Multi-sensor anomaly detection method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose a multi-sensor anomaly detection method and device, computer equipment and a storage medium. The method comprises: acquiring signals of multiple sensors to obtain a signal to be detected; using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to preprocess the signal to be detected to obtain a preprocessing result; and using a neural network and a Bayesian filter to perform anomaly monitoring on the preprocessing result to obtain an anomaly monitoring result. The method can maintain good anomaly detection results for a long time, and increase the robustness of the model by simulating the possibility of observation measurement values.

Description

TECHNICAL FIELD

[0001] The present application relates to a sensor anomaly detection method, in particular to a multi-sensor anomaly detection method, device, computer equipment and storage medium. BACKGROUND

[0002] Anomaly detection aims to determine when the monitored object has abnormal behavior and timely issue a warning to attract the attention of the background personnel. This technology has always been an active research point in the field of machine learning. Many methods have been proposed for multivariate time series anomaly detection tasks, such as traditional unsupervised anomaly detection algorithms: support vector machine and isolation forest, etc. The currently commonly used algorithm is the anomaly detection algorithm based on residual or error. There are mainly two ways to use this kind of algorithm, one is to use a prediction model such as a recurrent neural network to predict the measurement value of the sensor at the future time, and the other is to use a reconstruction model such as an autoencoder to project the sensor measurement value to a low-dimensional space and reconstruct it, and then compare the predicted or reconstructed measurement value with the observed measurement value to obtain the residual. If the residual exceeds the threshold, an abnormal warning is given. In practical applications, devices often have various noises in the measurement values due to their imperfect manufacturing, imperfect control by operators, and various reasons, which may cause the set residual threshold to have good anomaly detection results in the current time period, but lose effectiveness in the later period. Unlike prediction-based anomaly detection, density-based anomaly detection uses the likelihood of simulated observed measurement values to increase the robustness of the model.

[0003] Therefore, it is necessary to design a new method to solve the technical problems in the existing sensor anomaly detection method. SUMMARY

[0004] The purpose of the present application is to overcome the defects of the prior art and provide a multi-sensor anomaly detection method, device, computer equipment and storage medium.

[0005] To achieve the above purpose, the technical scheme adopted by the present application is as follows: a multi-sensor anomaly detection method, comprising:

[0006] Obtaining signals of multiple sensors to obtain a to-be-detected signal;

[0007] Using a multi-dimensional time series data interpolation algorithm based on random forest and an SR algorithm to preprocess the to-be-detected signal to obtain a preprocessing result;

[0008] Based on neural network and Bayesian filtering, the preprocessing result is monitored for anomaly to obtain an anomaly monitoring result.

[0009] A further technical scheme is that after the anomaly monitoring result is obtained by the neural network and the Bayesian filtering based on the preprocessing result, the method further comprises:

[0010] The abnormal monitoring result is interpreted in a probabilistic and statistical manner.

[0011] A further technical solution is that the multi-dimensional time series data interpolation algorithm based on a random forest and the SR algorithm are used to pre-process the to-be-detected signal to obtain a pre-processing result, including:

[0012] The multi-dimensional time series data interpolation algorithm based on a random forest uses a random forest in an iterative manner to fill in missing values of the to-be-detected signal to obtain a filling result;

[0013] The filling result is subjected to data cleaning based on the SR algorithm to obtain a cleaning result;

[0014] The cleaning result is subjected to data normalization to obtain the pre-processing result.

[0015] A further technical solution is that the pre-processing result is subjected to abnormal monitoring based on a neural network and a Bayesian filter to obtain an abnormal monitoring result, including:

[0016] A neural network that captures time information and spatial information of the pre-processing result is established;

[0017] An initial time hidden state vector mean and covariance are initialized to generate random numbers; an initial time hidden layer state vector value is simulated, and a next time multi-sensor measurement value is predicted and calculated by combining the neural network to calculate a predicted multi-sensor measurement value subject to a high-dimensional normal distribution mean and covariance;

[0018] An abnormal score of a sensor real measurement value is calculated according to the mean and covariance to obtain the abnormal monitoring result.

[0019] A further technical solution is that the neural network includes a g network, an f network, and an h network; the g network is a feedforward neural network; the f network is a multi-layer LSTM network; and the h network is a feedforward neural network.

