An Online Detection Method for Time Series Anomaly Data Based on Perceptual Grouping

Abstract

This invention discloses an online anomaly detection method for time series data based on sensor grouping, comprising: sensor nodes collecting current time series data; uploading the current time series to a cloud server, so that the cloud server generates a correlation coefficient map of the wireless sensor network based on the correlation coefficients between the sensor nodes, and groups multiple sensor nodes based on the correlation coefficient map, and sends the grouping results to the wireless sensor network; using a pre-trained Bayesian network model to perform anomaly screening on its own current time series to obtain a primary detection result; for each grouped node set, performing anomaly screening on its own current time series according to a first preset threshold corresponding to its own node set to obtain a secondary detection result; and determining the detection result of the current time series of each sensor node. This invention can reduce the communication complexity in wireless sensor networks, reduce energy consumption, and improve the accuracy of anomaly detection.

Description

Technical Field

[0001] This invention belongs to the field of wireless sensor network technology, specifically relating to an online detection method for time-series abnormal data based on sensing groups. Background Technology

[0002] Wireless sensor networks (WSNs) are networks formed by sensors autonomously distributed in a specific space. With the rapid development of smart cities, automated factories, and smart healthcare, WSNs have become an important method of information acquisition. A WSN consists of a large number of nodes distributed within a geographical area. Each node is connected to one or more sensors, and each node comprises multiple components such as a microcontroller, electronic circuitry, a radio transceiver, and a power source.

[0003] While cryptography, secure routing, and other technologies have improved the security of sensor networks, wireless sensor networks still suffer from limited node resources and vulnerability to attacks. Currently, there is no effective method to detect data anomalies in sensor networks, making it difficult to guarantee the reliability of sensor network data. Therefore, how to efficiently and accurately utilize data for anomaly detection is a hot topic in the field of sensor network security.

[0004] Typically, when a node's measurement data deviates significantly from normal sensing data, it is considered outlier data, also known as anomaly. Sources of outliers include noise caused by sensor device malfunctions, sudden natural events in the deployment environment, and malicious data attacks targeting the network. Based on different mechanisms and manifestations of time series data, anomalies are generally classified into three types: point anomalies, pattern anomalies, and sequence anomalies. Compared to pattern and sequence anomalies, point anomalies better reflect the quality of data and the security status of wireless sensor networks within a certain time period, and are therefore more valuable for research. Thus, anomaly detection in wireless sensor networks primarily focuses on point anomalies.

[0005] Currently, those skilled in the art have analyzed and researched anomaly detection in wireless sensor networks from five aspects: statistical, distance-based, density-based, clustering-based, and machine learning-based. Statistical anomaly detection methods effectively detect anomalies in low-dimensional data by judging whether the difference between the data and the statistical distribution exceeds a specific value or range of anomalies; however, this method is not suitable for multi-dimensional data. Distance-based anomaly detection methods detect anomalies by calculating the distance difference between data in the space and its neighboring data; however, for multivariate data, calculating the distance between samples is too costly. Density-based anomaly detection methods detect anomalies by comparing the density of an object with its neighborhood. This method introduces the LOF (Local Outlier Factor), where a higher LOF value indicates a greater likelihood of anomalies; however, this method has high time complexity and is sensitive to the LOF threshold setting. Clustering-based anomaly detection methods are limited in that their detection performance heavily depends on the choice of cluster and have high computational complexity for multivariate data. Furthermore, with the development of deep learning, more and more machine learning-based anomaly detection methods are being applied; however, these methods are limited by long model training times, requiring different models to be trained for different data.

[0006] It is evident that existing anomaly detection methods neglect the scale of wireless sensor networks and fail to fully utilize the spatiotemporal correlations between nodes within these networks. Due to the large scale, high dimensionality, and massive volume of data in wireless sensor networks, the aforementioned anomaly detection methods are not only time-consuming but also computationally expensive. Summary of the Invention

[0007] To address the aforementioned problems in the existing technology, this invention provides an online detection method for time-series anomaly data based on perceptual grouping. The technical problem to be solved by this invention is achieved through the following technical solution:

[0008] This invention provides an online detection method for time series anomaly data based on sensing grouping, which is applied to a wireless sensor network communicating with a cloud server. The wireless sensor network includes multiple sensor nodes.

