A prototype negative sample mixed contrast satellite anomaly detection method and system

Abstract

The application provides a satellite anomaly detection method and system based on prototype negative sample mixed contrast, the method comprising: inputting a satellite telemetry data set into a trained deep neural network model to obtain an anomaly score of the data, determining an anomaly score threshold according to a trained anomaly sample proportion ∈, sorting the anomaly score in ascending order, and determining the first ∈ samples as abnormal; the training process of the deep neural network model comprising: clustering semantically similar samples into the same group to obtain pseudo-labels of the samples, mixing sample features with the distance between an anchor point and a prototype to which a negative sample belongs as a weight to generate difficult negative samples, and guiding neural network learning; and constructing an anomaly score function using sample features and prototype information. The application has the advantages that: the application solves the sampling bias problem of negative samples in the current contrast learning method, obtains more meaningful negative samples, can be practically applied to satellite anomaly detection, and improves the safety of satellite on-orbit operation.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of satellite anomaly detection, and particularly relates to a satellite anomaly detection method and system based on prototype negative sample mixed comparison. BACKGROUND

[0002] Satellites are one of the most complex technical systems, which operate in extremely harsh conditions. Influenced by factors such as insufficient design verification, space extreme environment, damage cumulative effect and dynamic change of satellite state, abnormal events occur from time to time, and serious abnormalities will lead to mission degradation or failure. Satellite telemetry data is the most important basis for ground operation personnel to judge the on-orbit state of the satellite, and data-driven anomaly detection has become an important means to improve the reliability and safe operation of spacecraft in orbit.

[0003] Anomaly detection, also known as outlier detection or novelty detection, refers to the process of identifying data points that do not conform to the expected pattern of operation. Satellite telemetry parameter anomaly detection aims to issue an alarm according to telemetry parameters, and to remind satellite operation personnel to pay more attention to the satellite operation state when an unprecedented pattern appears. Some anomalies of satellites are known, but as time goes on, other new types of anomalies may also be discovered due to changes in the space environment or command sequence. Therefore, this paper formulates the satellite telemetry parameter anomaly detection as a semi-supervised problem.

[0004] With the continuous increase in the number of satellites, the anomaly detection problem of satellites attracts more and more scientists and scholars to conduct research, and a large number of anomaly detection related works have appeared. Recently, most of the researches are two-stage anomaly detection algorithms: (a) use an encoder to get a high-level feature representation of the data, (b) build an anomaly score based on the learned features. The development of deep learning also provides another research direction for anomaly detection, and a series of deep anomaly detection methods are proposed by related scholars, which first map samples to a feature space that is easy to separate, and then separate normal and abnormal samples in the feature space. At the same time, contrastive learning has shown strong feature extraction ability in the field of computer vision and natural language processing. The purpose of contrastive learning is to learn the feature representation of the sample, attract different enhanced samples of the same sample, and repel different samples. Given the strong feature representation ability of contrastive learning, many scholars have proposed a large number of anomaly detection algorithms based on contrastive learning.

[0005] The learning goal of contrastive learning tends to uniformly distribute the feature vectors of samples on the hypersphere of the feature space, resulting in the overlap of normal and abnormal samples in the feature space. Specifically, the problems faced by directly applying contrastive learning to the anomaly detection problem mainly include the following points: first, existing methods are usually based on the single-class assumption, regarding all training samples as a single class, and cannot discover the underlying structure on the entire data distribution. For example, a satellite system (or each subsystem thereof) has several different operating modes, and the actual data samples belong to different semantic categories as the mode changes over time, which does not meet the assumption of single-class classification. Second, the common practice of randomly sampling negative samples from the same small batch as the anchor point may cause the negative samples to be semantically similar to the anchor, facing the problem of sampling bias. At the same time, the hard perception characteristics of the contrastive loss will cause samples closer to the anchor to produce larger gradients, which will further break the local semantic structure, causing semantically similar samples to be more separated. SUMMARY

[0006] The purpose of the present application is to overcome the defect in the prior art that the negative samples face the problem of sampling bias, that is, the negative samples obtained by sampling have the same semantic information as the anchor point, resulting in the difficulty in distinguishing the normal and abnormal samples in the feature space.

[0007] In order to achieve the above purpose, the present application provides a prototype negative sample mixed contrast satellite anomaly detection method, which comprises:

[0008] Inputting a satellite telemetry data set into a trained satellite anomaly detection model to obtain an anomaly score of the data, determining an anomaly score threshold according to the proportion of abnormal samples obtained by training, sorting the anomaly scores in ascending order, and determining the first samples as abnormal.

[0009] The training process of the satellite anomaly detection model comprises:

[0010] Clustering semantically similar samples into the same group to obtain pseudo-labels of the samples, mixing sample features with distances between the anchor point and the prototypes to which the negative samples belong as weights to generate hard negative samples, and guiding the satellite anomaly detection model to learn; and constructing an anomaly score function using sample features and prototype information.

[0011] As an improvement of the above method, the satellite anomaly detection model is a deep neural network model, the input is a satellite telemetry data set, and the output is an anomaly score of each telemetry data in the satellite telemetry data set.

