by the target device in the main operating phase to train the target anomaly recognition network.

[0145] In one embodiment, when the processor executes the computer program, it further implements the following steps: the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0146] In one embodiment, when the second time-series data is input into the target anomaly identification network, the processor, when executing the computer program, further implements the following steps: fragmenting and preprocessing the second time-series data; and inputting the preprocessed second time-series data into the target anomaly identification network.

[0147] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0148] The process involves: acquiring first time-series data generated by the target device during a first operating phase; training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network; acquiring second time-series data generated by the target device during a second operating phase; inputting the second time-series data into the target anomaly detection network; and determining whether the target device has an anomaly based on the output of the target anomaly detection network. The first operating phase precedes the second operating phase, and the first operating phase is the phase where the probability of the target device having an anomaly is less than a first preset probability threshold.

[0149] In one embodiment, an initial anomaly detection network is trained based on the first time-series data to obtain a target anomaly detection network. When the computer program is executed by the processor, the following steps are also performed: with the difference between the network input and the network output being less than a preset difference threshold as the training target, the initial anomaly detection network is trained based on the first time-series data to obtain the target anomaly detection network.

[0150] In one embodiment, the computer program, when executed by the processor, further implements the following steps: determining the target difference between the output of the target anomaly identification network and the second time-series data; and determining whether the target device is abnormal based on whether the target difference is greater than a preset difference threshold.

[0151] In one embodiment, the target anomaly detection network includes a cascaded encoder and decoder, the encoder including a plurality of one-dimensional convolutional layers, and the decoder including the plurality of one-dimensional deconvolutional layers, wherein the number of the one-dimensional convolutional layers is equal to the number of the one-dimensional deconvolutional layers.

[0152] In one embodiment, the second operating phase includes a main operating phase and a terminal operating phase, wherein the main operating phase precedes the terminal operating phase, and the terminal operating phase is the phase in which the probability of the target device malfunctioning is greater than a second preset probability threshold. When the computer program is executed by the processor, it further implements the following steps: using the target second time-series data generated by the target device during the main operating phase to train the target anomaly recognition network.

[0153] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0154] In one embodiment, when the second time-series data is input into the target anomaly identification network, the computer program, when executed by the processor, further implements the following steps: fragmenting and preprocessing the second time-series data; and inputting the preprocessed second time-series data into the target anomaly identification network.

[0155] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, performs the following steps:

[0156] The process involves: acquiring first time-series data generated by the target device during a first operating phase; training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network; acquiring second time-series data generated by the target device during a second operating phase; inputting the second time-series data into the target anomaly detection network; and determining whether the target device has an anomaly based on the output of the target anomaly detection network. The first operating phase precedes the second operating phase, and the first operating phase is the phase where the probability of the target device having an anomaly is less than a first preset probability threshold.

[0157] In one embodiment, an initial anomaly detection network is trained based on the first time-series data to obtain a target anomaly detection network. When the computer program is executed by the processor, the following steps are also performed: with the difference between the network input and the network output being less than a preset difference threshold as the training target, the initial anomaly detection network is trained based on the first time-series data to obtain the target anomaly detection network.

[0158] In one embodiment, the computer program, when executed by the processor, further implements the following steps: determining the target difference between the output of the target anomaly identification network and the second time-series data; and determining whether the target device is abnormal based on whether the target difference is greater than a preset difference threshold.

[0159] In one embodiment, the target anomaly detection network includes a cascaded encoder and decoder, the encoder including a plurality of one-dimensional convolutional layers, and the decoder including the plurality of one-dimensional deconvolutional layers, wherein the number of the one-dimensional convolutional layers is equal to the number of the one-dimensional deconvolutional layers.

[0160] In one embodiment, the second operating phase includes a main operating phase and a terminal operating phase, wherein the main operating phase precedes the terminal operating phase, and the terminal operating phase is the phase in which the probability of the target device malfunctioning is greater than a second preset probability threshold. When the computer program is executed by the processor, it further implements the following steps: using the target second time-series data generated by the target device during the main operating phase to train the target anomaly recognition network.