[0009] The online method for detecting time series anomalies includes:

[0010] Sensor nodes collect the current time series;

[0011] Sensor nodes upload their current time series data to a cloud server, which then generates a correlation coefficient map of the wireless sensor network based on the correlation coefficients between the sensor nodes. The cloud server then groups the multiple sensor nodes based on the correlation coefficient map and sends the grouping results to the wireless sensor network.

[0012] Sensor nodes use a pre-trained Bayesian network model to perform anomaly screening on their current time series to obtain preliminary detection results;

[0013] For each grouped set of nodes, the sensor node performs anomaly screening on its current time series based on the first preset threshold corresponding to its own set of nodes, and obtains the secondary detection result;

[0014] Based on the primary detection results and the secondary detection results, the detection results of the current time series of each sensor node are determined.

[0015] In one embodiment of the present invention, the step of a sensor node uploading its current time series to a cloud server, so that the cloud server generates a correlation coefficient map of the wireless sensor network based on the correlation coefficients between the sensor nodes, includes:

[0016] The sensor nodes upload their current time series to the cloud server, so that the cloud server can calculate the correlation coefficient matrix based on the time series, determine the correlation coefficient between each sensor node based on the correlation coefficient matrix, and further generate a correlation coefficient map based on the correlation coefficient and a second preset threshold.

[0017] In one embodiment of the present invention, the correlation coefficient matrix is ​​represented as follows:

[0018]

[0019] in,

[0020]

[0021] In the formula, The correlation coefficient matrix, Represents sensor nodes i With sensor nodes j The correlation coefficient between them , , n Indicates the number of sensor nodes. , Representing sensor nodes i Sensor nodes j At any moment m The collected time series, , They represent t 0~ T Sensor nodes within a time period i Sensor nodes j The collected time series mean, , , , Representing sensor nodes i Sensor nodes j The collected data sequence, , , This represents the L2 norm, also known as the Euclidean norm.

[0022] In one embodiment of the present invention, the cloud server generates the correlation coefficient graph according to the following steps:

[0023] Compare sensor nodes i With sensor nodes j Correlation coefficient between Size;

[0024] When the correlation coefficient When the threshold is greater than or equal to the second preset threshold, at the sensor node i With sensor nodes j Establish an undirected edge between them and set the correlation coefficient. As a sensor node i With sensor nodes j Weights between ;

[0025] When the correlation coefficient When the value is less than the second preset threshold, the sensor node will be... i With sensor nodes j Weights between Set to 0;

[0026] After traversing all sensor nodes, a correlation coefficient graph is generated based on the obtained adjacency matrix.

[0027] In one embodiment of the present invention, the cloud server groups multiple sensor nodes according to the following steps:

[0028] For sensor nodes i Calculate the sensor nodes respectively i The matching value with each neighbor node, wherein the neighbor node is the sensor node connected via an undirected edge. i Connected sensor nodes;

[0029] When sensor node iWhen the matching value generated by matching with each neighbor node is greater than 0, the sensor node is... i The sensor node is matched with the neighbor node with the highest matching value; when the sensor node i When the matching values ​​generated by matching with each neighbor node are all greater than 0 and equal, a neighbor node is randomly selected to match the sensor node. i Matched as a group; when sensor nodes i If the matching value generated by matching with each neighbor node is less than 0, then the sensor node... i Groups that do not match neighboring nodes;

[0030] Sensor nodes matched as a group i and sensor nodes l Merged into a new sensor node k And adjust the correlation coefficient graph;

[0031] The grouping results of the sensor nodes are obtained based on the current correlation coefficient graph when the matching value of each sensor node with each of its neighboring nodes is less than 0.

[0032] In one embodiment of the present invention, the matching value is calculated according to the following formula:

[0033]

[0034] in, This represents the sum of all weights in the current correlation coefficient graph. Represents all sensor nodes The sum of the weights of all neighboring nodes. Represents all sensor nodes The sum of the weights of the sensor node with all its neighboring nodes. For sensor nodes The neighboring nodes, Represents sensor nodes With sensor nodes The weights between them.

