Event duration perception-based industrial production process anomaly detection method and device

Abstract

The application belongs to the technical field of industrial production and relates to an industrial production process anomaly detection method and device based on event duration perception, a computer device and a storage medium, the method comprising the following steps: acquiring sensor time series data and extracting time series data features; extracting the state of the sensor at different moments from the time series data features based on internal state changes of the sensor; establishing a hidden semi-Markov model based on the time series and the state changes of the sensor; and performing industrial process anomaly detection based on a hidden semi-Markov likelihood probability graph. The device event perception is converted into a model of the cooperative interaction between the evolution of the internal state of the sensor and the change of the time series, which not only has good interpretability for the state changes and abnormal results of the sensor but also can judge the abnormality from the perspective of the measurable physical quantity of the sensor, has a lower false alarm rate, and can track the specific abnormal sensor node based on the model likelihood probability graph and control the abnormal sensor in a timely and effective manner.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of industrial production, and in particular to an industrial production process anomaly detection method and device based on event duration perception, a computer device and a storage medium. BACKGROUND

[0002] The production process is a key link of the industrial internet. In different industrial production event stages, different intelligent sensors (intelligent sensors, edge computers, etc.) cooperate to form a complex and huge industrial production process network. Timely and accurate detection of the events and physical behaviors of each device helps to understand the running status of the production process. Through tracking and positioning of the running status, abnormal conditions caused by physical damage or network attacks can be found in time, thereby avoiding the stagnation of the entire production process or the damage of the product, which is of great significance to enterprises, individuals and products themselves. The detection of the starting point of the device event in the industrial process is referred to as industrial process anomaly detection.

[0003] Industrial process anomaly detection is generally divided into three categories: traditional detection methods, current statistical methods and machine learning methods. In the traditional production process anomaly detection method, basic statistical analysis techniques such as mean, variance and standard deviation are usually used to detect anomalies in the production process. However, the nonlinearity and high dimensionality of the current complex industrial process pose great challenges to its application. The two major pain points of "curse of dimensionality" and "modeling difficulty" make the traditional anomaly detection method not suitable for application to the current complex industrial process. The statistical model refers to a model established based on probability theory and using mathematical statistical methods. The main means of establishing a statistical model is regression analysis. One of the defects of the statistical model is that the statistical model is difficult to predict and analyze completely unknown phenomena, and can only be used to detect simple anomalies, but may not be effective for complex time series anomaly detection. The machine learning model is the result of the machine learning algorithm, which can be regarded as a function that outputs a certain result under a given input condition. Machine learning has advantages in accurately extracting data features and analyzing big data. For industrial data with large data volume and time series characteristics and complex industrial environments of sensors, anomaly detection methods based on machine learning can effectively respond. The existing anomaly detection method based on machine learning generally uses machine learning algorithms to learn the behavior profile of the production process from the data, and then realizes anomaly detection by evaluating the behavior deviation of the production process to be detected. The defect of this method is that it is more dependent on the completeness of the data set, and when the data set is lacking, the anomaly detection efficiency is low. SUMMARY

[0004] The embodiment of the application aims to provide an event duration perception-based industrial production process anomaly detection method and device, computer equipment and storage medium, to solve the problem that the existing machine learning-based anomaly detection method relies on the completeness of the data set, and when the data set is lacking, the anomaly detection efficiency is low. In order to solve the above technical problems, the application provides an event duration perception-based industrial production process anomaly detection method, which adopts the following technical scheme, comprising:

[0005] Obtain sensor time series data and extract time series data features;

[0006] Based on the internal state change of the sensor, extract the state of the sensor at different times from the time series data features;

[0007] Based on the time series of the hidden semi-Markov model and the state change of the sensor, establish a hidden semi-Markov model;

[0008] According to the hidden semi-Markov model, based on the hidden semi-Markov likelihood probability curve, perform industrial process anomaly detection.

[0009] Preferably, the step of obtaining sensor time series data and extracting time series data features specifically comprises:

[0010] Obtain sensor time series data based on the SCADA system.

[0011] Model the sensor time series data by HSMM;

[0012] Extract the sensor time series data features and analyze the sensor time series data features.

[0013] Preferably, the step of extracting the state of the sensor at different times from the time series data features based on the internal state change of the sensor specifically comprises:

[0014] Obtain different events mined by Kmeans from observation values;

[0015] Take the different events mined by Kmeans from observation values as the state, and the event change is the internal state change of the sensor;

[0016] According to the internal change of the sensor, extract the state of the sensor at different times from the time series data features.