[0012] As an improvement of the above method, the clustering of semantically similar samples into the same group to obtain pseudo-labels of the samples specifically comprises:

[0013] The pseudo-label matrix Q is calculated according to the formula:

[0014] Q = diag(α)P λ diag(β)

[0015] where Q is a K × N pseudo-label matrix, K represents the number of clusters of neural network, N represents the number of data samples; α and β represent two scaling coefficient vectors; λ represents a balance coefficient of convergence speed and proximity to the original optimal transport problem; P represents a K × N joint probability matrix, and the element in the matrix is represented as:

[0016]

[0017] where y represents the value of the label; represents the i-th augmented sample, a ∈ {1, 2} represents the augmented mode index; represents the class probability:

[0018]

[0019] where C is a prototype matrix, and the columns thereof are composed of prototype vectors {c1, c2, …, c K} ; h represents a mapping head composed of a single-layer neural network; f(·) represents an encoder composed of a neural network; is the identification of a composite function, which represents that the two functions before and after are composed into a composite function.

[0020] As an improvement of the above method, the distance between the anchor point and the prototype to which the negative sample belongs is taken as the weight for sample feature mixing to generate a difficult negative sample, and the difficult negative sample h

[0021] difficult negative sample h j is represented as:

[0022]

[0023] where z i represents an anchor point feature vector; z j represents a sample feature vector; ||·||2 represents the 2-norm of a vector; and the weight D(c i ,c j ) in sample mixing is represented as:

[0024]

[0025] where T represents vector transposition; c i and c j represent the i-th and j-th prototype vectors of the prototype matrix C.

[0026] As an improvement of the above method, the neural network learning process is:

[0027] The following two steps are alternately performed to learn:

[0028] Step A1: Given the pseudo label matrix Q, the neural network model is learned by minimizing the loss function in the final training objective function;

[0029] The final training objective function is:

[0030]

[0031] Wherein, represents the calculation result of the loss function; the constant η is used to balance the two loss functions and The value range is 0 to 1;

[0032] represents the contrast loss of the difficult negative sample:

[0033]

[0034] Wherein, the i-th feature vector of the first enhancement method The i-th feature vector of the second enhancement method τ represents the temperature coefficient; represents the indicator function, which takes the value of 1 only when i≠j; h j represents the j-th mapping head composed of a single-layer neural network;

[0035] sim(·) represents the simulation function:

[0036]

[0037]

[0038] represents the consistency loss function:

[0039]

[0040] Wherein, respectively represent the class probability of respectively represent the posterior probability of

[0041] Step A2: Given the current neural network model, calculate the probability matrix P, and then calculate the pseudo label matrix Q using the pseudo label matrix Q formula.

[0042] As an improvement of the above method, the abnormal score function s(x i ) is:

[0043]

[0044] Where, x i Let y represent the i-th input sample. i ∈{1,…,K} represents the pseudo-label of the sample, which is obtained by performing the argmax operation on the pseudo-label matrix Q; f(x i ) is the sample x i Features obtained using neural networks; a class-conditional Gaussian distribution with K covariance matrices of Σ is defined: Where μ c Let be the mean of a multivariate Gaussian distribution with class c∈{1,…,K}. Indicates a Gaussian normal distribution;

[0045] Using all samples in the training set {(x1,y1),…,(x N ,y N Calculate the parameters of the conditional Gaussian distribution:

[0046]

[0047] Where, N c This indicates the number of samples in category c; This indicates that the training samples are used to measure the mean μ. c The estimate; This indicates that the covariance matrix Σ is estimated using the training samples.

[0048] As an improvement to the above method, the proportion of abnormal samples obtained through training is specifically as follows:

[0049] The ratio of the amount of abnormal data input to the total amount of training data during the training of the satellite anomaly detection model is called the anomaly sample ratio ∈.

[0050] This application also provides a satellite anomaly detection system based on prototype negative sample mixed comparison, implemented using the above method, the system comprising:

[0051] The anomaly detection module is used to input satellite telemetry datasets into a trained satellite anomaly detection model, obtain anomaly scores for the data, determine anomaly score thresholds based on the proportion of anomaly samples obtained during training, sort the anomaly scores in ascending order, and classify the top ∈ samples as anomalies; and

[0052] The training module is used to cluster semantically similar samples into the same group to obtain pseudo-labels for the samples. It uses the distance between the anchor point and the prototype to which the negative sample belongs as weight to mix sample features and generate hard negative samples to guide the learning of the satellite anomaly detection model. It uses sample features and prototype information to construct an anomaly score function.

[0053] Compared with the prior art, the advantages of the present invention are:

[0054] The application uses real satellite telemetry parameter data and three public data sets Thyroid, Satellite and Satimage to study the anomaly detection problem of satellite telemetry data, solves the sampling bias problem of negative samples in the current contrast learning method, and obtains more meaningful negative samples. An anomaly detection method based on prototype negative sample hybrid contrast learning is proposed, which effectively improves the anomaly detection result. The research results show that the experimental model has good performance in F1 score in the anomaly detection process in four data sets, and can be practically applied to satellite anomaly detection to improve the safety of satellite on-orbit operation. BRIEF DESCRIPTION OF DRAWINGS

[0055] Figure 1 Fig. 1 shows a prototype-based negative sample hybrid contrast learning framework diagram;

[0056] Figure 2 Fig. 2 shows the F1 value of the method of the application on the Thyroid data set;

[0057] Figure 3 Fig. 3 shows the F1 value of the method of the application on the Micius data set;

[0058] Figure 4 Fig. 4 shows the F1 value of the method of the application on the Satellite data set;

[0059] Figure 5 Fig. 5 shows the F1 value of the method of the application on the Satimage data set F

[0060] Figure 6 Fig. 6 shows a sensitivity analysis result diagram of the number of prototypes;

[0061] Figure 7 Fig. 7 shows a sensitivity analysis result diagram of the batch size.

