A method for judging abnormal behavior of equipment based on correlation analysis

Abstract

The present invention discloses a method for judging abnormal behavior of equipment based on correlation analysis, comprising the following steps: using the mapping correlation analysis result to screen out the partition elements in all the elements of abnormal positioning, using the CNN neural network to construct an abnormal behavior micro-motion judgment model based on the partition elements, so as to realize the micro-motion judgment of the abnormal behavior of the equipment before the equipment failure occurs when there is no explicit mapping of the abnormal behavior of the equipment, realize early recognition when the abnormal behavior of the equipment is not manifested, avoid the hysteresis of abnormal recognition, and introduce the hollow space convolution pooling pyramid network into the abnormal behavior micro-motion judgment model to construct a high-sensitivity abnormal behavior micro-motion judgment model. The present invention improves the sensitivity of the abnormal behavior micro-motion judgment model to the micro-motion judgment of abnormal behavior of the equipment, further improves the sensitivity of early judgment when the abnormal behavior of the equipment is not manifested, and the timeliness of abnormal behavior judgment is stronger.

Description

Technical Field

[0001] The present invention relates to the technical field of device behavior recognition, and in particular to a method for judging abnormal device behavior based on correlation analysis. Background Art

[0002] Equipment is an important facility of the functional system. Maintaining the normal operation of the equipment is an important guarantee for the safe operation of the entire functional system. Therefore, it is necessary to troubleshoot and eliminate faults in the functional system to ensure the normal operation of the equipment. However, due to the relatively large scale of the functional system, higher requirements are placed on equipment troubleshooting.

[0003] Prior art 202111495800.1 discloses a distribution network equipment anomaly identification method and system thereof, which can further determine the defect environment operation status information set after obtaining the distribution network equipment operation status information set, so that different operation status information can be targetedly mined and identified through different state description mining subnets to accurately and completely obtain different state description distributions. Furthermore, by combining different state description distributions and calling the equipment defect identification subnet, the defect theme quantification possibility pointed to by the distribution network equipment operation status information can be accurately located, so that the abnormal identification situation corresponding to the distribution network equipment operation status information set can be accurately located based on the defect theme quantification possibility, thereby combining the equipment operation level and the defect environment level for analysis to improve the accuracy and credibility of the distribution network equipment abnormality identification.

[0004] Although the above-mentioned prior art has improved the accuracy of device anomaly identification to a certain extent, it is all identified when the abnormal behavior of the device has already appeared, and there is still a lag in abnormal identification, which will cause system losses. Summary of the invention

[0005] The purpose of the present invention is to provide a method for judging abnormal behavior of equipment based on correlation analysis, so as to solve the technical problem in the prior art that when abnormal behavior of equipment has already appeared, there is still a lag in abnormal identification, which will cause system losses.

[0006] In order to solve the above technical problems, the present invention specifically provides the following technical solutions:

[0007] A method for determining abnormal behavior of a device based on correlation analysis comprises the following steps:

[0008] Step S1, extracting the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event in the equipment fault record log, and extracting the abnormality positioning full elements from the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event using a feature analysis algorithm, wherein the abnormality positioning full elements are the intensified features that can be used to judge the abnormal behavior of the equipment under the condition of explicit mapping of the abnormal behavior of the equipment, and the intensified features are characterized as the features that are highly targeted for judging the abnormal behavior of the equipment under the condition of explicit mapping of the abnormal behavior of the equipment;

[0009] Step S2, mapping correlation analysis is performed on the equipment operating condition data sequence before the equipment abnormal behavior event occurs and the equipment operating condition data sequence after the equipment abnormal behavior event occurs, and the partition element is screened out from all the abnormal location elements using the mapping correlation analysis result, wherein the partition element is a micro-feature that can be used to judge the abnormal behavior of the equipment when there is no explicit mapping of the abnormal behavior of the equipment, and the micro-feature is characterized as a highly targeted feature for judging the abnormal behavior of the equipment when there is no explicit mapping of the abnormal behavior of the equipment;

[0010] Step S3, using a CNN neural network to construct an abnormal behavior micro-motion determination model based on partition elements, so as to realize micro-motion determination of abnormal behavior of the equipment when there is no explicit mapping of abnormal behavior of the equipment before the equipment failure occurs;

[0011] Step S4: Introduce a dilated spatial convolutional pooling pyramid network into the abnormal behavior micromotion determination model to construct a high-sensitivity abnormal behavior micromotion determination model, so as to improve the sensitivity of the abnormal behavior micromotion determination model to the micromotion determination of abnormal behavior of the device.