[0020] A further technical solution is that a loss function of the neural network includes a reconstruction error, a prediction residual, and a difference value of a continuous time hidden layer state.

[0021] A further technical solution is that the abnormal monitoring result is interpreted in a probabilistic and statistical manner, including:

[0022] An empirical cumulative distribution function of a left tail and a right tail of each sensor in the abnormal monitoring result and a skewness of each sensor data are calculated;

[0023] An empirical connection function is calculated according to the empirical cumulative distribution function of each sensor in the abnormal monitoring result.

[0024] The probability of the measurement value of the monitoring object at the current time point in the anomaly monitoring result appearing at the tail is calculated using an empirical connection function, and the probability of the measurement value of each sensor appearing at the tail is multiplied.

[0025] The application further provides a multi-sensor anomaly detection device, comprising:

[0026] A signal acquisition unit is configured to acquire signals of multiple sensors to obtain to-be-detected signals.

[0027] A preprocessing unit is configured to preprocess the to-be-detected signals by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to obtain preprocessing results.

[0028] An anomaly monitoring unit is configured to perform anomaly monitoring on the preprocessing results based on a neural network and a Bayesian filter to obtain anomaly monitoring results.

[0029] The application further provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the method described above when executing the computer program.

[0030] The application further provides a storage medium storing a computer program, wherein the computer program is executed by a processor to implement the method described above.

[0031] Compared with the prior art, the application has the beneficial effects that: the application preprocesses multiple sensor signals by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm, and performs anomaly monitoring on the preprocessing results based on a neural network and a Bayesian filter, thereby achieving long-term good anomaly detection results and increasing the robustness of the model by simulating the possibility of observation measurement values.

[0032] The application will be further described below in combination with the drawings and specific embodiments. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0034] Figure 1 An application scenario diagram of the multi-sensor anomaly detection method provided by the embodiments of the application is shown.

[0035] Figure 2A flowchart of a multi-sensor anomaly detection method provided by an embodiment of the present application is shown in FIG. 1.

[0036] Figure 3 A sub-flowchart of the multi-sensor anomaly detection method provided by an embodiment of the present application is shown in FIG. 2.

[0037] Figure 4 A sub-flowchart of the multi-sensor anomaly detection method provided by an embodiment of the present application is shown in FIG. 3.

[0038] Figure 5 A schematic diagram of a neural network architecture provided by an embodiment of the present application is shown in FIG. 4.

[0039] Figure 6 A flowchart of a multi-sensor anomaly detection method provided by another embodiment of the present application is shown in FIG. 5.

[0040] Figure 7 A sub-flowchart of the multi-sensor anomaly detection method provided by another embodiment of the present application is shown in FIG. 6.

[0041] Figure 8 A schematic block diagram of a multi-sensor anomaly detection device provided by an embodiment of the present application is shown in FIG. 7.

[0042] Figure 9 A schematic block diagram of a preprocessing unit of a multi-sensor anomaly detection device provided by an embodiment of the present application is shown in FIG. 8.

[0043] Figure 10 A schematic block diagram of an anomaly monitoring unit of a multi-sensor anomaly detection device provided by an embodiment of the present application is shown in FIG. 9.

[0044] Figure 11 A schematic block diagram of a multi-sensor anomaly detection device provided by another embodiment of the present application is shown in FIG. 10.

[0045] Figure 12 A schematic block diagram of an interpretation unit of a multi-sensor anomaly detection device provided by another embodiment of the present application is shown in FIG. 11.

[0046] Figure 13 A schematic block diagram of a computer device provided by an embodiment of the present application is shown in FIG. 12. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present application.

[0048] It should be understood that the terms "comprises" and "comprising," when used in this specification and the following claims, indicate the presence of the described features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0049] It should also be understood that the terms used in the specification of the application herein are used for the purpose of describing particular embodiments only and are not intended to limit the application. As used in the specification and the appended claims of the application, the singular forms "a," "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0050] It should be further understood that the term "and / or" used in the specification of the application and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes these combinations.