[0062] wherein, Figures 2-5 Fig. 8 shows the Mean F1 value and the Contamination Ratio value in the method of the application; Figure 6 Fig. 9 shows the Number of Prototypes in the method of the application; Figure 7 Fig. 10 shows the Batch Size in the method of the application. DETAILED DESCRIPTION

[0063] The technical solutions of the application will be described in detail below with reference to the accompanying drawings.

[0064] ​The application provides a satellite anomaly detection method and system based on prototype negative sample mixed comparison, and the method is a two-stage anomaly detection method, namely, a prototype negative sample mixed comparison anomaly detection method (CLPNM-AD). In the representation learning stage, the CLPNM-AD assigns the same pseudo label to the samples with similar semantics by the clustering consistency between different enhanced samples of the same sample. In addition, in order to solve the sampling bias problem, the application selects negative samples from the categories different from the category to which the anchor point belongs, and further proposes a sample mixing strategy based on prototype distance, which obtains difficult negative samples by mixing the feature vectors of the anchor and the selected negative samples and taking the distance between the prototypes of the anchor and the selected negative samples as the weighted weight. When the anchor and the negative sample are mixed, the weight of the negative sample far away from the anchor on the anchor will be greater, which will make the negative samples in all directions around the anchor produce effective gradients, so as to push these samples away from the anchor. In the anomaly detection stage, an anomaly score function based on sample features and pseudo labels is proposed, and the Mahalanobis distance between the sample and the nearest class conditional Gaussian distribution is taken as the anomaly score.

[0065] The satellite anomaly detection method based on prototype negative sample mixed comparison (CLPNM-AD) provided by the application is verified on 3 public data sets and 1 real task data set, and the technical process of the specific detection algorithm is as follows: firstly, real satellite telemetry data and public data sets are obtained, the data is preprocessed, then the research problem is defined and described and the contrastive learning is introduced, finally the framework of the whole algorithm is built, and the detection model is obtained. The real-time data realizes anomaly detection based on the modeling result of the model.

[0066] The anomaly detection problem is formulated as a semi-supervised scenario, and the training data set in the scenario only contains normal data samples. The goal of anomaly detection is to train and build a detector to determine whether a new sample x is abnormal. The anomaly detection first maps the data sample to the feature space by using a neural network, where d is the feature dimension. In the application, the parameters of the neural network f are obtained by constructing a contrastive learning task, and then an anomaly score function is constructed to represent the abnormality degree of the sample x.

[0067] Contrastive learning is a self-supervised learning method, which learns by maximizing the consistency between different enhanced samples of the same data sample. During model training, a batch (Batch) with a size of N is randomly extracted from the training data set, and a contrastive prediction task is defined on the enhanced samples in the batch. Let and , where and are two independent random enhancement processes. According to the classical contrastive learning method proposed by the related scholars, the contrastive loss is defined as:

[0068]

[0069] where sim(u,v)=u T v / ||u||||v||; is the identity of the composite function, indicating that the two functions before and after are composed into a composite function; f(·) is an encoder composed of a neural network; h is a mapping head composed of a single-layer neural network, which is used to further map the sample features and apply the contrastive loss; is an indicator function, which takes the value 1 if and only if i≠j; τ is the temperature coefficient.

[0070] Contrastive learning learns network parameters by maximizing the similarity between different views of the same input and minimizing the similarity between different input views. Views are crucial in contrastive learning, but view generation techniques are domain-specific, such as color warping and geometric transformation as view generation techniques in computer vision, and word masking as a view generation method in natural language processing. Telemetry parameters, as a kind of tabular data, currently have no recognized view generation method. The view generation method proposed in the present application first calculates the empirical edge distribution of each feature value on the entire training data set, then randomly selects a certain proportion of features, and randomly selects values from the empirical edge distribution of the feature to replace the original feature value.

[0071] Build an anomaly detection algorithm framework:

[0072] The present application proposes a two-stage anomaly detection method. In the following step 1, first, samples with similar semantics are clustered into the same group to obtain pseudo-labels of the samples, then the distance between the anchor point and the prototype to which the negative sample belongs is used as a weight to mix the sample features, thereby generating difficult negative samples, and finally the difficult negative samples are used to guide network learning. In the following step 2, the sample features generated in step 1 and the prototype information are used to construct an anomaly score.