[0035] In one embodiment of the present invention, for each grouped set of nodes, the step of the sensor node performing anomaly screening on its current time series according to a first preset threshold corresponding to its own set of nodes to obtain a secondary detection result includes:

[0036] Get the most recent Sensor nodes within time First time series collected and sensor nodes The second time series collected And calculate the mean of the first time series. and the mean of the second time series ;

[0037] Will and As the center of the region, calculate the Mahalanobis distance between the current time series and the center of the region;

[0038] Determine whether the Mahalanobis distance between the current time series and the center of the region is greater than a first preset threshold; if so, the secondary detection result of the current time series is abnormal; otherwise, the secondary detection result of the current time series is normal.

[0039] In one embodiment of the present invention, the step of determining the detection result of the current time series of each sensor node based on the primary detection result and the secondary detection result includes:

[0040] If both the primary and secondary detection results of the current time series are abnormal, then the detection result of the current time series of this sensor node is abnormal.

[0041] If the primary and / or secondary detection results of the current time series are normal, then the detection results of the current time series of this sensor node are normal.

[0042] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0043] This invention provides an online detection method for time series anomaly data based on sensor grouping. The cloud server uses correlation coefficients to characterize the correlation strength between sensor nodes and generates a correlation coefficient map based on the correlation coefficients. The wireless sensor nodes are then grouped based on the correlation coefficient map, which can not only reduce the communication complexity in the wireless sensor network, but also reduce energy consumption and improve the anomaly detection accuracy.

[0044] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0045] Figure 1 This is a flowchart of an online detection method for time series anomaly data based on perceptual grouping provided in an embodiment of the present invention;

[0046] Figure 2 This is a schematic diagram of an online detection method for time series anomaly data based on perceptual grouping provided in an embodiment of the present invention;

[0047] Figure 3a This is a schematic diagram of a generated dataset provided in an embodiment of the present invention;

[0048] Figure 3bThis is another schematic diagram of the generated dataset provided in an embodiment of the present invention;

[0049] Figure 4a This is a graph showing the DR and FPR results of the generated dataset provided in this embodiment of the invention.

[0050] Figure 4b This is a graph showing the F1 score of the generated dataset provided in this embodiment of the invention;

[0051] Figure 5a This is a comparison chart of the FDR index of sliding window size and abnormality ratio provided in the embodiments of the present invention;

[0052] Figure 5b This is a comparison chart of the sliding window size and the abnormality ratio provided in the embodiments of the present invention;

[0053] Figure 5c This is a comparison chart of the FPR index between the abnormality ratio and the relevant threshold provided in the embodiments of the present invention;

[0054] Figure 5d This is a comparison chart of the abnormality ratio and related threshold DR index provided in the embodiments of the present invention;

[0055] Figure 6a This is a comparison chart of FPR indicators provided in the embodiments of the present invention;

[0056] Figure 6b This is a comparison chart of DR indicators provided in an embodiment of the present invention;

[0057] Figure 6c This is a comparison chart of the F1 index provided in the embodiments of the present invention;

[0058] Figure 7 This is a schematic diagram illustrating the relationship between data volume and energy consumption provided in an embodiment of the present invention. Detailed Implementation

[0059] The present invention will be further described in detail below with reference to specific embodiments, but the implementation of the present invention is not limited thereto.

[0060] Typically, sensor nodes in wireless sensor networks are deployed directly in the external environment to collect data. Because these nodes are completely exposed to an uncontrollable external environment, their physical resources, such as energy, computing power, storage capacity, and communication capabilities, are very limited. Therefore, sensor nodes are highly susceptible to interference from environmental factors and malicious data corruption, leading to anomalies in the data collected by the sensor network.

[0061] In view of this, the present invention provides an online detection method for time series anomaly data based on perceptual grouping.