[0161] In one embodiment, when the computer program is executed by the processor, it further implements the following steps: the gradient of the weight parameters when training the target anomaly detection network using the second time-series data of the target is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

[0162] In one embodiment, when the second time-series data is input into the target anomaly identification network, the computer program, when executed by the processor, further performs the following steps: fragmenting and preprocessing the second time-series data; and inputting the preprocessed second time-series data into the target anomaly identification network.

[0163] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0164] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0165] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0166] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. An anomaly detection method, characterized in that, The method includes: Acquire the first time-series data generated by the target device in the first operating phase, where the first operating phase is the phase in which the target device begins operation immediately after being put into use following factory inspection. The initial anomaly detection network is trained based on the first time series data to obtain the target anomaly detection network; Acquire second time-series data generated by the target device in the second operating phase, wherein the first operating phase is prior to the second operating phase, and the second operating phase includes a main operating phase and a terminal operating phase; wherein the main operating phase is prior to the terminal operating phase; the terminal operating phase is a phase in which the probability of the target device malfunctioning is greater than a second preset probability threshold, and the first operating phase is a phase in which the probability of the target device malfunctioning is less than a first preset probability threshold; The second time-series data is input into the target anomaly detection network, and the output of the target anomaly detection network is used to determine whether the target device has an anomaly. The method further includes: training the target anomaly detection network using the target second time-series data generated by the target device during the main operation phase of the device; wherein the gradient of the weight parameters when training the target anomaly detection network using the target second time-series data is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

2. The method according to claim 1, characterized in that, The step of training an initial anomaly detection network based on the first time-series data to obtain a target anomaly detection network includes: The initial anomaly recognition network is trained based on the first time series data with the training objective being that the difference between the network input and the network output is less than a preset difference threshold, thereby obtaining the target anomaly recognition network.

3. The method according to claim 2, characterized in that, The step of determining whether the target device is abnormal based on the output of the target anomaly identification network includes: Determine the target difference between the output of the target anomaly identification network and the second time-series data; Whether the target device is abnormal is determined based on whether the target difference is greater than the preset difference threshold.

4. The method according to any one of claims 1 to 3, characterized in that, The target anomaly detection network includes a cascaded encoder and decoder. The encoder includes multiple one-dimensional convolutional layers, and the decoder includes multiple one-dimensional deconvolutional layers, wherein the number of one-dimensional convolutional layers is equal to the number of one-dimensional deconvolutional layers.

5. The method according to any one of claims 1 to 3, characterized in that, The step of inputting the second time-series data into the target anomaly detection network includes: The second time-series data is segmented and preprocessed. The second time-series data after data preprocessing is input into the target anomaly identification network.

6. The method according to claim 5, characterized in that, The method further includes: If the second time series data was collected when the target device was in the late stage of its lifespan, then the second time series data after data preprocessing is input into the target anomaly identification network so that the target anomaly identification network can perform anomaly detection on the second time series data after data preprocessing. If the second time-series data was collected when the target device is in the main operating phase of the device, then the second time-series data after data preprocessing is input into the target anomaly identification network, so that the target anomaly identification network can perform anomaly detection on the second time-series data after data preprocessing, and perform network training based on the second time-series data after data preprocessing.

7. An anomaly detection device, characterized in that, The device includes: The first acquisition module is used to acquire the first time-series data generated by the target device in the first operating phase, which is the phase when the target device has just been put into use after the factory inspection and has started operating. The training module is used to train an initial anomaly recognition network based on the first time-series data to obtain a target anomaly recognition network; The second acquisition module is used to acquire second time-series data generated by the target device in the second operating phase. The first operating phase is located before the second operating phase. The second operating phase includes a main operating phase and a device end-of-life operating phase. The main operating phase is located before the device end-of-life operating phase. The device end-of-life operating phase is the phase in which the probability of the target device malfunctioning is greater than a second preset probability threshold, and the first operating phase is the phase in which the probability of the target device malfunctioning is less than a first preset probability threshold. The detection module is used to input the second time-series data into the target anomaly identification network, and determine whether the target device has an anomaly based on the output of the target anomaly identification network; An update module is used to train the target anomaly detection network using the target second time-series data generated by the target device during the main operation phase of the device; wherein the gradient of the weight parameters when training the target anomaly detection network using the target second time-series data is less than the gradient of the weight parameters when training the initial anomaly detection network using the first time-series data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images