[0073] Step 1: Prototype-based negative sample mixing contrastive learning

[0074] The goal of the present application is to cluster samples with similar semantics into the same group in the feature space, and to push samples from different groups as far apart as possible. In order to achieve the above goal, a prototype-based negative sample mixing (CLPNM) contrastive learning method is proposed in this step. As shown in Figure 1As shown, semantic consistency loss promotes related view representations to have the same prototype (cluster center). Furthermore, by using the distance between different prototypes as the weight for sample mixing, anchor points are mixed with sample features from different categories to obtain hard-negative samples. By replacing negative samples with hard-negative samples, contrastive loss can make different categories more separable in the feature space. CLPNM is detailed below.

[0075] 1) Cluster Consistency Self-Labeling

[0076] like Figure 1 As shown, deep neural networks process samples Mapped to feature vectors Right now In the formula, a∈{1,2} is the enhancement mode subscript. Let D be a vector space composed of real vectors. The obtained sample features are then mapped to K clusters, with the cluster centers defined as K trainable prototype vectors {c1, c2, ..., c...}. K Let C be a prototype matrix, whose columns are derived from the prototype vectors {c1, c2, ..., c...}. K In practical engineering, C is implemented as a single-layer linear neural network that maps feature vectors to class score vectors. Then, a softmax operation is used to map the class scores to class probabilities.

[0077]

[0078] Define posterior probability Indicates sample Pseudo-tags. and The cross-entropy loss function defined above is:

[0079]

[0080] In unsupervised problems, the sample labels are unknown, and the optimization of E(p(x) is crucial. (a) ),q(x (a) This will cause q to degenerate, meaning all samples will be assigned an arbitrary single pseudo-label. To address this issue, following the approach of other researchers, a constraint is added to the same batch of data samples, distributing the samples evenly among different pseudo-labels. The optimization objective is formally expressed as:

[0081]

[0082] Constraints mean that each data sample Each of the N data samples is assigned a soft label, and the N data samples are evenly distributed among the K prototypes.

[0083] The optimization objective in the above equation is a linear sum assignment problem. To solve this problem, we define two K x N joint probability matrices P and Q, whose elements are denoted as:

[0084]

[0085] The average partition constraint is imposed on matrix Q, which makes Q a transportation polytope:

[0086]

[0087] where 1 N and 1 K are vectors with all elements being 1, and r and c are the projections of matrix Q on its rows and columns. The imposed average constraint means that:

[0088]

[0089] Then, the above initial optimization objective is rewritten as:

[0090]

[0091] where <·> denotes the dot product of two matrices, and log is computed element-wise.

[0092] The Sinkhorn-Knopp algorithm is adopted in this application to solve the above linear sum assignment problem. This algorithm converts the optimization objective into:

[0093]

[0094] where KL is the Kullback-Leibler divergence, and rc T can be regarded as a K x N probability matrix. The benefit of introducing the regularization term is that the minimum of the optimization objective in the above equation can be represented as:

[0095] Q = diag (a) P λ diag (b) (10)

[0096] where a and b are two scaling coefficient vectors, and l is a balance coefficient between the convergence speed and the closeness to the original linear sum assignment problem. In the problem scenario of this application, since the main concern is the final clustering quality and the representation learning result, a fixed l is adopted.

[0097] Next, the pseudo-label matrix Q is adopted to learn the neural network parameters. To encourage the clustering consistency of two augmented samples and , the is adopted as the sample and vice versa. The consistency loss function is defined as:

[0098]

[0099] where N denotes the batch size and K denotes the number of prototypes.

[0100] 2) Negative sample mixing contrast

[0101] The pseudo-label matrix Q can be used for learning the consistency of clustering on one hand, and on the other hand, Q can be used to solve the sampling bias problem and generate difficult negative samples to guide the learning of the neural network. In the previous step, the matrix Q represents the soft label of the sample, and in this step, the hard label of the sample is needed to represent the semantic category of the data sample. A simple softmax calculation is performed on the matrix Q to obtain the hard label of the sample.

[0102] The feature vector of the anchor point is mixed with the sample vectors of different prototypes in the batch to obtain the feature vector of the difficult negative sample. The weight of the sample mixing is determined by the distance between the prototypes to which the sample belongs. The distance between two prototypes is defined as:

[0103]

[0104] where c i and c j are two prototype vectors of the prototype matrix C; ||·||2 denotes the 2-norm of the vector. Figure 1

[0105] For the anchor point feature vector z i and the sample feature vector z j , the mixed sample is represented as:

[0106]

[0107] The contrast loss using difficult negative samples is represented as:

[0108]

[0109] The final training objective is represented as:

[0110]

[0111] where the constant η is used to balance the two loss functions, and its value range is 0 to 1.

[0112] The core of the algorithm is that the neural network model and the pseudo-label matrix Q obtained by solving the optimal transport problem are alternately executed for 100 rounds of the following two steps to learn:

[0113] ​Step 1: Representation Learning. Given the pseudo-label matrix Q, minimize the loss function in the final training objective (15) to build the model. study.

[0114] Step 2: Label self-assignment. Given the current model... Calculate the log probability matrix P, and then calculate the pseudo-label matrix Q using formula (10):

[0115]

[0116] In the formula: α y Let β be the y-th subscript value of vector α; i Let be the i-th subscript value of vector β; [P λ β] y This represents the process of calculating each element of matrix P to the power of λ, then multiplying it by vector β and taking the y-th index; [α] T P λ ] i This indicates that after the vector α is transposed and multiplied by matrix P, the i-th index value is taken.