[0062] Figure 1This is a flowchart of an online method for detecting time-series anomalies based on perceptual grouping, provided in an embodiment of the present invention. Figure 2 This is a schematic diagram of an online anomaly detection method for time series data based on perceptual grouping provided in an embodiment of the present invention. For example... Figure 1-2 As shown, this embodiment of the invention provides an online detection method for time series anomaly data based on sensing grouping, which is applied to a wireless sensor network that communicates with a cloud server. The wireless sensor network includes multiple sensor nodes.

[0063] The above-mentioned online methods for detecting time series anomalies include:

[0064] S1, Sensor nodes collect the current time series;

[0065] S2. Sensor nodes upload their current time series to the cloud server, so that the cloud server can generate a correlation coefficient map of the wireless sensor network based on the correlation coefficient between each sensor node, and then group multiple sensor nodes based on the correlation coefficient map and send the grouping results to the wireless sensor network.

[0066] S3. Sensor nodes use a pre-trained Bayesian network model to perform anomaly screening on their current time series and obtain preliminary detection results.

[0067] S4. For each set of nodes after grouping, the sensor node performs anomaly screening on its current time series according to the first preset threshold corresponding to its own set of nodes, and obtains the secondary detection result.

[0068] S5. Based on the primary detection results and secondary detection results, determine the current time series detection results of each sensor node.

[0069] Specifically, in a wireless sensor network, the data collected by each sensor node is a time series. Each sensor node first uploads its current time series to a cloud server. The cloud server calculates the correlation coefficients between the sensor nodes based on the current time series and generates a correlation coefficient graph. The correlation coefficients characterize the strength of the correlation between the sensor nodes. Since random grouping ignores the correlation between sensor nodes, leading to a large detection error, this embodiment uses the correlation coefficient graph to calculate the matching value to determine whether two sensor nodes belong to the same group, thereby deciding the optimal group for each sensor node.

[0070] It should be understood that the online anomaly detection of time series in this embodiment includes primary detection and secondary detection. In the primary detection stage, each sensor node uses a pre-trained Bayesian network model to detect whether its current time series is abnormal. For example, the Bayesian network model can be trained using normal historical time series, and the category of the current time series is inferred through maximum a posteriori probability to obtain the primary detection result. Next, in the secondary detection stage, the range of normal data is determined using normal historical time series. This range geometrically represents a region, and the Mahalanobis distance between the current time series and the center of the region is calculated to obtain the secondary detection result. Finally, the current time series can be judged as normal or abnormal based on the primary and secondary detection results.

[0071] Optionally, in step S2 above, the step of the sensor node uploading its current time series to the cloud server so that the cloud server can generate a correlation coefficient map of the wireless sensor network based on the correlation coefficients between the sensor nodes includes:

[0072] The sensor nodes upload their current time series data to the cloud server, which then calculates the correlation coefficient matrix based on the time series data. After determining the correlation coefficient between each sensor node based on the correlation coefficient matrix, the cloud server generates a correlation coefficient map based on the correlation coefficient and a second preset threshold.

[0073] In this embodiment, the correlation coefficient matrix is ​​represented as follows:

[0074]

[0075] in,

[0076]

[0077] In the formula, The correlation coefficient matrix, Represents sensor nodes i With sensor nodes j The correlation coefficient between them , , n Indicates the number of sensor nodes. , Representing sensor nodes i Sensor nodes j At any moment m The collected time series, , They represent t 0~ T Sensor nodes within a time period i Sensor nodes j The collected time series mean, , , , Representing sensor nodes i Sensor nodes j The collected data sequence, , , This represents the L2 norm, also known as the Euclidean norm.

[0078] Optionally, the cloud server generates the correlation coefficient graph by following these steps:

[0079] Compare sensor nodes i With sensor nodes j Correlation coefficient between Size;

[0080] When the correlation coefficient When the threshold is greater than or equal to the second preset threshold, at the sensor node i With sensor nodes j Establish an undirected edge between them and set the correlation coefficient. As a sensor node i With sensor nodes j Weights between ;

[0081] When the correlation coefficient When the value is less than the second preset threshold, the sensor node will be... i With sensor nodes j Weights between Set to 0;

[0082] After traversing all sensor nodes, a correlation coefficient graph is generated based on the obtained adjacency matrix.