[0017] Preferably, the step of establishing a hidden semi-Markov model based on the time series of the hidden semi-Markov model and the state change of the sensor specifically comprises:

[0018] Select the measurement data of a measurable physical quantity of a certain sensor to be clustered;

[0019] Initialize the estimator of Kmeans, and set the initial parameters;

[0020] According to the measured data training, the data clustering result is obtained;

[0021] According to the clustering result, define a function;

[0022] According to the function, the state transition probability distribution matrix is obtained;

[0023] Initialize the HSMM class of Gaussian distribution.

[0024] Preferably, the step of performing industrial process anomaly detection based on the hidden semi-Markov model and the hidden semi-Markov likelihood probability curve specifically comprises:

[0025] The observation sequence generated between the training sets is input into the hidden semi-Markov model to obtain the likelihood probability (a≤p≤b), and the value of the likelihood probability under normal behavior is within the normal threshold [a,b]. The formula of the hidden semi-Markov likelihood probability is

[0026]

[0027] Wherein, λ represents a plurality of parameters of the HSMM model, represents the observation sequence generated in a period of time, m represents a hidden state of the HSMM, and α T represents the forward probability at T time, a represents the lower limit value of the normal threshold, b represents the upper limit value of the normal threshold, and p represents the likelihood probability value;

[0028] During anomaly detection, the observation sequence o1, o2, …, o T is input, the likelihood probability is obtained, and it is judged whether the likelihood probability is within the normal threshold [a,b]. If yes, it is normal, otherwise, it is abnormal.

[0029] Preferably, the step of extracting the sensor time series data features and analyzing the sensor time series data features specifically comprises:

[0030] A plurality of measurable physical quantities which change in numerical value over time in the industrial production process are one-to-one corresponding to the observation values of the HSMM;

[0031] The observation values are preprocessed, and different events are mined from the observation values by Kmeans, the number of physical states and the state space are estimated, the state is corresponding to the hidden variable of the hidden semi-Markov model, and the relationship between the observation values and the hidden variables is obtained;

[0032] According to the distribution characteristics of data, an Abstract Emissions model, a Multinomial Emissions model and a Gaussian Emissions model in the HSMM are selected;

[0033] The state distribution probability π, the state transition probability matrix tmat and the state residence distribution matrix durations of the HSMM are initialized, and each parameter is input to the model for training.

[0034] Preferably, the likelihood probability is calculated as an average log-likelihood probability, denoted as ALL, and the average log-likelihood probability is calculated according to the following formula:

[0035]

[0036] Wherein, Ω represents the model given various known parameters, The forward probability at time T is represented as F (T).

[0037] In order to solve the above technical problems, the application further provides an industrial production process anomaly detection device based on event duration perception, which adopts the technical scheme as follows, comprising:

[0038] An acquisition module is configured to acquire sensor time series data and extract time series data features.

[0039] An extraction module is configured to extract states of the sensor at different times from the time series data features based on internal state changes of the sensor.

[0040] A model establishment module is configured to establish a hidden semi-Markov model based on hidden semi-Markov time series and state changes of the sensor.

[0041] An anomaly detection module is configured to perform industrial process anomaly detection based on a hidden semi-Markov likelihood probability curve according to the hidden semi-Markov model.

[0042] In order to solve the above technical problems, the application further provides a computer device, which adopts the technical scheme as follows, comprising a memory and a processor, the memory stores computer readable instructions, and the processor executes the computer readable instructions to realize the steps of the above-mentioned industrial production process anomaly detection method based on event duration perception.

[0043] In order to solve the above technical problems, the application further provides a computer readable storage medium, which adopts the technical scheme as follows, the computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by the processor to realize the steps of the above-mentioned industrial production process anomaly detection method based on event duration perception.

[0044] Compared with the prior art, the present application has the following beneficial effects: the device event awareness is converted into the model of the coordinated interaction of the time series change and the internal state evolution of the sensor itself, which not only has good interpretability for the state change and abnormal result of the sensor, but also can judge the abnormality from the perspective of the measurable physical quantity of the sensor, has a lower false alarm rate, and can track the specific abnormal sensor based on the model likelihood probability curve, and control the abnormal sensor in time and effectively; the completeness of the data set is not required, and even when the data set is lacking, the abnormality detection can still be performed normally, and the detection efficiency is high. BRIEF DESCRIPTION OF DRAWINGS

[0045] In order to more clearly illustrate the scheme in the present application, the drawings needed in the description of the embodiments of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0046] Figure 1 is a flowchart of an embodiment of the industrial production process abnormality detection method based on event duration awareness of the present application;

[0047] Figure 2 is a SCADA system structure schematic diagram for acquiring time series data of a sensor in the industrial production process abnormality detection method based on event duration awareness of the present application;

[0048] Figure 3 is a flowchart of constructing an HSMM model in the industrial production process abnormality detection method based on event duration awareness of the present application;