[0012] As a preferred solution of the present invention, the feature analysis algorithm is used to extract all the abnormality location factors from the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event, including:

[0013] The PCA algorithm is used to quantify the contribution of the equipment condition data sequence during the abnormal behavior of each device, and the contribution of each equipment condition data in each abnormal behavior of each device is obtained;

[0014] The contribution of the equipment operating condition data is compared with the preset contribution threshold, where:

[0015] When the contribution of the equipment condition data in the equipment abnormal behavior event is higher than or equal to the contribution threshold, the corresponding equipment condition data is used as the abnormal location full factor of the equipment abnormal behavior;

[0016] When the contribution of the equipment operating condition data in the equipment abnormal behavior event is lower than the contribution threshold, the corresponding equipment operating condition data is used as the non-abnormal positioning full factor of the equipment abnormal behavior.

[0017] As a preferred solution of the present invention, the mapping correlation analysis of the equipment operating condition data sequence before the equipment abnormal behavior event occurs and the equipment operating condition data sequence after the equipment abnormal behavior event occurs includes:

[0018] Calculate the data correlation of the data sequence of all abnormal positioning elements before the abnormal behavior event of the device and the data sequence of all abnormal positioning elements after the abnormal behavior event of the device, and obtain the mapping correlation of all abnormal positioning elements before and after the abnormal behavior event of the device;

[0019] The quantitative formula of the mapping correlation is:

[0020]

[0021] Where D k The mapping correlation of all elements for locating the kth anomaly, S k,r H is the data value of the kth abnormal location factor at the rth data sequence point before the abnormal behavior event of the equipment occurs. k,r It is the data value of all factors of the kth abnormal location at the rth data sequence point before the abnormal behavior event of the equipment occurs. n is the number of sequence points in the data sequence, and k and r are counting variables.

[0022] As a preferred solution of the present invention, the method of using the mapping correlation analysis result to select the isolation elements from all the elements of abnormal location includes:

[0023] The mapping correlation of each anomaly location full element is compared with the preset correlation threshold, where:

[0024] When the mapping correlation of the abnormal location full element is higher than or equal to the correlation threshold, the abnormal location full element is marked as a partition element;

[0025] If the mapping correlation of all the exception positioning features is lower than the correlation threshold, the all the exception positioning features will be marked as non-isolated features.

[0026] As a preferred solution of the present invention, the abnormal behavior micro-motion determination model is constructed based on the partition elements using the CNN neural network, including:

[0027] The data sequence of each partition element before the abnormal behavior event of the equipment is used as the input item of the CNN neural network, and the abnormal behavior of the equipment corresponding to the abnormal behavior event of the equipment is used as the output item of the CNN neural network;

[0028] Using a CNN neural network to learn and train the input items and output items of the CNN neural network to obtain the abnormal behavior micro-motion determination model;

[0029] The model expression of the abnormal behavior micro-motion determination model is:

[0030] label = CNN(S)

[0031] In the formula, label is the abnormal behavior of the device, S is the data sequence of each partition element before the abnormal behavior event of the device occurs, and CNN is the neural network.

[0032] As a preferred solution of the present invention, the ASPP pooling pyramid network is introduced into the abnormal behavior micro-motion determination model to construct a high-sensitivity abnormal behavior micro-motion determination model, including:

[0033] By selecting ASPP pooling modules with different sampling rates to form an ASPP pooling pyramid module, data feature details are extracted from the data sequence of the partition elements respectively, wherein the data feature detail information extracted by the ASPP pooling modules with different adoption rates has different feature sampling scales in the data dimension;

[0034] The ASPP pooling pyramid module fuses the data feature detail information obtained at different feature sampling scales to improve the acquisition of data feature detail information in the data sequence of the partition elements with high information content;

[0035] The data feature details output by the ASPP pooling pyramid module are used as the input of the abnormal behavior micro-motion determination model to improve the sensitivity of the abnormal behavior micro-motion determination model to the micro-motion determination of abnormal behavior of the equipment;