[0083] Specifically, an undirected correlation graph is constructed, where each sensor node in the wireless sensor network corresponds to a vertex in the correlation graph. That is, the number of sensor nodes in the wireless sensor network is equal to the number of vertices in the undirected correlation graph. Define... Sensor nodes in an undirected correlation graph i With sensor nodes j The weights between them. For sensor nodes. i With sensor nodes j When the correlation coefficient Greater than or equal to the second preset threshold At the time, at the sensor node i Corresponding vertices and nodes Establish an undirected edge between corresponding vertices and set the correlation coefficient. As a sensor node i With sensor nodes j The weights between them, i.e. When the correlation coefficient Less than the second preset threshold When, then the weights The value is assigned to 0, that is After performing the above operations on each sensor node, an adjacency matrix is ​​obtained, which can be used to generate a correlation coefficient graph.

[0084] Furthermore, the cloud server groups the multiple sensor nodes according to the following steps:

[0085] For sensor nodes i Calculate the sensor nodes respectively i The matching value with each neighbor node, where the neighbor node is the value of the sensor node through an undirected edge. i Connected sensor nodes;

[0086] When sensor node i When the matching value generated by matching with each neighbor node is greater than 0, the sensor node is... i The sensor node is matched with the neighbor node with the highest matching value; when the sensor node i When the matching values ​​generated by matching with each neighbor node are all greater than 0 and equal, a neighbor node is randomly selected to match the sensor node. i Matched as a group; when sensor nodes i If the matching value generated by matching with each neighbor node is less than 0, then the sensor node... i Groups that do not match neighboring nodes;

[0087] Sensor nodes matched as a group i and sensor nodes l Merged into a new sensor node k And adjust the correlation coefficient plot;

[0088] The grouping results of the sensor nodes are obtained based on the current correlation coefficient graph when the matching value of each sensor node with each of its neighboring nodes is less than 0.

[0089] When grouping sensor nodes, we can first consider the sensor nodes corresponding to each vertex in the correlation coefficient graph as a group, and then use the matching value... Measure the sensor node i Its neighboring nodes l The gain resulting from grouping them together. Specifically, the sensor nodes are calculated sequentially. With adjacent sensor nodes l The value of matching as a set If sensor node iIf the matching value generated by matching with each neighbor node is greater than 0, then match with the neighbor node with the highest matching value. If the matching values ​​with all neighbor nodes are equal, then randomly select one of those neighbor nodes for matching. If the sensor node... i If the matching value generated by matching with each neighbor node is less than 0, then no matching is performed on the sensor node. i Perform a match.

[0090] Furthermore, sensor nodes i With sensor nodes l After being matched into a group, in the correlation coefficient graph

[0091] Merge the two sensor nodes into a new sensor node. k At this point, it is necessary to disconnect the original sensor node. Corresponding vertices and sensor nodes The undirected edges connecting corresponding vertices are modified to connect to the new sensor node. The corresponding vertices are connected.

[0092] When the matching value between all sensor nodes is no greater than 0, the grouping result of the sensor nodes is obtained, and the cloud server can transmit the grouping result to the wireless sensor network.

[0093] It should be noted that the matching value in this embodiment The calculation method is as follows:

[0094]

[0095] in, This represents the sum of all weights in the current correlation coefficient graph. Represents all sensor nodes The sum of the weights of all neighboring nodes. Represents all sensor nodes The sum of the weights of the sensor node with all its neighboring nodes. For sensor nodes The neighboring nodes, Represents sensor nodes With sensor nodes The weights between them.

[0096] In step S4 above, for each grouped node set, the sensor node performs anomaly filtering on its current time series based on the first preset threshold corresponding to its own node set to obtain the secondary detection result, including:

[0097] S401, retrieve the most recent Sensor nodes within time First time series collected and sensor nodes The second time series collected And calculate the mean of the first time series. and the mean of the second time series ;

[0098] S402, will and As the center of the region, calculate the Mahalanobis distance between the current time series and the center of the region;

[0099] S403. Determine whether the Mahalanobis distance between the current time series and the center of the region is greater than a first preset threshold; if yes, the secondary detection result of the current time series is abnormal; otherwise, the secondary detection result of the current time series is normal.