[0049] Figure 4 is an HSMM-based industrial production process abnormality detection framework schematic diagram in the industrial production process abnormality detection method based on event duration awareness of the present application;

[0050] Figure 5 is a medium network use scene schematic diagram in a water supply system in the industrial production process abnormality detection method based on event duration awareness of the present application;

[0051] Figure 6 is a structure schematic diagram of an embodiment of the industrial production process abnormality detection device based on event duration awareness of the present application;

[0052] Figure 7 is a structure schematic diagram of an embodiment of the computer device of the present application. DETAILED DESCRIPTION

[0053] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs; the terminology used in the description herein is for describing particular embodiments only and is not intended to be limiting upon the application; the use herein of terms such as "comprise", "comprises" or "comprising" and any variations thereof are intended to cover a non-exclusive inclusion; the use herein of terms such as "first", "second" and the like are intended to distinguish between similar objects but are not intended to signify a particular order.

[0054] Reference herein to "an embodiment" means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase that in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of one another. It is expressly understood that the embodiments described herein are merely examples from a whole class of comparable embodiments which are claimed by the application.

[0055] In order to better understand the technical scheme of the present application, the technical scheme in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings.

[0056] Example One

[0057] With reference to Figure 1 , a flow chart of one embodiment of the event duration-aware industrial production process anomaly detection method of the present application is shown. The event duration-aware industrial production process anomaly detection method comprises the following steps:

[0058] Step S1, obtain sensor time series data and extract time series data features.

[0059] In the present embodiment, the electronic device on which the event duration-aware industrial production process anomaly detection method runs can receive the event duration-aware industrial production process anomaly detection request through wired connection or wireless connection. It should be noted that the above-mentioned wireless connection can include but is not limited to 3G / 4G / 5G connection, WiFi connection, Bluetooth connection, WiMAXX connection, Zigbee connection, UWB (ultra wideband) connection, and other now known or future developed wireless connection methods.

[0060] In industrial production processes, due to the large number of variables and complex dimensions, the obtained time series data mostly have the characteristics of high capacity and high complexity, and a large amount of time series data is generated and collected. Time series data refers to time series data with strong and obvious periodicity, characterized by time series, correlation and multi-dimensionality, etc.

[0061] In some optional implementations of the embodiment, step S1 can further include the following steps:

[0062] S11, obtaining sensor time series data based on a SCADA system.

[0063] Figure 2 is a schematic diagram of a SCADA system structure for obtaining sensor time series data in the event duration-aware industrial production process anomaly detection method of the present application. As shown in Figure 2 SCADA (Supervisory Control And Data Acquisition) system, i.e. data acquisition and monitoring control system. The SCADA system is a computer-based DCS and power automation monitoring system.

[0064] The SCADA system can monitor and control the running equipment on site to realize data acquisition, equipment control, measurement, parameter adjustment, and various signal alarms. The SCADA system involves configuration software and data transmission links (such as radio data link, GPRS, etc.). The SCADA system mainly consists of the following parts: monitoring computer, remote terminal unit (RTU), programmable logic controller (PLC), communication infrastructure, human-machine interface (HMI), etc. Based on the SCADA system, the obtained sensor time series data is generated into a batadal data set, for example, at different times, each sensor can represent the water level, water flow, etc. of the water tank.

[0065] S12, modeling the sensor time series data by HSMM.

[0066] The construction of the HSMM model is first training, mainly using the Baum Welch algorithm to iteratively train the model, that is, the parameter estimation method in the previous section. The Baum Welch algorithm is actually the EM algorithm, which is a special case of the EM algorithm. Before starting to construct the HSMM model, in addition to initializing the parameters λ = (π, A, D, B) of the HSMM, the minimum convergence value and the number of iterations of the model also need to be initialized. At this point, the observation sequence o1, o2..o n can be input to train the model. It is also worth noting that each measurable physical quantity is basically inconsistent in time series change, hidden state number and initialization parameter, so a corresponding HSMM model needs to be established for each measurable physical quantity according to the parameter change. In addition, the quality of the model is related to the initialized parameters λ = (π, A, D, B) and the minimum convergence value and the number of iterations, which need to be adjusted according to the training effect in the later stage.

[0067] S13, extract the sensor time series data features, and analyze the sensor time series data features.

[0068] The time series analysis is mainly completed through the HSMM model, the time series are respectively modeled through the HSMM model, and the features of the time series are extracted and analyzed.

[0069] In some optional implementations of the embodiment, step S13 can further include the following steps:

[0070] S131, one-to-one correspondence between the HSMM observation value and the plurality of measurable physical quantities in the industrial production process which change with time series.