[0036] The relationship between the receptive field and sampling rate of the ASPP pooling module is:

[0037] R f =2×(r SDR -1)×(v-1)+v;

[0038] Where R f represents the receptive field of a single convolution kernel in the ASPP module; r SDR represents the sampling rate, v represents the size of the convolution kernel;

[0039] The feature extraction operation in the ASPP pooling pyramid module is implemented by a dilated spatial convolutional network;

[0040] The output of the ASPP pooling pyramid module is used as the input of the abnormal behavior micro-motion determination model to obtain the highly sensitive abnormal behavior micro-motion determination model;

[0041] The specific parameters of the high-sensitivity abnormal behavior micro-motion judgment model include the learning rate set to 1×10 -3 , the weight decay coefficient is set to 1×10 -6, the momentum is set to 0.95.

[0042] As a preferred solution of the present invention, all equipment operating conditions of the equipment abnormal behavior event are normalized before mapping correlation analysis, abnormal behavior micro-motion determination model and high-sensitivity abnormal behavior micro-motion determination model construction to avoid dimensional error.

[0043] As a preferred solution of the present invention, the CNN neural network adopts cross entropy as the loss function and uses a stochastic gradient descent optimizer for training to obtain an abnormal behavior micro-motion determination model.

[0044] As a preferred solution of the present invention, the data values ​​at each sequence point in the equipment operating condition data sequence are arranged in sequence according to time sequence.

[0045] As a preferred solution of the present invention, abnormal behavior events of each device are extracted from the device fault record log based on the sample balance principle.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] The present invention uses the mapping correlation analysis results to screen out the partition elements from all the elements of abnormal positioning, and uses the CNN neural network to construct an abnormal behavior micro-motion judgment model based on the partition elements, so as to realize the micro-motion judgment of the abnormal behavior of the equipment before the equipment failure occurs when there is no explicit mapping of the abnormal behavior of the equipment, and realize early recognition when the abnormal behavior of the equipment is not manifested, avoiding the hysteresis of abnormal recognition, and introduces a void space convolution pooling pyramid network into the abnormal behavior micro-motion judgment model to construct a high-sensitivity abnormal behavior micro-motion judgment model, so as to improve the sensitivity of the abnormal behavior micro-motion judgment model to the micro-motion judgment of the abnormal behavior of the equipment, further improve the sensitivity of early judgment when the abnormal behavior of the equipment is not manifested, and make the abnormal behavior judgment more timely. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0049] Figure 1 A flow chart of a method for determining abnormal behavior of a device provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] At present, when the abnormal behavior of the equipment is identified when it has already appeared, there is still a lag in abnormal identification, which will cause system loss. Therefore, the present invention provides a method for judging abnormal behavior of the equipment based on correlation analysis, constructs an abnormal behavior micro-motion judgment model, and realizes early recognition when the abnormal behavior of the equipment has not yet appeared, avoiding the lag in abnormal identification. A void space convolution pooling pyramid network is introduced into the abnormal behavior micro-motion judgment model to construct a high-sensitivity abnormal behavior micro-motion judgment model, thereby improving the judgment sensitivity of the abnormal behavior micro-motion judgment model to the abnormal behavior of the equipment.

[0052] like Figure 1 As shown, the present invention provides a method for determining abnormal behavior of a device based on correlation analysis, comprising the following steps:

[0053] Step S1, extracting the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event in the equipment fault record log, and extracting the abnormality positioning full factor from the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event using a feature analysis algorithm, the abnormality positioning full factor is an intensified feature that can be used to judge the abnormal behavior of the equipment under the condition of explicit mapping of the abnormal behavior of the equipment, and the intensified feature is characterized as a highly targeted feature for judging the abnormal behavior of the equipment under the condition of explicit mapping of the abnormal behavior of the equipment;

[0054] Step S2, mapping correlation analysis is performed on the equipment operating condition data sequence before the equipment abnormal behavior event occurs and the equipment operating condition data sequence after the equipment abnormal behavior event occurs, and the partition element is screened out from all the abnormal positioning elements using the mapping correlation analysis result. The partition element is a micro-feature that can be used to judge the equipment abnormal behavior when there is no explicit mapping of the equipment abnormal behavior. The micro-feature is characterized by a highly targeted feature for judging the equipment abnormal behavior when there is no explicit mapping of the equipment abnormal behavior. The no explicit mapping situation means that the equipment abnormal behavior has not been mapped from the data level to the equipment level and has not been physically or visually manifested during the equipment operation process, that is, the equipment abnormal behavior is in a potential outbreak period and has not yet caused substantial physical damage to the operation of the equipment level;