[0051] Please refer to Figure 1 and Figure 2 , Figure 1 The application scenario diagram of the multi-sensor anomaly detection method provided by the embodiments of the application. Figure 2 The schematic flowchart of the multi-sensor anomaly detection method provided by the embodiments of the application. The multi-sensor anomaly detection method is applied to a server. The server interacts with a plurality of sensors, pre-processes multi-sensor data based on a random forest-based multi-dimensional time series data interpolation and an SR (Spectral Rsudial) algorithm, performs anomaly monitoring on the multi-sensor based on a neural network and a Bayesian filter, and performs anomaly detection interpretation based on probability statistics, thereby achieving long-term maintenance of good anomaly detection results without using the possibility of simulated observation measurement values to increase the robustness of the model.

[0052] Figure 2 The flowchart of the multi-sensor anomaly detection method provided by the embodiments of the application. As shown in Figure 2 , the method comprises the following steps S110 to S130.

[0053] S110, acquiring signals of a plurality of sensors to obtain to-be-detected signals.

[0054] In this embodiment, the to-be-detected signals refer to signals detected by the plurality of sensors.

[0055] S120, pre-processing the to-be-detected signals by using a random forest-based multi-dimensional time series data interpolation algorithm and an SR algorithm to obtain a pre-processing result.

[0056] In the embodiment, the pre-processing result refers to a result formed after missing value filling, data cleaning and data normalization are performed on the to-be-detected signal.

[0057] In an embodiment, referring to Figure 3 The step S120 can include steps S121-S123.

[0058] S121, a multi-dimensional time series data imputation algorithm based on random forest fills the missing values of the to-be-detected signal in an iterative manner using random forest to obtain a filling result.

[0059] In the embodiment, the filling result refers to a result formed after the missing values of the to-be-detected signal are filled.

[0060] Since the sensor may encounter a power failure type of sudden event during measurement, the incoming data has a certain missing value, but there is a certain correlation between different sensors under the same site, among which the same type of sensors have a higher correlation, and different types of sensors have a lower correlation. The missing data can be imputed using the correlation between the data. The multi-dimensional time series data imputation algorithm based on random forest fills the missing values in an iterative manner using random forest. The sensor with missing values is used as the explained variable, and the sensor without missing values is used as the explanatory variable to establish a random forest model, and the missing part of the explained variable is used as the training data to train the model, and the missing part is predicted to achieve imputation. When more than one sensor has missing values, it is necessary to repeatedly iterate until a certain convergence condition is met.

[0061] S122, data cleaning is performed on the filling result based on the SR algorithm to obtain a cleaning result.

[0062] In the embodiment, the cleaning result refers to a result formed after the filling result is cleaned using the SR algorithm.

[0063] In the embodiment, the training of the neural network and Bayesian filtering anomaly detection model needs to be performed under non-anomalous data, so data cleaning needs to be performed after data imputation. Considering that the spectral residual algorithm has good performance in single variable time series anomaly detection, this part uses the spectral residual to clean the data of each sensor.

[0064] S123, data normalization is performed on the cleaning result to obtain a pre-processing result.

[0065] In this embodiment, the neural network and Bayesian filtering based anomaly detection model needs to use gradient descent algorithm for network parameter update in the training process, and the data needs to be normalized after data cleaning. This step not only can effectively prevent the occurrence of gradient disappearance or gradient explosion in the gradient descent process, but also can speed up the convergence speed. This part uses the following formula to normalize each sensor data:

[0066] Wherein, X j represents the jth sensor data, min(X j ) represents the minimum value of the jth sensor data, and max(X j ) represents the maximum value of the jth sensor data.

[0067] S130, based on neural network and Bayesian filtering, the pre-processing result is monitored to obtain the abnormal monitoring result.

[0068] In this embodiment, the anomaly detection result refers to the result of the abnormal value formed by monitoring the sensor data abnormal value of the pre-processing result.

[0069] In an embodiment, please refer to Figure 4 , the above step S130 can include steps S131-S133.

[0070] S131, a neural network for capturing time information and spatial information of the pre-processing result is established.

[0071] In this embodiment, as shown in Figure 5 , the neural network includes g network, f network and h network; the g network is a feedforward neural network; the f network is a multilayer LSTM network; and the h network is a feedforward neural network.

[0072] The construction of the neural network is also the reconstruction / prediction of the multidimensional time series.