[0071] S132, data preprocessing is performed on the observation value, and different events such as opening and closing events of switches corresponding to the state of the sensor are mined from the observation value through Kmeans, that is, the number of physical states and the state space are estimated, the state corresponds to the hidden variable of the hidden semi-Markov model, and the relationship between the observation value and the hidden variable is obtained.

[0072] S133, according to the distribution characteristics of the data such as Gaussian distribution, AbstractEmissions model, MultinomialEmissions model and GaussianEmissions model in the HSMM are selected.

[0073] S134, initialize the state distribution probability π, state transition probability matrix tmat, and state residence distribution matrix durations of the HSMM, and input each parameter to the model for training.

[0074] Step S2, based on the internal state change of the sensor, the state of the sensor at different time is extracted from the time series data features.

[0075] A sensor is a measuring component or device that converts a measured quantity into a certain physical quantity (such as an electrical quantity) with a certain precision, which is easy to process and measure. Generally, a sensor converts a non-electric quantity into an electric quantity for output. The characteristics (static characteristics and dynamic characteristics) of the sensor are the external features represented by its internal parameters, which determine the performance and precision of the sensor. A sensor is generally composed of three parts: a sensitive element, a sensing element, and a conversion circuit. The sensitive element is a pre-conversion device that can convert a measured quantity into a physical quantity that is easy to measure, and has a certain mathematical relationship (preferably linear) between the input and the output. For example, an elastic sensitive element converts force into displacement or strain output. The sensing element converts the non-electric physical quantity output by the sensitive element into an electric signal (such as resistance, inductance, capacitance, etc.). For example, temperature is converted into resistance variation, displacement is converted into inductance or capacitance, etc. The basic conversion circuit converts the electric signal quantity into an electric quantity that is easy to measure, such as voltage, current, frequency, etc.

[0076] The internal state of the sensor often changes when the internal or external environment changes.

[0077] In the embodiment, step S2 can further include the following steps:

[0078] S21, obtaining different events mined by Kmeans from observation values.

[0079] Kmeans clusters the observation values, and each class output represents an event.

[0080] S22, taking the different events mined by Kmeans from the observation values as the state, and the event change is the internal state change of the sensor.

[0081] S23, extracting the state of the sensor at different times from the time series data features according to the internal change of the sensor.

[0082] According to the clustering result of step S21, the data at each time is classified, and the classification category is the state corresponding to the data. The state of the sensor at different times includes the rising or falling of the water level state of the water tank, the rising or falling of the water temperature state, etc. Different sensors have multiple states.

[0083] Step S3, establishing a hidden semi-Markov model based on the time series and the state change of the sensor.

[0084] Figure 3 is the flow chart of constructing the HSMM model adopted in the event duration perception-based industrial production process anomaly detection method of the present application. As shown in Figure 3As shown, the process of constructing the HSMM model used in the event duration-aware industrial production process anomaly detection method can include: collecting sensor data, preprocessing the sensor data, Kmeans clustering, initializing various parameters, model training, etc.

[0085] In this embodiment, HSMM modeling can be performed in the following manner, for example:

[0086] S31, select the measurement data of a certain sensor measurable physical quantity to be clustered.

[0087] S32, initialize the Kmean estimator and set the initial parameter n_clusters, random_state n_clusters=cluster number, random_state=random number.

[0088] estimator=KMeans(n_clusters,random_state).

[0089] S33, train and get data clustering results, estimator.fit(measurement data);

[0090] Clustering results=estimator.predict(measurement data).

[0091] S34, def function(clustering results, measurement data);

[0092] Return means, scale;

[0093] means, scale=call function(clustering results, measurement data) #means represents mean, scale represents variance;

[0094] pi=initial probability distribution, durations=state duration matrix.

[0095] S35, tmat=numpy.array([state transition probability distribution matrix]);

[0096] tmat represents the state transition probability distribution matrix.

[0097] pi=numpy.array([initial probability distribution matrix]);

[0098] pi represents the initial probability distribution matrix.

[0099] durations=numpy.array([state duration matrix]);

[0100] durations represents a state duration matrix.

[0101] S36, HSMM=GaussianHSMM(means, scales, durations, tmat, π).

[0102] Here, a Gaussian distribution HSMM class is initialized. In this embodiment, the Gaussian distribution HSMM class is used for analyzing data with Gaussian distribution characteristics, so the Gaussian distribution HSMM class is used when the parameters are set.

[0103] S37, end.

[0104] Step S4, according to the hidden semi-Markov model, based on the hidden semi-Markov likelihood probability graph, industrial process anomaly detection is performed.