[0117] The model in this application is a deep neural network model, and the final output is the anomaly score of satellite telemetry data.

[0118] Step 2: Abnormal Score Function

[0119] This paper uses sample features and prototypes to quantify the degree of anomaly of samples, thereby classifying samples as normal or anomalous. Related research indicates that the mapping head focuses excessively on the proxy task, and the features it extracts lose information useful for downstream tasks. Therefore, this application is based on encoder f... θ The obtained features are used to construct an anomaly score function.

[0120] Let x i Indicates the input sample, y i ∈{1,…,K} represents the pseudo-label of the sample, which is obtained by performing an argmax operation on the pseudo-label matrix Q. Based on relevant research, it is assumed that the samples in each cluster obtained by clustering follow a class-conditional multivariate Gaussian distribution. Specifically, a class-conditional Gaussian distribution with K covariance matrices Σ is defined: In the formula μ c Let be the mean of a multivariate Gaussian distribution with class c∈{1,…,K}. f(x) represents a Gaussian normal distribution; i ) is the sample x i Features obtained using a neural network f. We use all samples {(x1,y1),…,(x...} from the training set. N ,y N Calculate the parameters of the conditional Gaussian distribution:

[0121]

[0122] where N is the number of samples in the training set; N c is the number of samples in class c; is the estimate of the mean μ c using the training samples; is the estimate of the covariance matrix Σ using the training samples; y i denotes the pseudo-label of sample x i .

[0123] Based on the above class-conditional multivariate Gaussian distribution, we use the distance between the sample x and the nearest class-conditional Gaussian distribution as the anomaly score, and the anomaly score function s(x) is defined as:

[0124]

[0125] Finally, according to the proportion of abnormal samples ∈ in the data set input during model training, the anomaly score threshold is determined, that is, the anomaly scores are sorted in ascending order, and the first ∈ samples are determined as abnormal.

[0126] The ratio of the amount of abnormal data input during training to the total amount of training data is the proportion of abnormal samples ∈.

[0127] Next, we use three public benchmark data sets Thyroid, Satellite, and Satimage, and one data set Micius constructed from real telemetry parameters of the quantum science experiment satellite to verify the effectiveness of the method of the present application.

[0128] Thyroid: This data set comes from the thyroid disease classification data set of the OODS anomaly detection data warehouse, including 6 continuous variables. There are a total of 3 classes in the original data set, one of which is taken as the abnormal class, and the other two classes are taken as the normal class.

[0129] Micius: This data set comes from the telemetry parameter data of the quantum science experiment satellite from January 2017 to February 2018. 23 parameters related to the working state of the satellite are selected. This data set contains 4 operating modes, mode 4 as a rare mode, which is taken as the abnormal class, and the other modes are taken as the normal class.

[0130] Satellite: This data set comes from the Landsat satellite of the United States and is a multi-classification data set in the UCI machine learning warehouse, including training data and test data. Class 2, 4 and 5 in this data set are taken as abnormal classes, and other classes are taken as normal classes.

[0131] Satimage: The data comes from the Landsat satellite of the United States, which is a multi-classification data set in the UCI machine learning warehouse. 71 abnormal points in class 2 are regarded as anomalies, and other data are regarded as normal data.

[0132] (1) Data source

[0133] Table 1 Dataset statistics

[0134]

[0135] (2) Introduction of benchmark algorithm

[0136] OC-SVM: One-Class Support Vector Machine (OC-SVM) is a kernel-based anomaly detection method, which uses kernel function to map normal data to high-dimensional space and construct decision boundary to determine anomaly. In this paper, radial basis function is used as kernel function.

[0137] LOF: Local Outlier Factor (LOF) is an unsupervised anomaly detection algorithm, which generates an anomaly score according to the distance of the surrounding neighbor samples.

[0138] DAGMM: Deep Autoencoding Gaussian Mixture Model (DAGMM) is a deep autoencoder-based anomaly detection method, which includes a compression network based on autoencoder and an estimation network based on Gaussian mixture. The compression network uses deep autoencoder to extract sample features, and the estimation network calculates the anomaly score according to the features and the reconstruction error of the autoencoder.

[0139] Deep SVDD: Deep Support Vector Data Description (Deep SVDD) is a deep neural network-based anomaly detection method, which learns a hypersphere from normal data, and uses the hypersphere as the decision boundary to determine anomalies.

[0140] GOAD: A self-supervised anomaly detection method, which trains a set of multi-classification proxy tasks, and calculates the anomaly score according to the classifier results.

[0141] NeuTraL AD: An end-to-end anomaly detection method based on contrastive learning, which uses a set of learnable transformation functions on the training data, and then learns the network parameters by imposing distance constraints on the transformed samples.

[0142] (3) Experimental performance index

[0143] The experimental setup used in the experiment is: the mean and standard deviation of the evaluation index of 20 runs are used as the measure of the performance of the anomaly detection; in each experiment, 50% of the normal data samples are randomly sampled as the training set, and the remaining 50% of the samples and all the abnormal samples are used as the test set; the abnormal threshold is determined according to the proportion of abnormal samples in the data set, that is, the abnormal scores are sorted in ascending order, and the first ρ samples are determined as abnormal. In the experiment, the abnormal class is taken as the positive example, and the F1 value is defined based on this: In the formula G represents the real abnormal data set in the data set; R represents the abnormal data set determined by the anomaly detection algorithm.