[0055] Step S3, using a CNN neural network to construct an abnormal behavior micro-motion determination model based on partition elements, so as to realize micro-motion determination of abnormal behavior of the equipment when there is no explicit mapping of abnormal behavior of the equipment before the equipment failure occurs;

[0056] Step S4: Introduce a dilated spatial convolutional pooling pyramid network into the abnormal behavior micromotion determination model to construct a high-sensitivity abnormal behavior micromotion determination model, so as to improve the sensitivity of the abnormal behavior micromotion determination model to the micromotion determination of abnormal behavior of the device.

[0057] The present invention utilizes a feature analysis algorithm to extract all the factors for abnormal location positioning, conducts sufficient information mining on the equipment operating condition data during the occurrence of abnormal equipment behavior, realizes the operating condition data specifically related to determining the abnormal equipment behavior as all the factors for abnormal location positioning, and comprehensively obtains the operating condition characteristics for determining the abnormal equipment behavior.

[0058] The present invention utilizes the correlation of all abnormal positioning elements before and after the abnormal behavior of the device occurs to screen out characteristic elements (i.e., isolation elements) that can be used to specifically determine the abnormal behavior of the device when there is no explicit mapping of the abnormal behavior of the device. The present invention can mine out targeted features that can be used to determine the abnormal behavior of the device when there is no explicit mapping before the abnormal behavior of the device occurs from all abnormal positioning elements, and can achieve early identification of the abnormal behavior of the device before it produces a physical impact. The non-dynamic elements achieve targeted matching with the abnormal behavior of the device before it occurs. The abnormality determination scenario of the device is highly targeted, and the pre-determination reduces the system loss that may be caused by the abnormal behavior of the device, thereby achieving the ability of the subsequent construction of a model to pre-identify the abnormal behavior when there is no explicit mapping of the abnormal behavior of the device. The scenario is highly targeted, and the delayed identification of the abnormal behavior is avoided.

[0059] The present invention uses partition elements to construct an abnormal behavior micro-motion judgment model, which inherits the pertinence of the scenario where there is no explicit mapping between the partition elements and the abnormal behavior of the equipment and the predictability of the abnormal behavior of the equipment. After the predictability is guaranteed, since the equipment operating condition data has an influence before and after the abnormal behavior occurs, such as causal correlation, degree correlation, etc., it is necessary to further mine the data features of the equipment operating condition data before and after the abnormal behavior occurs, so as to obtain data features that capture and locate the abnormal behavior more sensitively, that is, to predict the abnormal behavior of the equipment more quickly and accurately before the abnormal behavior occurs, and to ensure the timeliness of the prediction. Strong timeliness can ensure that the possibility of excluding abnormal behavior is higher. Therefore, the present invention introduces a void space convolution pooling pyramid network in the abnormal behavior micro-motion judgment model. The void space convolution pooling pyramid network has the characteristic of capturing contextual information, and then it can realize the mining of the data features of the equipment operating condition data before and after the abnormal behavior occurs to obtain data features that capture and locate the abnormal behavior more sensitively, improve the sensitivity of the abnormal behavior micro-motion judgment model, and can predict the abnormal behavior of the equipment more quickly and accurately before the abnormal behavior occurs.

[0060] The present invention utilizes partition elements and a void space convolution pooling pyramid network to construct a highly sensitive abnormal behavior micro-motion determination model that has both the predictability of abnormal behavior recognition and the high sensitivity of abnormal behavior recognition.