[0105] HSMM (hidden semi-Markov models) is the abbreviation of hidden semi-Markov model, which is an extended model of HMM (hidden Markov model). The hidden semi-Markov model (HSMM) is a kind of HMM considering that the state residence probability distribution is explicit. It is to add a time component on the structure of the defined hidden Markov model, which overcomes the limitations of HMM modeling caused by the assumption of Markov chain, and provides better modeling and analysis capabilities in solving real problems, improves the pattern classification ability, and improves the accuracy of pattern classification. Unlike the conventional HMM in which one state corresponds to one observation value, in the HSMM, one state corresponds to a segment of observation values. The hidden Markov model (Hidden Markov Model, HMM) is a statistical model used to describe a Markov process containing hidden unknown parameters. The difficulty is to determine the hidden parameters of the process from the observable parameters. Then use these parameters for further analysis, such as pattern recognition. The hidden Markov model is a Markov chain, whose state cannot be directly observed, but can be observed through the observation vector sequence. Each observation vector is represented by a certain probability density distribution in various states, and each observation vector is generated by a state sequence with corresponding probability density distribution. Therefore, the hidden Markov model is a double random process - a hidden Markov chain with a certain number of states and a set of explicit random functions.

[0106] In some optional implementations of the embodiment, step S4 can further perform the following steps:

[0107] S41, input the generated observation sequence between the training sets into the hidden semi-Markov model to obtain the likelihood probability likehood (a≤p≤b), and obtain the value of the likelihood probability under normal behavior in the normal threshold [a, b]. The hidden semi-Markov likelihood probability formula is

[0108]

[0109] wherein, λ represents a plurality of parameters of the HSMM model, such as an initial state probability distribution, a probability transition matrix, a state duration length probability, a state observation matrix, etc. represents an observation sequence generated in a period of time such as 1 to T, m represents a hidden state of the HSMM, and α T represents a forward probability at T, a represents a lower limit value of a normal threshold value which is not less than 0, b represents an upper limit value of a normal threshold value which is not more than 1, and p represents a likelihood probability value.

[0110] In some optional implementations of the embodiment, the likelihood probability is calculated as an average log likelihood probability, denoted as ALL, and the average log likelihood probability calculation formula is:

[0111]

[0112] wherein, Ω represents a model given various known parameters, represents a forward probability at T.

[0113] S42, when the anomaly is detected, an observation sequence o1, o2, …, o T of a period of time is input, a likelihood probability is obtained, and it is judged whether the likelihood probability is within a normal threshold value [a, b] range, yes if so, normal, otherwise abnormal.

[0114] Figure 4 is a schematic diagram of an HSMM-based industrial production process anomaly detection framework used in the event duration perception-based industrial production process anomaly detection method of the application. As shown in Figure 4 , it can be seen that the application establishes a sensor state evolution and time sequence model through the HSMM. In the whole industrial production process anomaly detection process, the characteristics of the time sequence are first extracted and analyzed, the sensor state is mined through the Kmeans clustering algorithm, and the HSMM model is established in combination of the two.

[0115] Figure 5 is a schematic diagram of a use scenario of a medium network of a town water supply system in the event duration perception-based industrial production process anomaly detection method of the application. As shown in Figure 5 , a batadal data set is generated based on a SCADA system in a use scenario of a medium network of a town water supply system, each sensor at different time can represent water level, water flow and other numerical values of a water tank, and is taken as an observation sequence of the HSMM:

[0116] O m×T ={o1, o2, o3, …, o m}, o i= R T o is the observation sequence of sensor i, m is the last data collected, R is the set of observation sequences, T is the data collection time length. Through the Kmeans clustering algorithm, the observation sequence o i is clustered, the behavior events of the sensor are mined, each event corresponds to a state, the state time length describes the event time length, and a plurality of hidden states S are obtained. Here, the hidden state S refers to different events, different behaviors or different running stages of the industrial process.

[0117] The water valve can be divided into two events of opening and closing, the water flow valve can be divided into three events of large, medium and small, and the like. The number of clustered states is adjusted through the Kmeans parameter and the actual industrial situation, the clustering result is analyzed, and the maximum time length l of each state of the sensor is calculated.

[0118] Through the clustering algorithm, the hidden state of the sensor mined represents different events, different behaviors or different running stages of the industrial process. First, through Kmeans clustering, the observation value of each measurable physical quantity is mined to obtain different events of the sensor, which is used as different states. The state corresponds to the hidden variable of the hidden semi-Markov model, and the relationship between the observation value and the hidden variable is obtained. Therefore, the change process of the hidden state accurately describes the running process of the industrial process.