[0144] (4) Algorithm effectiveness

[0145] We compare with 6 baseline algorithms on 4 benchmark datasets to evaluate the effectiveness of the algorithm.

[0146] Table 2 Average F1 value and standard deviation of CIPNM-AD and baseline methods

[0147]

[0148] Table 2 shows the average F1 value and its standard deviation of CIPNM-AD and all baseline algorithms. CIPNM-AD significantly outperforms the baseline algorithms on Thyroid and Micius datasets, improving the current best algorithm DAGMM and LOF by 11.5% and 11.0%, respectively. On Satellite and Satimage datasets, our proposed method improves the sub-optimal methods DAGMM and GOAD by 3.5% and 0.8%, respectively. It is surprising that two traditional baseline algorithms OC-SVM and LOF perform even better than some deep methods on Micius and Satellite datasets. The traditional method LOF achieves sub-optimal results on the Micius dataset, because most deep methods ignore the preservation of local structure information in the data when extracting features, while LOF mainly relies on local density information for anomaly detection. Fortunately, the method of the present application preserves the local structure information of the data through the prototype information of the data, which enables the method of the present application to achieve good results on the Micius dataset. Therefore, in the anomaly detection task, the characteristics of the data and the type of anomaly should be paid attention to.

[0149] To further verify the superiority of the method proposed in this application, Wilcoxon rank-sum test is used to evaluate the performance of CLPNM-AD on the four benchmark datasets. In order to compare our method with each benchmark algorithm, we evaluate the null hypothesis H0 and the alternative hypothesis H1 of our method and each benchmark method: H0: A ≈ B; H1: A > B, where A represents the F1 of the method proposed in this application on a certain dataset, and B represents the F1 of a certain benchmark method on the dataset. The p-value of each test pair is calculated, and then tested at the significant level of p = 0.05.

[0150] Table 3 p-value of Wilcoxon rank-sum test on F1

[0151]

[0152] As shown in Table 3, except for no significant difference compared with GOAD algorithm on Satimage dataset, in all other cases, this application has enough significant to reject the null hypothesis and accept the alternative hypothesis, that is, the CLPNM-AD method is significantly better than the benchmark algorithm.

[0153] (5) Algorithm robustness

[0154] In practical applications, the training set often contains noise or abnormal data. In order to verify the sensitivity of the algorithm to the contaminated training data, different contaminated datasets are used to verify the algorithm. In each experiment, 50% of the normal samples are randomly sampled from the normal data, and c% of the abnormal samples are randomly sampled from the abnormal data, and the two are mixed to form the training set.

[0155] Figures 2-5 The average F1 obtained from 20 rounds of experiments is shown as a function of the pollution rate. In most cases, contaminated data has a negative impact on anomaly detection. When the pollution rate c increases from 1% to 5%, the average F1 value of the CLPNM-AD algorithm has a small decline on all datasets. The CLPNM-AD algorithm can still maintain high detection accuracy when the pollution rate is 5%, and it is better than the benchmark algorithm on all contaminated datasets. From the experimental results, it can be seen that the CLPNM-AD algorithm has good noise robustness. At the same time, it can also be seen that the DAGMM algorithm is sensitive to the pollution rate of the training data, especially on the Micius and Satellite datasets. Therefore, in order to achieve better anomaly detection effect, try to use high-quality training data when training the model.

[0156] (6) Ablation experiment

[0157] This experiment analyzes the original InfoNCE loss Clustering consistency loss and the impact of the negative sample synthesis strategy on the algorithm on different datasets.

[0158] Table 4 Ablation experiment of different optimization modules

[0159]

[0160] As shown in Table 4, when and are applied alone, has better effect than This is because maintains the consistency of positive samples in the feature space and pushes the negative samples away as far as possible, obtaining a semantic structure more conducive to anomaly detection. At the same time, applying and the difficult negative sample synthesis strategy, our model achieves the optimal anomaly detection effect, which shows that the prototype-based negative sample synthesis strategy can eliminate sampling bias and further improve the effect of anomaly detection.

[0161] (7) Parameter sensitivity analysis

[0162] This section analyzes the influence of the number of prototypes K and the batch size N on the performance of the model.

[0163] Figure 6 The performance of the method of the present application is shown in the process of increasing the number of prototypes K from 4 to 24. It is observed from the figure that the method of the present application has good robustness to the number of prototypes on the Micius, Satellite and Satimage datasets. On the Thyroid dataset, the method of the present application is obviously affected by the number of prototypes, and the performance of the method decreases obviously as the number of prototypes K increases from 4 to 24. It is speculated that the model is not robust enough to the number of prototypes on the Thyroid dataset because the dataset itself has a relatively obvious semantic category, and the number of semantic categories is close to 4. Excessive increase of the number of prototypes will break this semantic structure, causing the performance of the method to decrease.