[0061] The present invention uses the PCA algorithm to extract all the factors for abnormal location, conducts full information mining on the equipment operating condition data during the abnormal behavior of the equipment, realizes the operating condition data related to the determination of the abnormal behavior of the equipment as all the factors for abnormal location, and comprehensively obtains the operating condition characteristics for determining the abnormal behavior of the equipment, as follows:

[0062] The feature analysis algorithm is used to extract all the abnormal location factors from the equipment operating condition data sequence during the abnormal behavior events of each equipment, including:

[0063] The PCA algorithm is used to quantify the contribution of the equipment condition data sequence during the abnormal behavior of each device, and the contribution of each equipment condition data in each abnormal behavior of each device is obtained;

[0064] The contribution of the equipment operating condition data is compared with the preset contribution threshold, where:

[0065] When the contribution of the equipment condition data in the equipment abnormal behavior event is higher than or equal to the contribution threshold, the corresponding equipment condition data is used as the abnormal location full factor of the equipment abnormal behavior;

[0066] When the contribution of the equipment operating condition data in the equipment abnormal behavior event is lower than the contribution threshold, the corresponding equipment operating condition data is used as the non-abnormal positioning full factor of the equipment abnormal behavior.

[0067] The present invention can be used to determine the data features of the abnormal behavior of the device when there is no explicit mapping before the abnormal behavior of the device occurs, that is, to determine the isolation factors, which are obtained by performing correlation analysis on the data series of the abnormal positioning full factors before and after the abnormal behavior of the device occurs, and the correlation analysis is quantified using the data discreteness, wherein the data series of the abnormal positioning full factors before and after the abnormal behavior of the device occurs have a high correlation, indicating that the data series of the abnormal positioning full factors before and after the abnormal behavior of the device occurs have a high degree of dispersion, and the data time series law shows a split feature before and after the abnormal behavior of the device occurs, which indicates that the occurrence of the abnormal behavior of the device has caused a very large change in the abnormal positioning full factors, and the abnormal behavior of the device can be determined by using the abnormal positioning full factors, that is, the abnormal positioning full factors are data features that can be used to determine the abnormal behavior when there is no explicit mapping before the abnormal behavior of the device occurs, and can be determined as isolation factors. The specific method for determining the isolation factors is as follows:

[0068] The equipment operating condition data sequence before the equipment abnormal behavior event occurs and the equipment operating condition data sequence after the equipment abnormal behavior event occurs are mapped and correlated, including:

[0069] Calculate the data correlation of the data sequence of all abnormal positioning elements before the abnormal behavior event of the device and the data sequence of all abnormal positioning elements after the abnormal behavior event of the device, and obtain the mapping correlation of all abnormal positioning elements before and after the abnormal behavior event of the device;

[0070] The quantitative formula for mapping correlation is:

[0071]

[0072] Where D k The mapping correlation of all elements for locating the kth anomaly, S k,r H is the data value of the kth abnormal location factor at the rth data sequence point before the abnormal behavior event of the equipment occurs. k,r It is the data value of all factors of the kth abnormal location at the rth data sequence point before the abnormal behavior event of the equipment occurs. n is the number of sequence points in the data sequence, and k and r are counting variables.

[0073] The mapping correlation analysis results are used to screen out the isolation elements from all the abnormal positioning elements, including:

[0074] The mapping correlation of each anomaly location full element is compared with the preset correlation threshold, where:

[0075] When the mapping correlation of the abnormal location full element is higher than or equal to the correlation threshold, the abnormal location full element is marked as a partition element;

[0076] If the mapping correlation of all the exception positioning features is lower than the correlation threshold, the all the exception positioning features will be marked as non-isolated features.

[0077] The data discreteness is used to perform correlation analysis and quantification. Among them, the data series of the abnormal positioning full elements before and after the abnormal behavior of the equipment is highly correlated, indicating that the data series of the abnormal positioning full elements before and after the abnormal behavior of the equipment is highly dispersed, and the data temporal law shows a fragmented feature before and after the abnormal behavior of the equipment occurs. Therefore, it means that the occurrence of abnormal behavior of the equipment has caused a very large change in the abnormal positioning full elements. The abnormal positioning full elements can be used to judge the abnormal behavior of the equipment.

[0078] Similarly, the data series correlation of the full elements of abnormal positioning before and after the abnormal behavior of the equipment occurs is low, indicating that the data series of the full elements of abnormal positioning before and after the abnormal behavior of the equipment occurs is low in dispersion, and the data temporal regularity shows no difference before and after the abnormal behavior of the equipment occurs. Therefore, it means that the occurrence of abnormal behavior of the equipment has caused the full elements of abnormal positioning to remain basically unchanged, and it is difficult to judge the abnormal behavior of the equipment through the full elements of abnormal positioning.