[0119] At this point, the maximum duration l of the state of the sensor and the number n of hidden states are obtained, and the following definitions are made:

[0120] The observation variables o1, o2, o3,... o t , if the number of observation values is M, and the M observation value sequences are assumed to be V1, V2... V M , then O t = {V1, V2... V M}; the hidden state set is S = {1, 2,... N}; the state duration matrix D n×l is initialized (where r i (d) ∈ D, represents the probability that the state i lasts for d). The state transition matrix A n×n (where a i,j ∈ A, represents the probability that the state i transitions to the state j). The initial probability distribution vector is π = (π1, π2, π3... π N , 1, 2, 3... N ∈ S, representing the probability distribution of the initial system in a certain state), the emission matrix B = {b j (k)} represents the relationship between the state and the observation variable), B is equivalent to an observation value probability function B = {b i (o k )}, 1 ≤ i ≤ N; The initial parameters of the HSMM model are adjusted by... The size of λ = argmaxP(O / λ) is such that, under given initial conditions, the output P(O) is maximized. T The probability distribution γ of each sensor is maximized. This is a maximum likelihood problem, requiring the Baum-Welch algorithm for training. The Baum-Welch algorithm is essentially a special case of the EM algorithm. The model parameters π, A, B, and D of the HSMM are iteratively updated sequentially. After training, the state distribution probability matrix γ of each sensor is finally updated again. n×T (where γ t (j)∈γ, representing the probability that the sensor is in state j at time t), where T is the duration of sensor data acquisition, i.e.:

[0121]

[0122] Where i, j represent states, d represents the duration of a state, and α t (j,d) represents the forward probability, given the observed data o at times 1 to t. 1:t Given the parameter λ, the probability that the state will change to j at time td and continue for d time steps, where P is the conditional probability of the event occurring and S is the latent state of the sensor.

[0123]

[0124] β t (j,d) represents the backward probability. Given the parameter λ and the state j at time t-1 with a duration of d, the observation sequence from time t+1 to T is (o t+1 ,o t+2 ,……,o T The probability of ).

[0125]

[0126] Where, η t (j,d) represents the probability that state j has persisted for time d at time t, and the probability that the random process is in state j at time t is:

[0127]

[0128] To update parameter A, the following intermediate variables also need to be defined:

[0129]

[0130] Therefore, the formula for updating the model's parameters is as follows:

[0131]

[0132]

[0133]

[0134]

[0135] where f (o t -o) is an indicator function defined as:

[0136]

[0137] Most of the machine learning in the prior art, such as decision tree, SVM algorithm has great limitations, and needs a large amount of data and model training, and these methods detect the industrial scene with time sequence characteristics and show low efficiency. The HSMM can well adapt to and process complex time sequence data, has good detection effect for light production process, and is not dependent on data quantity like most machine learning algorithms, needs a large amount of data for training, and can analyze the correlation between data, and for the sensor state, the mode clustering algorithm can effectively extract the event description of each sensor at different time from the complex continuous data features as the state of the HSMM, and the number of physical states of the industrial production process and the state space can be estimated. The HSMM can accurately model the state with duration in each sensor, and after modeling, the abnormal time sequence segment of the sensor can be detected through the likelihood probability of the model.

[0138] The abnormality detection method for industrial production process based on event duration perception provided by the application converts the equipment event perception into the coordinated interaction model of the state evolution and time sequence change of the sensor itself, not only has good interpretability for the state change and abnormal result of the sensor, but also can judge the abnormality of the industrial production process from the measurable physical quantity of the sensor, has lower false alarm rate, and based on the model likelihood probability curve, the specific abnormal sensor node can be tracked, the abnormal sensor can be managed and controlled in time and effectively, does not need to rely on the completeness of the data set, and even when the data set is lacking, the abnormality detection can still be normally performed, and the detection efficiency is high.

[0139] The application is operational with numerous general purpose or special purpose computing system environments or configurations. Examples of well- known computing systems, environments, and / or configurations that can be suitable for use with the application include personal computers, server computers, handheld or laptop devices, tablet devices, multiprocessor systems, microprocessor-based systems, set top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments that include any of the above systems or devices, and the like. The application can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, and the like, that perform particular tasks or implement particular abstract data types. The application can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules can be located in local and remote computer storage media including memory storage devices.

[0140] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through computer readable instructions, and the computer readable instructions can be stored in a computer readable storage medium. When the program is executed, the processes of the above-mentioned embodiment methods can be included. The storage medium can be a non-volatile storage medium such as a magnetic disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0141] It should be understood that although each step in the flowchart of the accompanying drawings is displayed in sequence according to the direction of the arrow, these steps are not necessarily executed in sequence according to the direction of the arrow. Unless otherwise stated herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other sequences. Moreover, at least part of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be alternately executed with other steps or sub-steps or stages of other steps.