[0164] Figure 7 The anomaly detection effect of the method of the present application under different batches is shown. As can be seen from the figure, the method of the present application is not sensitive to the batch size on the Micius, Satellite and Satimage datasets, and is relatively sensitive to the batch size on the Thyroid dataset. The increase of the batch size can improve the detection effect of the algorithm. In most cases, the method of the present application can provide sufficient negative information for representation learning by synthesizing difficult negative samples, and does not need a large number of batches to provide additional negative information.

[0165] The application proposes a prototype-based negative mixed contrast learning anomaly detection method (CLPNM-AD). CLPNM-AD groups samples with similar semantics together to obtain pseudo labels of the samples. In addition, CLPNM-AD designs a negative mixing strategy, taking the distance between prototypes as the weight, mixing the feature vectors of anchor points with the feature vectors of samples in clusters other than the cluster where the anchor points are located, to reduce sampling bias and obtain difficult negative vectors. Finally, CLPNM-AD displays the anomaly score according to the Mahalanobis distance between the feature vector of the sample and the nearest prototype conditional Gaussian distribution. The comprehensive experiments on the actual task data set and three benchmark data sets prove the performance of the proposed method.

[0166] The application also provides a satellite anomaly detection system based on prototype negative sample mixing contrast, which is realized based on the above method. The system comprises:

[0167] An anomaly detection module is configured to input a satellite telemetry data set into a trained deep neural network model to obtain an anomaly score of the data, determine an anomaly score threshold according to the proportion of anomaly samples in the data set, sort the anomaly scores in ascending order, and determine the samples in the front as anomalies.

[0168] A training module is configured to cluster samples with similar semantics into the same group to obtain pseudo labels of the samples, mix sample features with the distance between the anchor points and the prototypes to which the negative samples belong as the weight, generate difficult negative samples, and guide neural network learning; and construct an anomaly score function using sample features and prototype information.

[0169] The application also provides a computer device, which comprises at least one processor, a memory, at least one network interface and a user interface. The various components in the device are coupled together through a bus system. It can be understood that the bus system is used to realize the connection and communication between the components. In addition to the data bus, the bus system also includes a power bus, a control bus and a status signal bus.

[0170] The user interface can include a display, a keyboard or a pointing device. For example, a mouse, a trackball, a touchpad or a touch screen, etc.

[0171] It can be appreciated that the memory in the embodiments disclosed in the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (Read-Only Memory, ROM), a programmable read-only memory (Programmable ROM, PROM), an erasable programmable read-only memory (Erasable PROM, EPROM), an electrically erasable programmable read-only memory (Electrically EPROM, EEPROM) or a flash memory. The volatile memory can be a random access memory (Random Access Memory, RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (Static RAM, SRAM), dynamic random access memory (Dynamic RAM, DRAM), synchronous dynamic random access memory (Synchronous DRAM, SDRAM), double data rate synchronous dynamic random access memory (Double Data Rate SDRAM, DDR SDRAM), enhanced synchronous dynamic random access memory (Enhanced SDRAM, ESDRAM), synchronous link dynamic random access memory (Synchlink DRAM, SLDRAM) and direct memory bus random access memory (Direct Rambus RAM, DRRAM). The memory described herein is intended to include but not limited to these and any other suitable types of memory.

[0172] In some embodiments, the memory stores elements, executable modules or data structures, or a subset thereof, or an extended set thereof: an operating system and an application program.

[0173] Among them, the operating system includes various system programs, such as a framework layer, a core library layer, a driver layer, etc., for implementing various basic services and processing hardware-based tasks. The application program includes various application programs, such as a media player (Media Player), a browser (Browser), etc., for implementing various application services. The program for implementing the method of the embodiments of the present disclosure can be included in the application program.

[0174] In the above-described embodiments, the processor can be configured to perform the steps of the above-described method by invoking the program or instructions stored in the memory, in particular, the program or instructions stored in the application program.

[0175] performing the steps of the above-described method.

[0176] The method can be applied to a processor or implemented by the processor. The processor can be an integrated circuit chip having a signal processing capability. In implementation, the steps of the method can be completed by an integrated logic circuit of hardware in the processor or by an instruction in the form of software. The processor can be a general-purpose processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The methods disclosed above can be implemented or executed by the processor. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed above can be directly embodied as a hardware code executed by the processor or a combination of hardware and software modules in the processor. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, or other mature storage media in the art. The storage media is located in the storage memory, and the processor reads information in the storage memory and combines the hardware to complete the steps of the method.

[0177] It can be understood that the embodiments described herein can be implemented in hardware, software, firmware, middleware, microcode, or a combination thereof. For a hardware implementation, the processing units can be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSP Devices), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, micro-controllers, microprocessors, other electronic units designed to perform the functions described herein, or a combination thereof.

[0178] For a software implementation, the techniques can be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. The software codes can be stored in memory and executed by processors. The memory can be implemented within the processor or external to the processor.

[0179] The application further provides a nonvolatile storage medium for storing the computer program. When the computer program is executed by a processor, each step in the above method embodiment can be implemented.

[0180] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application but not limit the present application. Although the present application is described in detail with reference to the embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or replaced equivalently without departing from the spirit and scope of the present application, and all of them should be covered in the scope of the claims of the present application.