[0073] The architecture of the neural network is composed of three subnets, which are g network, f network and h network. The main functions of each network layer are as follows:

[0074] g network: feedforward neural network with parameters ω. The input of this network layer is the measurement value of the multi-sensor at t-1 time, and the feedforward neural network encodes the measurement value of the multi-sensor at t-1 time into a lower-dimensional hidden state vector z t-1 .

[0075] f network: multilayer LSTM network with parameters θ. The input of this network layer is the measurement value of the multi-sensor from t-l time to t-1 time, and the multilayer LSTM network encodes the measurement value of the multi-sensor from t-l time to t-1 time into a hidden vector h t-1 . Vector ht -1 The time series of the time content information is provided for the conversion of the hidden state, in combination with the hidden state vector z t-1 The next time, that is, the time t, hidden state vector z t .

[0076] h network: the parameter is a feedforward neural network with The input of this network layer is the hidden state vector z t The feedforward neural network decodes the hidden state vector into the corresponding sensor measurement value at time t, which corresponds to the prediction of the sensor measurement value at time t. If the input of this network layer is the hidden state vector z t-1 , the feedforward neural network decodes it into the corresponding sensor measurement value at time t-1, and the measurement value at this time is the input value of the f network, and this part corresponds to the reconstruction of the sensor measurement value at time t-1.

[0077] In this embodiment, the parameters in the network are initially taken as some random values, and then updated using the gradient descent method according to the samples, without the need for setting.

[0078] The above g network, f network and h network constitute a neural network, the input of the network has two, which are: the measurement value of the multi-sensor at time t-1 and the measurement value of the multi-sensor from time t-1 to time t-1, and the output of the network also has two, which are: the reconstruction of the multi-sensor measurement value at time t-1 and the prediction of the multi-sensor measurement value at time t-1. For the subsequent anomaly detection task, the training of the network only uses normal data. The loss function of the network is composed of three parts, which are the reconstruction error the prediction residual and the difference of the continuous time hidden layer state , which is expressed as follows:

[0079] After the loss function is determined, the random gradient descent algorithm is used to update the parameters.

[0080] S132, initialize the mean and covariance of the initial time hidden state vector to generate random numbers; simulate the value of the initial time hidden layer state vector, and combine the neural network to predict the measurement value of the multi-sensor at the next time and calculate the mean and covariance of the predicted multi-sensor measurement value subject to high-dimensional normal distribution.

[0081] In this embodiment, the neural network can be represented by the following formula: Not generally assuming that the error follows a high-dimensional normal distribution, then z t and x tAll are subject to high-dimensional normal distribution. After knowing the data distribution, the two important parameters of the distribution, mean and covariance, are estimated. First, the mean and covariance of the hidden state vector at the initial time are initialized p 0 = εI m , generate random numbers according to the mean and covariance of the hidden state vector at the initial time, simulate the hidden layer state vector value at the initial time, and combine the neural network constructed in the last step to predict the measurement value of the next time of the multi-sensor and calculate the mean μ and covariance ∑ of the predicted multi-sensor measurement value at the time.

[0082] S133, calculate the abnormal score of the real measurement value of the sensor according to the mean and covariance, to obtain an abnormal monitoring result.

[0083] In this embodiment, theoretically, the real measurement value of the multi-sensor should also be subject to a high-dimensional normal distribution with mean μ and covariance ∑. According to this theory, the abnormal score of the real measurement value of the sensor is calculated:

[0084] The multi-sensor anomaly detection method described above, by using the random forest multi-dimensional time series data interpolation algorithm and the SR algorithm for pre-processing of multiple sensor signals, and based on neural network and Bayesian filtering, the pre-processing result is monitored, and a long-term good abnormal detection result is realized. The robustness of the model does not need to use the possibility of simulated observation measurement value to increase.

[0085] Figure 6 is a flowchart of a multi-sensor anomaly detection method provided by another embodiment of the application. As shown in Figure 6 the multi-sensor anomaly detection method of the embodiment includes step S240. Steps S210-S230 are similar to steps S110-S130 in the above embodiment, and will not be described here. The step S240 added in this embodiment will be described in detail below.

[0086] S240, the abnormal monitoring result is explained by a probability and statistics method.