[0142] Example Two

[0143] Further reference Figure 6 , as an implementation of the method described above Figure 1 , the application provides an embodiment of an event duration-aware industrial production process anomaly detection device. The device embodiment corresponds to the method embodiment shown in Figure 1 , and the device can be applied to various electronic devices.

[0144] As Figure 6 shown, the event duration perception-based industrial production process anomaly detection device 50 of the embodiment includes an acquisition module 51, an extraction module 52, a model establishment module 53, and an anomaly detection module 54. Among them:

[0145] The acquisition module 51 is configured to acquire sensor time series data and extract time series data features.

[0146] The extraction module 52 is configured to extract states of the sensor at different times from the time series data features based on internal state changes of the sensor.

[0147] The model establishment module 53 is configured to establish a hidden semi-Markov model based on hidden semi-Markov time series and state changes of the sensor.

[0148] The anomaly detection module 54 is configured to perform industrial process anomaly detection based on a hidden semi-Markov likelihood probability graph according to the hidden semi-Markov model.

[0149] By adopting the embodiment, the beneficial effects are as follows: the device event perception is converted into a model of the coordinated interaction of the state evolution and time series changes of the sensor itself, which not only has good interpretability for the state changes and abnormal results of the sensor, but also can judge the anomaly of the industrial production process from the perspective of the measurable physical quantity of the sensor, has a lower false positive rate, and based on the model likelihood probability graph, the specific abnormal sensor node can be tracked, and the abnormal sensor can be managed and controlled in time and effectively; without relying on the completeness of the data set, even when the data set is lacking, the anomaly detection can still be performed normally, and the detection efficiency is high.

[0150] Example Three

[0151] To solve the above technical problems, the embodiment of the present application further provides a computer device. For details, please refer to Figure 7 , Figure 7 The basic structure block diagram of the computer device of the embodiment is shown in the figure.

[0152] The computer device 6 comprises a memory 61, a processor 62, and a network interface 63 which are communicatively connected by a system bus. It should be noted that the computer device 6 is only shown with the components of the memory 61, the processor 62, and the network interface 63, but it should be understood that not all of the shown components are required to be implemented, and more or fewer components can be alternatively implemented. Among them, those skilled in the art can understand that the computer device herein is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0153] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad, a voice control device, and the like.

[0154] The memory 61 comprises at least one type of readable storage medium, including a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or a memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, and the like. Of course, the memory 61 can also include both the internal storage unit and the external storage device of the computer device 6. In the present embodiment, the memory 61 is generally used to store an operating system and various application software installed in the computer device 6, such as computer readable instructions of the event duration perception based industrial production process anomaly detection method, and the like. In addition, the memory 61 can also be used to temporarily store various data that have been output or will be output.

[0155] The processor 62 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In the present embodiment, the processor 62 is configured to execute computer-readable instructions stored in the memory 61 or process data, such as computer-readable instructions of the event duration-aware industrial production process anomaly detection method.

[0156] The network interface 63 may include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0157] With the present embodiment, the beneficial effects are that the device event awareness is converted into a model of collaborative interaction of internal state evolution and time series change of the sensor itself, which not only has good interpretability for the state change and abnormal result of the sensor, but also can judge the abnormality of the industrial production process from the perspective of the measurable physical quantity of the sensor, has a lower false positive rate, and based on the model likelihood probability curve, the specific abnormal sensor node can be tracked, and the abnormal sensor can be managed and controlled in a timely and effective manner; without relying on the completeness of the data set, even when the data set is lacking, the anomaly detection can still be performed normally, and the detection efficiency is high.

[0158] Example Four

[0159] The present application also provides another embodiment, that is, a computer readable storage medium storing computer readable instructions, which can be executed by at least one processor to enable the at least one processor to perform the steps of the event duration-aware industrial production process anomaly detection method as described above.

[0160] With the present embodiment, the beneficial effects are that the device event awareness is converted into a model of collaborative interaction of internal state evolution and time series change of the sensor itself, which not only has good interpretability for the state change and abnormal result of the sensor, but also can judge the abnormality of the industrial production process from the perspective of the measurable physical quantity of the sensor, has a lower false positive rate, and based on the model likelihood probability curve, the specific abnormal sensor node can be tracked, and the abnormal sensor can be managed and controlled in a timely and effective manner; without relying on the completeness of the data set, even when the data set is lacking, the anomaly detection can still be performed normally, and the detection efficiency is high.

[0161] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and necessary general hardware platform, of course, also can be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of software product, and the computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), including a plurality of instructions to make a terminal device (may be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the various embodiment methods of the present application.