[0079] The CNN neural network is used to build an abnormal behavior micro-motion judgment model based on the partition elements, including:

[0080] The data sequence of each partition element before the abnormal behavior event of the equipment is used as the input item of the CNN neural network, and the abnormal behavior of the equipment corresponding to the abnormal behavior event of the equipment is used as the output item of the CNN neural network;

[0081] The CNN neural network is used to learn and train the input items and output items of the CNN neural network to obtain an abnormal behavior micro-motion judgment model;

[0082] The model expression of abnormal behavior micro-motion judgment model is:

[0083] label = CNN(S)

[0084] In the formula, label is the abnormal behavior of the device, S is the data sequence of each partition element before the abnormal behavior event of the device occurs, and CNN is the neural network.

[0085] In the abnormal behavior judgment process, since the data features of the partition elements before and after the abnormal behavior of the equipment have detailed features such as time series and correlation, mining detailed data features can improve the sensitivity of the model to abnormal behavior judgment. The partition elements contain a large amount of data feature detail information in the data time series sequence before and after the abnormal behavior of the equipment. This makes it difficult for the detection model constructed with a fixed-size convolution kernel to obtain sufficient data feature detail information and context information before and after the time series, resulting in insufficient recognition sensitivity. Therefore, the ASPP pooling pyramid network is introduced into the abnormal behavior micro-motion judgment model of the present invention to construct a high-sensitivity abnormal behavior micro-motion judgment model to expand the receptive field of the data dimension, mine context information, and use the ASPP pooling pyramid network to extract data features of different scales respectively, and finally perform fusion calculations to obtain richer data information and improve the model detection performance, as follows:

[0086] The ASPP pooling pyramid network is introduced into the abnormal behavior micro-motion judgment model to construct a highly sensitive abnormal behavior micro-motion judgment model, including:

[0087] By selecting ASPP pooling modules with different sampling rates to form an ASPP pooling pyramid module, data feature details are extracted from the data sequence of the partition elements respectively. The data feature details extracted by the ASPP pooling modules with different adoption rates have different feature sampling scales in the data dimension.

[0088] The ASPP pooling pyramid module fuses the data feature details obtained at different feature sampling scales to improve the acquisition of data feature details in the data sequence of partition elements with high information content;

[0089] The data feature details output by the ASPP pooling pyramid module are used as the input of the abnormal behavior micro-motion determination model to improve the sensitivity of the abnormal behavior micro-motion determination model to the micro-motion determination of abnormal behavior of the equipment;

[0090] The relationship between the receptive field and sampling rate of the ASPP pooling module is:

[0091] R f =2×(r SDR -1)×(v-1)+v;

[0092] Where R f represents the receptive field of a single convolution kernel in the ASPP module; r SDR represents the sampling rate, v represents the size of the convolution kernel;

[0093] The feature extraction operation in the ASPP pooling pyramid module is implemented by the dilated spatial convolutional network, where the calculation formula for the value at position (x, y, z) on the jth feature map in the i-th layer of the dilated spatial convolutional network is:

[0094]

[0095] in, is the value at position (x, y, z) on the jth feature map of the i-th layer, H i , W i and Di are the height, width and depth of the convolution kernel of the i-th layer, f is the activation function of the i-th layer, is the weight parameter at the convolution kernel position (h, w, d) connected to the mth feature map of the previous layer, is the value at position (x+h, y+w, z+d) on the mth feature map of the previous layer, b ij is the deviation of the jth feature map of the i-th layer, i, m, j are count variables;

[0096] The output of the ASPP pooling pyramid module is used as the input of the abnormal behavior micro-motion judgment model to obtain a high-sensitivity abnormal behavior micro-motion judgment model;

[0097] The specific parameters of the high-sensitivity abnormal behavior micro-motion judgment model include the learning rate set to 1×10 -3 , the weight decay coefficient is set to 1×10 -6 , the momentum is set to 0.95.

[0098] All equipment operating conditions of equipment abnormal behavior events are normalized before mapping correlation analysis, abnormal behavior micromotion determination model, and high-sensitivity abnormal behavior micromotion determination model construction to avoid dimensional errors.