[0087] The detected abnormality is explained, the probability of abnormality of each device at the current time point is calculated by a probability and statistics method, and is visualized; on the one hand, the abnormality of the monitoring object can be explained, and on the other hand, a basis for distinguishing whether the abnormality is a partial device abnormality or a monitoring object abnormality is provided.

[0088] In an embodiment, referring to Figure 7 the step S240 described above can include steps S241-S243.

[0089] S241, calculating the empirical cumulative distribution function of the left tail and the right tail of each sensor in the anomaly monitoring result and the skewness of each sensor data.

[0090] Specifically,

[0091] wherein, is the cumulative distribution function of each sensor data, I(X i ≤x) represents an indicator function, if X i ≤x, I(X i ≤x) = 1.

[0092] S242, calculating the empirical connection function according to the empirical cumulative distribution function of each sensor in the anomaly monitoring result.

[0093] Specifically,

[0094] S243, calculating the probability of the current time point measurement value of the monitoring object in the anomaly monitoring result appearing in the tail by using the empirical connection function, by multiplying the probability of the measurement value of each sensor appearing in the tail.

[0095] Specifically,

[0096] In this embodiment, the parameters in the network will take some random values at the beginning, and will be updated using the gradient descent method according to the samples subsequently, without the need for setting.

[0097] Figure 8 is a schematic block diagram of a multi-sensor anomaly detection device 300 provided by an embodiment of the present application. As Figure 8 shown, corresponding to the above multi-sensor anomaly detection method, the present application also provides a multi-sensor anomaly detection device 300. The multi-sensor anomaly detection device 300 includes units for executing the above multi-sensor anomaly detection method, and the device can be configured in a server. Specifically, please refer to Figure 8 , the multi-sensor anomaly detection device 300 includes a signal acquisition unit 301, a preprocessing unit 302, and an anomaly monitoring unit 303.

[0098] The signal acquisition unit 301 is configured to acquire signals of multiple sensors to obtain a to-be-detected signal; the preprocessing unit 302 is configured to preprocess the to-be-detected signal by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to obtain a preprocessing result; and the anomaly monitoring unit 303 is configured to perform anomaly monitoring on the preprocessing result based on a neural network and a Bayesian filter to obtain an anomaly monitoring result.

[0099] In an embodiment, as Figure 9As shown, the preprocessing unit 302 includes a filling subunit 3021, a cleaning subunit 3022, and a normalization subunit 3023.

[0100] The filling subunit 3021 is configured to fill missing values of the to-be-detected signal in an iterative manner using a random forest to obtain a filling result. The cleaning subunit 3022 is configured to perform data cleaning on the filling result based on an SR algorithm to obtain a cleaning result. The normalization subunit 3023 is configured to perform data normalization on the cleaning result to obtain a preprocessing result.

[0101] In an embodiment, as shown in Figure 10 The anomaly monitoring unit 303 includes an establishing subunit 3031, a content calculation subunit 3032, and a score determination subunit 3033.

[0102] The establishing subunit 3031 is configured to establish a neural network that captures time information and spatial information of the preprocessing result. The content calculation subunit 3032 is configured to initialize a mean and a covariance of an initial time hidden state vector to generate random numbers. The score determination subunit 3033 is configured to calculate an anomaly score of a sensor real measurement value according to the mean and the covariance to obtain an anomaly monitoring result.

[0103] Figure 11 is a schematic block diagram of a multi-sensor anomaly detection device 300 provided by another embodiment of the present application. As shown in Figure 11 The multi-sensor anomaly detection device 300 of the present embodiment is based on the above-mentioned embodiments and further includes an explanation unit 304.

[0104] The explanation unit 304 is configured to explain the anomaly monitoring result by a probabilistic and statistical manner

[0105] In an embodiment, as shown in Figure 12 The explanation unit 304 includes a first calculation subunit 3041, a second calculation subunit 3042, and a third calculation subunit 3043.

[0106] The first calculation sub-unit 3041 is configured to calculate the empirical cumulative distribution function of the left tail and the right tail of each sensor in the abnormality monitoring result and the skewness of the sensor data. The second calculation sub-unit 3042 is configured to calculate the empirical connection function according to the empirical cumulative distribution function of each sensor in the abnormality monitoring result. The third calculation sub-unit 3043 is configured to calculate the probability of the measurement value of the monitoring object at the current time point in the abnormality monitoring result appearing in the tail by multiplying the probability of the measurement value of each sensor appearing in the tail using the empirical connection function.