[0162] Obviously, the above-described embodiments are only a part of the embodiments of the present application, rather than all the embodiments, and the preferred embodiments of the present application are given in the drawings, but do not limit the patent scope of the present application. The present application can be realized in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or make equivalent replacements to some technical features. Any equivalent structure made by using the content of the present application specification and drawings, directly or indirectly applied to other related technical fields, is also within the patent protection scope of the present application.

Claims

1. An event duration perception based industrial production process anomaly detection method, characterized in that, The method comprises the following steps: obtaining sensor time series data, modeling the sensor time series data by HSMM, extracting sensor time series data features, and analyzing the sensor time series data features; The method comprises the following steps: corresponding to the observation value of the HSMM; data preprocessing is performed on the observation value, and different events are mined from the observation value by Kmeans, the number of physical states and the state space are estimated, the state corresponds to the hidden variable of the hidden semi-Markov model, and the relationship between the observation value and the hidden variable is obtained; According to the distribution characteristics of the data, the AbstractEmissions model, the MultinomialEmissions model and the GaussianEmissions model in the HSMM are selected; The state distribution probability π, the state transition probability matrix tmat, and the state residence distribution matrix durations of the HSMM are initialized, and each parameter is input into the model for training; Based on the internal state change of the sensor, the state of the sensor at different times is extracted from the time series data features; Based on the time series of the hidden semi-Markov model and the state change of the sensor, a hidden semi-Markov model is established. According to the hidden semi-Markov model, based on the hidden semi-Markov likelihood probability graph, the industrial process anomaly detection is performed.

2. The event duration aware industrial production process anomaly detection method according to claim 1, wherein, The step of obtaining sensor time series data specifically comprises: obtaining sensor time series data based on a SCADA system. 3.The event duration aware industrial production process anomaly detection method of claim 1, wherein, The step of extracting the state of the sensor at different times based on the internal state change of the sensor from the time series data features specifically comprises: Obtaining different events mined from the observation value by Kmeans; The different events mined from the observation value by Kmeans are taken as the state, and the event change is the internal state change of the sensor; According to the internal change of the sensor, the state of the sensor at different times is extracted from the time series data features.

4. The event duration aware industrial production process anomaly detection method of claim 1, wherein, The step of establishing a hidden semi-Markov model based on the time series of the hidden semi-Markov model and the state change of the sensor specifically comprises: Selecting the measurement data of a certain sensor measurable physical quantity to be clustered; Initializing the estimator of Kmeans and setting the initial parameters; According to the measurement data training, the data clustering result is obtained; According to the clustering result, a function is defined; According to the function, a state transition probability distribution matrix is obtained; Initializing the HSMM class of Gaussian distribution.

5. The event duration aware industrial production process anomaly detection method of claim 1, wherein, The step of performing industrial process anomaly detection based on the hidden semi-Markov likelihood probability graph according to the hidden semi-Markov model specifically comprises: The observation sequence generated between the training sets is input into the hidden semi-Markov model to obtain the likelihood probability likehood (a≤p≤b), and the value of the likelihood probability under normal behavior is within the normal threshold [a, b]. The formula of the hidden semi-Markov likelihood probability is ； wherein, a plurality of parameters representing the HSMM model, an observation sequence generated in a period of time, m represents a hidden state of the HSMM, a forward probability at time T, a represents a lower limit value of a normal threshold value, b represents an upper limit value of the normal threshold value, and p represents a likelihood probability value; When detecting anomaly, input observation sequence o1, o2, …, o T , get likelihood probability, judge whether the likelihood probability is in the normal threshold [a, b] range, yes, normal, otherwise, abnormal.

6. The event length-aware based industrial production process anomaly detection method of claim 5, wherein, The likelihood probability is calculated by the average log likelihood probability, denoted as ALL, and the formula for calculating the average log likelihood probability is: ； wherein, represents a model given various known parameters, represents a forward probability at time T.

7. An event duration-aware based industrial production process anomaly detection apparatus, characterized in that, It comprises: An acquisition module is configured to acquire sensor time series data and extract time series data features. An extraction module is configured to extract states of the sensor at different times from the time series data features based on internal state changes of the sensor. A model establishment module is configured to establish a hidden semi-Markov model based on hidden semi-Markov time series and the state changes of the sensor. An anomaly detection module is configured to perform industrial process anomaly detection based on a hidden semi-Markov likelihood probability curve according to the hidden semi-Markov model. 8.A computer device, comprising a memory and a processor, wherein the memory stores computer readable instructions, and the processor executes the computer readable instructions to implement steps of the event duration-aware industrial production process anomaly detection method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer readable instructions, and the computer readable instructions are executed by the processor to implement steps of the event duration-aware industrial production process anomaly detection method according to any one of claims 1 to 6.

Images