[0100] definition express Possible time series pairs with correlation and consistency at any given moment and The set of geometrically Represents a region. If the current time series of the sensor node is... If these two readings are consistent, it indicates that the secondary detection result of the current time series is normal; otherwise, they are inconsistent, and the secondary detection result of the current time series is abnormal. That is:

[0101]

[0102] In this embodiment, the mean of the first time series and the mean of the second time series As the region center, the Mahalanobis distance between the current time series of each sensor node and the region center is calculated. If the Mahalanobis distance between the current time series and the region center is not greater than a first preset threshold, the current time series is considered to have consistency. ;otherwise, .

[0103] Optionally, the first preset threshold is an absolute median difference threshold, which is defined as follows:

[0104]

[0105] In the formula, This represents the threshold adjustment factor, which is typically determined by the user based on specific data. This indicates the median operation. This indicates the current time series for which the absolute median difference threshold needs to be calculated.

[0106] Step S5 above, which involves determining the detection results of each sensor node's current time series based on the primary and secondary detection results, includes:

[0107] If both the primary and secondary detection results of the current time series are abnormal, then the detection result of the current time series of this sensor node is abnormal.

[0108] If the primary and / or secondary detection results of the current time series are normal, then the detection results of the current time series of this sensor node are normal.

[0109] The following simulation experiment further illustrates the online detection method for time series anomaly data based on perceptual grouping.

[0110] In this embodiment, nodes numbered 27 to 42 of the IBRL dataset were selected for the experiment. The experimental data was collected from March 1 to March 9, 2004. Feature temperature data was selected, as shown in Table 1. The temperature data was divided into different intervals. During the experiment, 30% of the original data was added at random intervals to simulate persistent anomalous data. Random Gaussian anomalies were added to the source data to simulate point anomalous data.

[0111] Table 1

[0112]

[0113] This embodiment uses Python as the simulation tool to conduct simulation experiments on both the generated dataset and the real dataset. The simulation dataset is generated according to the following formula:

[0114]

[0115] in,

[0116]

[0117] Next, add the abnormal data using the following formula:

[0118]

[0119] in,

[0120]

[0121] .

[0122] Figure 3a This is a schematic diagram of a generated dataset provided in an embodiment of the present invention. Figure 3b This is another schematic diagram of the generated dataset provided in an embodiment of the present invention. For example... Figure 3aAs shown, for generating datasets , This indicates the interference of noise on the data. This represents outlier data added to the dataset and depends on a random variable. After normalizing the generated dataset, as shown below Figure 3b As shown. Figure 4a This is a graph showing the DR (Detection Rate) and FPR (False Positive Rate) results of the generated dataset provided in this embodiment of the invention. Figure 4a As shown, the horizontal axis represents the proportion of outlier data, and the vertical axis represents the DR and FPR indices. It can be seen that the online outlier detection method for time series data based on perceptual grouping provided by this invention can be effectively applied to the generated dataset, and the changes in DR and FPR are relatively gradual as the proportion of outlier data on the vertical axis increases. Figure 4b This is a graph showing the F1 score of the generated dataset provided in this embodiment of the invention. Please refer to [link / reference]. Figure 4b The horizontal axis represents the percentage of outliers, and the vertical axis represents the F1 score. As expected, the F1 score decreases slowly as the number of outliers increases.