[0107] It should be noted that the specific implementation process of the multi-sensor abnormality detection apparatus 300 and each unit can be clearly understood by those skilled in the art, and can be referred to the corresponding description in the foregoing method embodiments. For the convenience and brevity of description, details are not described herein.

[0108] The multi-sensor abnormality detection apparatus 300 can be implemented in the form of a computer program, which can run on the computer device as shown in the accompanying drawings. Figure 13

[0109] Please refer to Figure 13 , Figure 13 is a schematic block diagram of a computer device provided by an embodiment of the present application. The computer device 500 can be a server, wherein the server can be a stand-alone server or a server cluster composed of multiple servers.

[0110] Referring to Figure 13 , the computer device 500 includes a processor 502, a memory, and a network interface 505 connected through a system bus 501, wherein the memory can include a non-volatile storage medium 503 and an internal memory 504.

[0111] The non-volatile storage medium 503 can store an operating system 5031 and a computer program 5032. The computer program 5032 includes program instructions, which, when executed, can cause the processor 502 to perform a multi-sensor abnormality detection method.

[0112] The processor 502 is configured to provide calculation and control capabilities to support the operation of the entire computer device 500.

[0113] The internal memory 504 provides an environment for the operation of the computer program 5032 in the non-volatile storage medium 503, which, when executed by the processor 502, can cause the processor 502 to perform a multi-sensor abnormality detection method.

[0114] The network interface 505 is configured to perform network communication with other devices. Those skilled in the art can understand that Figure 13 ​The structure shown in the figure is only a block diagram of part of the structure related to the scheme of the present application, and does not constitute a limitation on the computer device 500 to which the scheme of the present application is applied. Specifically, the computer device 500 can include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0115] The processor 502 is configured to run the computer program 5032 stored in the memory to implement the following steps:

[0116] Obtaining signals of a plurality of sensors to obtain a to-be-detected signal; preprocessing the to-be-detected signal by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to obtain a preprocessing result; and performing abnormal monitoring on the preprocessing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result.

[0117] In an embodiment, after implementing the step of performing abnormal monitoring on the preprocessing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result, the processor 502 further implements the following step:

[0118] Interpreting the abnormal monitoring result by means of probability statistics.

[0119] In an embodiment, when implementing the step of preprocessing the to-be-detected signal by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to obtain a preprocessing result, the processor 502 specifically implements the following step:

[0120] The multi-dimensional time series data interpolation algorithm based on a random forest uses a random forest in an iterative manner to fill in missing values of the to-be-detected signal to obtain a filling result; performs data cleaning on the filling result based on an SR algorithm to obtain a cleaning result; and performs data normalization on the cleaning result to obtain a preprocessing result.

[0121] In an embodiment, when implementing the step of performing abnormal monitoring on the preprocessing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result, the processor 502 specifically implements the following step:

[0122] establishing a neural network that captures time information and spatial information of the preprocessing result; initializing a mean and a covariance of an initial time hidden state vector to generate random numbers; simulating a value of an initial time hidden layer state vector, and combining the neural network to predict a measurement value of a next time of a plurality of sensors and calculate a mean and a covariance of the predicted measurement value of the plurality of sensors conforming to a high-dimensional normal distribution; and calculating an abnormal score of a real measurement value of a sensor according to the mean and the covariance to obtain an abnormal monitoring result.

[0123] The neural network comprises a g network, an f network and an h network; the g network is a feedforward neural network; the f network is a multilayer LSTM network; and the h network is a feedforward neural network.

[0124] The loss function of the neural network comprises a reconstruction error, a prediction residual and a difference value of a continuous time hidden layer state.

[0125] In an embodiment, when the processor 502 implements the step of interpreting the abnormal monitoring result by means of probability statistics, the following steps are implemented:

[0126] The empirical cumulative distribution function of the left tail and the right tail of each sensor in the abnormal monitoring result and the skewness of each sensor data are calculated; the empirical connection function is calculated according to the empirical cumulative distribution function of each sensor in the abnormal monitoring result; the probability of the current time point measurement value of the monitored object in the abnormal monitoring result appearing in the tail is calculated by using the empirical connection function, and the probability of each sensor measurement value appearing in the tail is multiplied.