Claims

1. A satellite anomaly detection method of prototype-negative sample mixed contrast, the method comprising: inputting a satellite telemetry data set into a trained satellite anomaly detection model to obtain an anomaly score of the data, determining an anomaly score threshold according to a trained anomaly sample proportion ∈, sorting the anomaly scores in ascending order, and determining the first ∈ samples as abnormal; the training process of the satellite anomaly detection model comprises: clustering semantically similar samples into the same group to obtain pseudo-labels of the samples, mixing sample features with the distance between anchor points and prototypes to which negative samples belong as weights to generate difficult negative samples, and guiding the satellite anomaly detection model to learn; and constructing an anomaly score function using sample features and prototype information; the pseudo-labels of the samples clustered into the same group are specifically: the pseudo-label matrix Q is formulaed as: Q = diag(a)P λ diag(β) wherein Q is a pseudo-label matrix of K×N, K represents the number of neural network clusters, N represents the number of data samples; α and β represent two scaling coefficient vectors; λ represents a balance coefficient of convergence speed and proximity to the original optimal transport problem; P represents a joint probability matrix of K×N, and the elements in the matrix are represented as: where y represents the value of the label; represents the i-th augmented sample, a e {1, 2} represents the index of the augmentation method; represents the class probability: Wherein, C is a prototype matrix, whose columns are composed of prototype vectors {c1, c2, …, c K} constitute; h represents a mapping head composed of a single-layer neural network; f(·) represents an encoder composed of a neural network; is the identity of a composite function, indicating that the two functions before and after are composed into a composite function.

2. The prototype negative sample hybrid contrast satellite anomaly detection method according to claim 1, characterized in that, the satellite anomaly detection model is a deep neural network model, the input is a satellite telemetry data set, and the output is an anomaly score of each telemetry data in the satellite telemetry data set.

3. The prototype negative sample hybrid contrast satellite anomaly detection method according to claim 1, characterized in that, the distance between the anchor points and the prototypes to which the negative samples belong is used as the weight to mix the sample features to generate difficult negative samples, and the specific process is: hard negative samples h j is expressed as: where z i denotes the anchor feature vector; z j denotes the sample feature vector; || · ||2denotes the 2-norm of a vector; and the weight D(c i ,c j ) when mixing samples is given by: where T denotes vector transpose; c i and c j denotes the i-th and j-th prototype vector of the prototype matrix C.

4. The prototype negative sample hybrid contrast satellite anomaly detection method according to claim 3, characterized in that, the neural network learning process is: the following two steps are alternately performed for a set number of rounds to learn: step A1: given the pseudo-label matrix Q, the loss function in the final training target formula is minimized to learn the neural network model; the final training target formula is: wherein, represents the loss function calculation result; the constant η is used to balance the two loss functions and whose value range is 0 to 1; contrastive loss that represents hard negative samples: Wherein the i-th feature vector of the first enhancement mode The i-th feature vector of the second enhancement mode τ represents the temperature coefficient; Indicates the indicator function, which takes the value 1 if and only if i≠j;h j Indicates the j-th mapping head composed of a single-layer neural network; sim(·) represents a simulation function: represents a consistency loss function: wherein, respectively represent the class probabilities; respectively represent the posterior probabilities; step A2: given the current neural network model, the probability matrix P is calculated, and then the pseudo-label matrix Q is calculated using the pseudo-label matrix Q formula.

5. The prototype negative sample hybrid contrast satellite anomaly detection method according to claim 1, wherein, The abnormal score function s(x i ) is: Where, x i Let y represent the i-th input sample. i ∈{1,…,K} represents the pseudo-label of the sample, which is obtained by performing the argmax operation on the pseudo-label matrix Q; f(x i ) is the sample x i Features obtained using neural networks; a class-conditional Gaussian distribution with K covariance matrices of Σ is defined: Where μ c Let be the mean of a multivariate Gaussian distribution with class c∈{1,…,K}. Indicates a Gaussian normal distribution; The parameters of the conditional Gaussian distribution are computed using all samples {(x1, y1),..., (x N , y N )} in the training set: where N c denotes the number of samples in class c; denotes the estimate of the mean μ c using the training samples; denotes the estimate of the covariance matrix Σ using the training samples.

6. The prototype negative sample hybrid contrast satellite anomaly detection method according to claim 1, wherein, the trained anomaly sample proportion ∈ is specifically: the ratio of the amount of abnormal data input during the training of the satellite anomaly detection model to the total amount of training data is the anomaly sample proportion ∈.

7. A prototype negative sample mixed contrast satellite anomaly detection system, based on any of claims 1-6, characterized in that, the system comprises: an anomaly detection module for inputting a satellite telemetry data set into a trained satellite anomaly detection model to obtain an anomaly score of the data, determining an anomaly score threshold according to a trained anomaly sample proportion ∈, sorting the anomaly scores in ascending order, and determining the first ∈ samples as abnormal; and a training module for clustering semantically similar samples into the same group to obtain pseudo-labels of the samples, mixing sample features with the distance between anchor points and prototypes to which negative samples belong as weights to generate difficult negative samples, and guiding the satellite anomaly detection model to learn; and constructing an anomaly score function using sample features and prototype information.

Images