[0123] To accurately evaluate the performance of this method, DR, FPR, and F1 were introduced as experimental metrics. The effectiveness of the proposed method was verified from three aspects: grouping effect, time window size, and threshold size. Figure 5a This is a comparison chart of the FDR index between the sliding window size and the anomaly ratio provided in an embodiment of the present invention. Figure 5b This is a comparison chart of the sliding window size and the anomaly ratio DR index provided in an embodiment of the present invention. Figure 5c This is a comparison chart of the FPR index between the anomaly ratio and the relevant threshold provided in an embodiment of the present invention. Figure 5d This is a comparison chart of the DR index between the abnormality ratio and the relevant threshold provided in an embodiment of the present invention. Figures 5a-5d As shown, the higher the proportion of outlier data, the lower the accuracy and the higher the false positive rate. DR is high when the time window is greater than 25 and less than 35. However, accuracy does not always increase with the increase of the time window, because a wider window includes more historical data, leading to deviations in time correlation. Figure 5a It can be seen that as the window size increases, the FPR remains relatively stable, indicating that a larger time window has a relatively smaller impact on the false positive rate. Combined with... Figures 5c-5d It can be concluded that when the correlation threshold is 0.8, a good accuracy and false positive detection rate are achieved.

[0124] To fully evaluate this invention, the online detection method for time series anomalies provided by this invention was compared with three other methods in a comparative experiment. Figure 6aThis is a comparison chart of FPR indicators provided in an embodiment of the present invention. Figure 6b This is a comparison chart of DR indicators provided in an embodiment of the present invention. Figure 6c This is a comparison chart of the F1 score provided in an embodiment of the present invention. Please refer to [link / reference]. Figure 6a and Figure 6b Under the same conditions, comparing the FPR and DR of different methods as the proportion of outlier data increases, the online outlier detection method based on perceptual grouping provided by this invention outperforms the three methods mentioned in terms of detection accuracy and false positive detection rate when the number of outliers increases. Figure 6c As shown in the figure, this embodiment further compares the F1 scores of the four methods. The online anomaly detection method for time series data based on perceptual grouping provided by this invention can effectively solve the problem of decreased detection performance caused by an increase in the number of anomalies. It can be seen that the online anomaly detection method for time series data provided by this invention has a high accuracy rate and a relatively low false detection rate. Figure 7 This is a schematic diagram illustrating the relationship between data volume and energy consumption provided in an embodiment of the present invention. For example... Figure 7 As shown, the online detection method for time series anomalies provided by this invention has acceptable energy consumption and high accuracy.

[0125] As can be seen from the above embodiments, the beneficial effects of the present invention are as follows:

[0126] This invention provides an online detection method for time series anomaly data based on sensor grouping. The cloud server uses correlation coefficients to characterize the correlation strength between sensor nodes and generates a correlation coefficient map based on the correlation coefficients. The wireless sensor nodes are then grouped based on the correlation coefficient map, which can not only reduce the communication complexity in the wireless sensor network, but also reduce energy consumption and improve the anomaly detection accuracy.

[0127] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0128] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. In addition, those skilled in the art can combine and integrate the different embodiments or examples described in this specification.

[0129] Although this application has been described herein in conjunction with various embodiments, other variations of the disclosed embodiments can be understood and implemented by those skilled in the art in carrying out the claimed application by reviewing the accompanying drawings, the disclosure, and the appended claims.