[0127] It should be understood that, in the embodiments of the present application, the processor 502 can be a central processing unit (CPU), and the processor 502 can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0128] It can be understood by those skilled in the art that all or part of the processes in the above-mentioned embodiments can be completed by a computer program instructing related hardware. The computer program comprises program instructions, and the computer program can be stored in a storage medium, which is a computer-readable storage medium. The program instructions are executed by at least one processor in the computer system to implement the process steps of the above-mentioned embodiments.

[0129] Therefore, the present application further provides a storage medium. The storage medium can be a computer-readable storage medium. The storage medium stores a computer program, wherein the computer program is executed by a processor to make the processor execute the following steps:

[0130] Obtaining signals of multiple sensors to obtain a to-be-detected signal; pre-processing the to-be-detected signal by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to obtain a pre-processing result; performing abnormal monitoring on the pre-processing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result.

[0131] In an embodiment, after the processor executes the computer program to implement the step of performing abnormal monitoring on the pre-processing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result, the processor further implements the following steps:

[0132] Interpreting the abnormal monitoring result in a probabilistic and statistical manner.

[0133] In an embodiment, when the processor executes the computer program to implement the step of pre-processing the to-be-detected signal by using a multi-dimensional time series data interpolation algorithm based on a random forest and an SR algorithm to obtain a pre-processing result, the processor specifically implements the following steps:

[0134] The multi-dimensional time series data interpolation algorithm based on a random forest fills in missing values of the to-be-detected signal in an iterative manner using a random forest to obtain a filling result; the filling result is cleaned based on an SR algorithm to obtain a cleaning result; the cleaning result is normalized to obtain a pre-processing result.

[0135] In an embodiment, when the processor executes the computer program to implement the step of performing abnormal monitoring on the pre-processing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result, the processor specifically implements the following steps:

[0136] establishing a neural network that captures time information and spatial information of the pre-processing result; initializing a mean and a covariance of a hidden state vector at an initial time to generate random numbers; simulating a value of a hidden layer state vector at the initial time, and combining the neural network to predict a measurement value of a next time of the multiple sensors and calculate a mean and a covariance of the predicted measurement value of the multiple sensors that conforms to a high-dimensional normal distribution; calculating an abnormal score of a real measurement value of a sensor according to the mean and the covariance to obtain an abnormal monitoring result.

[0137] The neural network includes a g network, an f network, and an h network; the g network is a feedforward neural network; the f network is a multi-layer LSTM network; and the h network is a feedforward neural network.

[0138] The loss function of the neural network includes a reconstruction error, a prediction residual, and a difference value of a continuous time hidden layer state.

[0139] In an embodiment, the processor, when executing the computer program to implement the step of interpreting the abnormal monitoring result by means of probability statistics, specifically implements the following steps:

[0140] calculating the empirical cumulative distribution function of the left tail and the right tail of each sensor in the abnormal monitoring result and the skewness of the data of each sensor; calculating the empirical connection function according to the empirical cumulative distribution function of each sensor in the abnormal monitoring result; calculating the probability of the measurement value of the monitoring object at the current time point in the abnormal monitoring result appearing in the tail by using the empirical connection function, by multiplying the probability of the measurement value of each sensor appearing in the tail.

[0141] The storage medium can be a U disk, a mobile hard disk, a read-only memory (ROM), a magnetic disk or an optical disk, and various computer readable storage media that can store program codes.

[0142] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware, computer software or a combination of both. In order to clearly illustrate the interchangeability of hardware and software, the components and steps of the examples have been described in general terms in the above description. Whether the functions are realized in hardware or software depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0143] In several embodiments provided by the present application, it should be understood that the disclosed apparatus and method can be implemented by other ways. For example, the apparatus embodiments described above are merely illustrative. For example, the division of each unit is only a logical function division, and actual implementation can have another division manner. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0144] The steps in the method embodiments of the present application can be adjusted, combined and deleted in sequence according to actual needs. The units in the apparatus embodiments of the present application can be combined, divided and deleted according to actual needs. In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0145] The integrated unit, if implemented in the form of a software function unit and sold or used as an independent product, can be stored in a storage medium. Based on such an understanding, the technical solutions of the present application essentially or say the part that contributes to the prior art, or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a terminal, or a network device, etc.) to execute all or part of the steps of the method described in the various embodiments of the present application.