[0099] The CNN neural network uses cross entropy as the loss function and uses a stochastic gradient descent optimizer for training to obtain an abnormal behavior micro-motion judgment model.

[0100] The data values ​​at each sequence point in the equipment operating condition data sequence are arranged in chronological order.

[0101] Based on the sample balance principle, each device abnormal behavior event is extracted from the device fault record log, that is, the same number of device abnormal behavior events are selected for each device abnormal behavior.

[0102] The present invention uses the mapping correlation analysis results to screen out the partition elements from all the elements of abnormal positioning, and uses the CNN neural network to construct an abnormal behavior micro-motion judgment model based on the partition elements, so as to realize the micro-motion judgment of the abnormal behavior of the equipment before the equipment failure occurs when there is no explicit mapping of the abnormal behavior of the equipment, and realize early recognition when the abnormal behavior of the equipment is not manifested, avoiding the hysteresis of abnormal recognition, and introduces a void space convolution pooling pyramid network into the abnormal behavior micro-motion judgment model to construct a high-sensitivity abnormal behavior micro-motion judgment model, so as to improve the sensitivity of the abnormal behavior micro-motion judgment model to the micro-motion judgment of the abnormal behavior of the equipment, further improve the sensitivity of early judgment when the abnormal behavior of the equipment is not manifested, and make the abnormal behavior judgment more timely.

[0103] The above embodiments are only exemplary embodiments of the present application and are not intended to limit the present application. The protection scope of the present application is defined by the claims. Those skilled in the art may make various modifications or equivalent substitutions to the present application within the essence and protection scope of the present application, and such modifications or equivalent substitutions shall also be deemed to fall within the protection scope of the present application.

Claims

1. A method for judging abnormal behavior of equipment based on correlation analysis, characterized in that: The following steps are involved: Step S1, extracting the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event in the equipment fault record log, and extracting the abnormality positioning full factor from the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event using a feature analysis algorithm, wherein the abnormality positioning full factor is an intensified feature used to judge the abnormal behavior of the equipment under the condition of explicit mapping of the abnormal behavior of the equipment, and the intensified feature is characterized as a highly targeted feature for judging the abnormal behavior of the equipment under the condition of explicit mapping of the abnormal behavior of the equipment; Step S2, mapping correlation analysis is performed on the equipment operating condition data sequence before the equipment abnormal behavior event occurs and the equipment operating condition data sequence after the equipment abnormal behavior event occurs, and the partition element is screened out from all the abnormal location elements using the mapping correlation analysis result, wherein the partition element is a micro-feature used to judge the abnormal behavior of the equipment when there is no explicit mapping of the abnormal behavior of the equipment, and the micro-feature is characterized as a highly targeted feature for judging the abnormal behavior of the equipment when there is no explicit mapping of the abnormal behavior of the equipment; Step S3, using a CNN neural network to construct an abnormal behavior micro-motion determination model based on partition elements, so as to realize micro-motion determination of abnormal behavior of the equipment when there is no explicit mapping of abnormal behavior of the equipment before the equipment failure occurs; Step S4: Introduce a dilated spatial convolutional pooling pyramid network into the abnormal behavior micromotion determination model to construct a high-sensitivity abnormal behavior micromotion determination model, so as to improve the sensitivity of the abnormal behavior micromotion determination model to the micromotion determination of abnormal behavior of the device.

2. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 1, characterized in that: The feature analysis algorithm is used to extract all the abnormal location elements from the equipment operating condition data sequence during the occurrence of each equipment abnormal behavior event, including: The PCA algorithm is used to quantify the contribution of the equipment condition data sequence during the abnormal behavior of each device, and the contribution of each equipment condition data in each abnormal behavior of each device is obtained; The contribution of the equipment operating condition data is compared with the preset contribution threshold, where: When the contribution of the equipment condition data in the equipment abnormal behavior event is higher than or equal to the contribution threshold, the corresponding equipment condition data is used as the abnormal location full factor of the equipment abnormal behavior; When the contribution of the equipment condition data in the equipment abnormal behavior event is lower than the contribution threshold, the corresponding equipment condition data is used as the non-abnormal positioning full factor of the equipment abnormal behavior.

3. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 2, characterized in that: The mapping correlation analysis of the equipment operating condition data sequence before the equipment abnormal behavior event occurs and the equipment operating condition data sequence after the equipment abnormal behavior event occurs includes: Calculate the data correlation of the data sequence of each abnormal positioning full element before the abnormal behavior event of the device occurs and the data sequence of each abnormal positioning full element after the abnormal behavior event of the device occurs, and obtain the mapping correlation of each abnormal positioning full element before and after the abnormal behavior event of the device occurs; The quantitative formula of the mapping correlation is: Where D k The mapping correlation of all elements for locating the kth anomaly, S k,r H is the data value of the kth abnormal location factor at the rth data sequence point before the abnormal behavior event of the equipment occurs. k,r is the data value of the kth abnormal location element at the rth data sequence point after the abnormal behavior event of the equipment occurs, n is the number of sequence points in the data sequence, and k and r are counting variables.

4. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 3 is characterized in that: The method of using the mapping correlation analysis results to select the isolation elements from all the elements of abnormal location includes: The mapping correlation of each anomaly location full element is compared with the preset correlation threshold, where: When the mapping correlation of the abnormal location full element is higher than or equal to the correlation threshold, the abnormal location full element is marked as a partition element; If the mapping correlation of all the exception positioning features is lower than the correlation threshold, the all the exception positioning features will be marked as non-isolated features.

5. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 4, characterized in that: The method of using a CNN neural network to construct an abnormal behavior micro-motion determination model based on partition elements includes: The data sequence of each partition element before the device abnormal behavior event occurs is used as the input item of the CNN neural network, and the device abnormal behavior corresponding to the device abnormal behavior event is used as the output item of the CNN neural network; Using a CNN neural network to learn and train the input items and output items of the CNN neural network to obtain the abnormal behavior micro-motion determination model; The model expression of the abnormal behavior micro-motion determination model is: label = CNN(S) In the formula, label is the abnormal behavior of the device, S is the data sequence of each partition element before the abnormal behavior event of the device occurs, and CNN is the neural network.

6. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 5, characterized in that: The ASPP pooling pyramid network is introduced into the abnormal behavior micro-motion determination model to construct a high-sensitivity abnormal behavior micro-motion determination model, including: By selecting ASPP pooling modules with different sampling rates to form an ASPP pooling pyramid module, data feature details are extracted from the data sequence of the partition elements respectively, wherein the data feature detail information extracted by the ASPP pooling modules with different adoption rates has different feature sampling scales in the data dimension; The ASPP pooling pyramid module fuses the data feature detail information obtained at different feature sampling scales to increase the acquisition of data feature detail information in the data sequence of the partitioning elements with a large amount of information; The data feature details output by the ASPP pooling pyramid module are used as the input of the abnormal behavior micro-motion determination model to improve the sensitivity of the abnormal behavior micro-motion determination model to the micro-motion determination of abnormal behavior of the equipment; The relationship between the receptive field and sampling rate of the ASPP pooling module is: R f =2×(r SDR -1)×(v-1)+v; Where R f Represents the receptive field of a single convolution kernel in the ASPP module; r SDR represents the sampling rate, v represents the size of the convolution kernel; The feature extraction operation in the ASPP pooling pyramid module is implemented by a dilated spatial convolutional network; The output of the ASPP pooling pyramid module is used as the input of the abnormal behavior micro-motion determination model to obtain the highly sensitive abnormal behavior micro-motion determination model; The specific parameters of the high-sensitivity abnormal behavior micro-motion judgment model include the learning rate set to 1×10 -3 , the weight decay coefficient is set to 1×10 -6 , the momentum is set to 0.

95.

7. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 6, characterized in that: All equipment operating conditions of the equipment abnormal behavior event are normalized before mapping correlation analysis, abnormal behavior micro-motion determination model and high-sensitivity abnormal behavior micro-motion determination model are constructed to avoid dimensional errors.

8. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 7, characterized in that: The CNN neural network adopts cross entropy as the loss function and uses a stochastic gradient descent optimizer for training to obtain an abnormal behavior micro-motion determination model.

9. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 8, characterized in that: The data values ​​at each sequence point in the equipment operating condition data sequence are arranged in sequence according to time sequence.

10. The method for determining abnormal behavior of equipment based on correlation analysis according to claim 9, characterized in that: Based on the sample balance principle, abnormal behavior events of each device are extracted from the device fault record log.

Images