[0130] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. An online detection method of time series anomaly data based on perception grouping, characterized in that, The application is applied to a wireless sensor network in communication connection with a cloud server, and the wireless sensor network comprises a plurality of sensor nodes. The time series anomaly data online detection method comprises: The sensor node collects a current time series; The sensor node uploads the current time series to the cloud server, so that the cloud server generates a correlation coefficient graph of the wireless sensor network according to the correlation coefficients between the sensor nodes, and the cloud server groups the plurality of sensor nodes based on the correlation coefficient graph and then sends the grouping result to the wireless sensor network; The sensor node uses a pre-trained Bayesian network model to perform anomaly screening on the current time series of the sensor node to obtain a primary detection result; For each node set after grouping, the sensor node performs anomaly screening on the current time series of the sensor node according to a first preset threshold corresponding to the node set to which the sensor node belongs to obtain a secondary detection result; According to the primary detection result and the secondary detection result, the detection result of the current time series of each sensor node is determined; wherein The step of uploading the current time series of the sensor node to the cloud server so that the cloud server generates a correlation coefficient graph of the wireless sensor network according to the correlation coefficients between the sensor nodes comprises: The sensor node uploads the current time series to the cloud server, so that the cloud server calculates a correlation coefficient matrix according to the time series, and determines the correlation coefficients between the sensor nodes based on the correlation coefficient matrix, and then further generates a correlation coefficient graph according to the correlation coefficients and a second preset threshold; The cloud server groups the plurality of sensor nodes according to the following steps: For sensor nodes i Calculate the sensor nodes respectively i The matching value with each neighbor node, wherein the neighbor node is the sensor node connected via an undirected edge. i Connected sensor nodes; When the matching value of each neighbor node is greater than 0 i When the matching value of each neighbor node is greater than 0 i The sensor node is matched with the neighbor node having the greatest matching value; when the matching value of each neighbor node is greater than 0 i The sensor node is matched with a neighbor node randomly selected from the neighbor nodes; when the matching value of each neighbor node is greater than 0 i The sensor node is matched with a neighbor node randomly selected from the neighbor nodes; when the matching value of each neighbor node is greater than 0 i The sensor node is not matched with a neighbor node; when the matching value of each neighbor node is less than 0 i The sensor node is not matched with a neighbor node; when the matching value of each neighbor node is less than 0 sensor nodes matching as a group i and sensor nodes l merge into new sensor nodes k and adjust the correlation coefficient map; Until the matching value of each sensor node with each neighbor node of the sensor node is less than 0, the grouping result of the sensor node is obtained according to the current correlation coefficient graph; The matching value is calculated according to the following formula: wherein, denotes the sum of all weights in the current correlation coefficient map, denotes the sum of all weights between sensor node and all neighbor nodes, denotes the sum of all weights between sensor node and all neighbor nodes, sensor node is a neighbor node of sensor node , denotes the weight between sensor node and sensor node . 2.The method of claim 1, wherein, The correlation coefficient matrix is represented as: The cloud server generates a correlation coefficient graph according to the following steps: wherein is a correlation coefficient matrix, denotes a time series collected by a sensor node i , j denotes a correlation coefficient between a sensor node , , n denotes a number of sensor nodes, , denotes a time series collected by a sensor node i , j denotes a time series collected by a sensor node m at a time instant , denotes a mean of a time series collected by a sensor node t over a time period T , i denotes a mean of a time series collected by a sensor node j over a time period , , , denotes a data sequence collected by a sensor node i , j denotes a data sequence collected by a sensor node , , denotes an L2 norm, i.e. the Euclidean norm. 3.The method of claim 2, wherein, A non-directional correlation graph is constructed, and each sensor node in the wireless sensor network corresponds to each vertex in the non-directional correlation graph; After traversing all the sensor nodes, an adjacency matrix is obtained; comparing the second preset threshold value with the size of the correlation coefficient the size of the correlation coefficient When the correlation coefficient is greater than or equal to a second preset threshold, a sensor node i corresponding to the node and the sensor node j establishes an undirected edge between the corresponding node and the sensor node, and takes the correlation coefficient as a weight between the sensor node i and the sensor node j ; and ; When the correlation coefficient When the value is less than the second preset threshold, the sensor node will be... i With sensor nodes j Weights between Set to 0; A correlation coefficient graph is generated based on the adjacency matrix. For each node set after grouping, the step of performing anomaly screening on the current time series of the sensor node according to a first preset threshold corresponding to the node set to which the sensor node belongs to obtain a secondary detection result comprises: 4.The method of claim 1, wherein, It is judged whether the Mahalanobis distance between the current time series and the region center is greater than the first preset threshold; if yes, the secondary detection result of the current time series is abnormal; otherwise, the secondary detection result of the current time series is normal. acquiring a first time series of sensor nodes acquired within a recent time and a second time series of sensor nodes acquired within a recent time ; will be described below. and as a region center, and calculating the Mahalanobis distance of the current time series from the region center; The step of determining the detection result of the current time series of each sensor node according to the primary detection result and the secondary detection result comprises:

5. The method of claim 1, wherein the method further comprises: If the primary detection result and the secondary detection result of the current time series are both abnormal, the detection result of the current time series of the sensor node is abnormal; If the primary detection result and / or the secondary detection result of the current time series is normal, the detection result of the current time series of the sensor node is normal. ​

Images