[0146] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of various equivalent modifications or replacements within the technical range disclosed by the present application, and these modifications or replacements should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A multi-sensor anomaly detection method, characterized by, The method comprises the following steps: obtaining signals of multiple sensors to obtain a to-be-detected signal; preprocessing the to-be-detected signal by using a random forest-based multi-dimensional time series data interpolation algorithm and an SR algorithm to obtain a preprocessing result; performing abnormal monitoring on the preprocessing result based on a neural network and a Bayesian filter to obtain an abnormal monitoring result; the preprocessing of the to-be-detected signal by using the random forest-based multi-dimensional time series data interpolation algorithm and the SR algorithm to obtain the preprocessing result comprises: the random forest-based multi-dimensional time series data interpolation algorithm fills in missing values of the to-be-detected signal in an iterative manner by using a random forest to obtain a filling result; performing data cleaning on the filling result based on the SR algorithm to obtain a cleaning result; performing data normalization on the cleaning result to obtain the preprocessing result; the abnormal monitoring on the preprocessing result based on the neural network and the Bayesian filter to obtain the abnormal monitoring result comprises: establishing a neural network that captures time information and spatial information of the preprocessing result; initializing a mean and a covariance of an initial time hidden state vector to generate random numbers; simulating a value of an initial time hidden layer state vector, and combining the neural network to predict a next time multi-sensor measurement value and calculate a mean and a covariance of the predicted multi-sensor measurement value subject to a high-dimensional normal distribution; calculating an abnormal score of a sensor real measurement value according to the mean and the covariance to obtain the abnormal monitoring result; the neural network comprises a g network, an f network and an h network; the g network is a feedforward neural network; the f network is a multi-layer LSTM network; the h network is a feedforward neural network; the g network, the f network and the h network constitute a neural network, and the neural network has two inputs, which are a t-1 time multi-sensor measurement value and a t-l time to t-1 time multi-sensor measurement value; the neural network also has two outputs, which are a reconstruction of the t-1 time multi-sensor measurement value and a prediction of the t-1 time multi-sensor measurement value; the loss function of the neural network comprises a reconstruction error, a prediction residual and a difference value of a continuous time hidden layer state.

2. The multi-sensor anomaly detection method of claim 1, wherein after the abnormal monitoring on the preprocessing result based on the neural network and the Bayesian filter to obtain the abnormal monitoring result, the method further comprises: interpreting the abnormal monitoring result by means of probability statistics.

3. The multi-sensor anomaly detection method of claim 2, wherein, the interpretation of the abnormal monitoring result by means of probability statistics comprises: calculating an empirical cumulative distribution function of a left tail and a right tail of each sensor in the abnormal monitoring result and a skewness of data of each sensor; calculating an empirical connection function according to the empirical cumulative distribution function of each sensor in the abnormal monitoring result; calculating a probability of a current time point measurement value of a monitoring object in the abnormal monitoring result appearing in a tail part by using the empirical connection function, and multiplying the probabilities of the measurement values of each sensor appearing in the tail part.

4. A multi-sensor anomaly detection apparatus characterized by comprising: The device uses the multi-sensor abnormal detection method according to any one of claims 1 to 3, and comprises: a signal acquisition unit configured to acquire signals of multiple sensors to obtain a to-be-detected signal; A preprocessing unit is configured to preprocess the to-be-detected signal by using a random forest-based multi-dimensional time series data interpolation algorithm and an SR algorithm to obtain a preprocessing result. An anomaly monitoring unit is configured to perform anomaly monitoring on the preprocessing result based on a neural network and a Bayesian filter to obtain an anomaly monitoring result.

5. A computer device, comprising: The computer device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method in any one of claims 1 to 3 when executing the computer program.

6. A storage medium, characterized by The storage medium stores a computer program, and the computer program can implement the method in any one of claims 1 to 3 when executed by a processor.

Images