Anomaly Detection Method Based on Unbalanced Adversarial Training Convolutional Autoencoder

Abstract

The present invention discloses an anomaly detection method based on an unbalanced adversarial training convolutional autoencoder, which comprises the following steps: 1) collecting original time series data generated by N sensors in a smart city application and aggregating the data as test data; 2) dividing the test data according to the time when the data is generated, and treating the time series data generated by each sensor at the same sampling moment as an N-dimensional test data sample; 3) sorting the test data samples by time and segmenting the sorted test data samples using a sliding window to obtain L time subsequences; 4) calculating the similarity of each pair of sensor data in each time subsequence to form a similarity matrix; 5) inputting the similarity matrix into a convolutional autoencoder model UGA-CAE based on unbalanced adversarial training to calculate the anomaly score of each time subsequence; if the anomaly score exceeds a set threshold, it is considered that each sensor data in the corresponding time subsequence is anomaly data.

Description

Technical Field

[0001] The present invention belongs to the field of artificial intelligence technology and relates to an anomaly detection method, in particular to an anomaly detection method based on unbalanced adversarial training convolutional autoencoder. Background Art

[0002] Anomaly detection is widely used in smart cities, playing a key role in predicting and managing the health of public transportation and facilities. The widespread use of sensing devices enables the collection and application of multi-dimensional sensory data to detect and analyze potential anomalies and respond quickly to identified anomalies. Anomaly detection technology can help city managers implement measures to improve transportation efficiency, facility safety, and energy efficiency, ultimately achieving sustainable development in smart cities.

[0003] Existing technologies primarily rely on offline batch data processing methods, utilizing popular deep learning models such as recurrent neural networks (RNNs), long short-term memory networks (LSTMs), and autoencoders. However, smart cities require efficient and online solutions, and these offline approaches are insufficient for practical applications, as people expect efficient and online solutions. Furthermore, due to the large number of existing sensors and the high volume of sensor data flow, the volume of data required for recording and analysis is enormous. Compared to normal operation, abnormalities occur less frequently, resulting in a low proportion of abnormal data in the overall data, making it sparse and non-significant. Summary of the Invention

[0004] In response to the problems existing in the prior art, the purpose of the present invention is to provide an anomaly detection method based on unbalanced adversarial training convolutional autoencoders, which has the characteristics of high efficiency, more distinguishability and continuity in anomaly detection in public transportation and facilities.

[0005] To achieve the above objectives, this paper first proposes a new anomaly detection framework based on edge-assisted Internet of Things (IoTs). The framework allows regular data collection from sensors and continuous anomaly detection at edge nodes.

[0006] Building on this foundation, the present invention further designs a novel and efficient unsupervised deep learning model, called the Unbalanced Generative Adversary (UGA-CAE) model. UGA-CAE combines convolutional autoencoders (CAE) with unbalanced generative adversary (UGA) training to achieve a balance between anomaly detection accuracy and resource consumption. The CAE learns and reconstructs associations between sensory devices for anomaly detection, while the adversarial training process introduces additional lightweight components to enhance the model's discriminability.

[0007] The present invention also introduces an adaptive strategy for continuous anomaly detection to reduce overall resource consumption. Based on theoretical analysis and evaluation on several real-world datasets, the proposed framework can discover potential correlation features between multi-dimensional perception data and effectively detect anomalies in public transportation and facilities in smart cities.

[0008] The technical solution of the present invention is:

[0009] An anomaly detection method based on unbalanced adversarial training convolutional autoencoder, the steps of which include:

[0010] 1) Collect the original time series data generated by N sensors in smart city applications and aggregate them as the data to be tested;

[0011] 2) Dividing the data to be measured according to the time when the data was generated, and treating the original time series data generated by each sensor at the same sampling moment as an N-dimensional data sample to be measured;

[0012] 3) sorting the data samples to be tested by time and segmenting the sorted data samples to be tested using a sliding window to obtain L time subsequences; each time subsequence includes multiple data samples to be tested;

[0013] 4) calculating the similarity between each pair of sensor data in each time subsequence to form a similarity matrix;

[0014] 5) The similarity matrix is ​​input into the convolutional autoencoder model UGA-CAE based on unbalanced adversarial training to calculate the anomaly score of each time subsequence; if the anomaly score of a time subsequence exceeds the set threshold, it is considered that all sensor data in the time subsequence are abnormal data, and the label of the time window corresponding to the time subsequence is added to the anomaly detection result set.

[0015] Furthermore, the convolutional autoencoder model UGA-CAE includes an encoder E, a main decoder D1 and a support decoder D2; the encoder E is used to map the input similarity matrix M into the feature space to obtain the similarity matrix M mid And input them into the main decoder D1 and the support decoder D2 respectively; the main decoder D1 is based on the input similarity matrix M mid Reconstruct the similarity matrix M to obtain The support decoder D2 according to D1 (M mid )The result after passing through the encoder E again is E(D1(M mid ))Reconstruction Then calculate the similarity matrix M and The sum of the differences is taken as the abnormality score of the time subsequence corresponding to the similarity matrix M.

[0016] Furthermore, the anomaly score of the time subsequence corresponding to the similarity matrix M is

[0017] Furthermore, the method for training the convolutional autoencoder model UGA-CAE is as follows: in the first stage, the encoder E maps the input similarity matrix M to the feature space to obtain the similarity matrix M mid And input them into the main decoder D1 and the support decoder D2 respectively; the main decoder D1 is based on the input similarity matrix M mid Reconstruct the similarity matrix M to obtain the first similarity matrix D1(M mid ); The support decoder D2 is based on the similarity matrix M of the input mid Reconstruct the similarity matrix M to obtain the second similarity matrix D2 (M mid ); In the second stage, the main decoder D1 is used as a generator and the support decoder D2 is used as a discriminator. The generator converts the first similarity matrix D1 (M mid ) is sent to the encoder E, and the encoder E converts the input D1(M mid ) is mapped to the feature space to obtain the similarity matrix E(D1(M mid )) and input it to the discriminator; the discriminator converts the similarity matrix E(D1(M mid )) and M mid As the input, reconstruct the similarity matrix M to obtain the third similarity matrix D2(D1(M mid )); Then based on minimizing the loss function Optimize and update the parameters of the main decoder D1 and the supporting decoder D2; where α>β,

[0018] Furthermore, the encoder E includes a first convolutional neural network of size 64×64, a second convolutional neural network of size 32×32, a third convolutional neural network of size 16×16, a fourth convolutional neural network of size 8×8 and a fifth convolutional neural network of size 4×4, which process the input data in sequence, and the convolution kernel size of each convolutional neural network is 3×3; the main decoder D1 is a deconvolution network symmetrical to the encoder E, and each deconvolution layer in the deconvolution network contains a batch normalization BN layer and uses the ReLU function as its activation function; the support decoder D2 includes a first deconvolutional neural network of size 64×64, a second deconvolutional neural network of size 32×32 and a third deconvolutional neural network of size 8×8, which process the input data in sequence, and the convolution kernel size of each deconvolution neural network is 3×3, and each deconvolution neural network contains a batch normalization BN layer and uses the ReLU function as its activation function.

[0019] Furthermore, the time subsequence corresponding to the lth sliding window is The data of the same sensor in the time subsequence corresponding to the lth sliding window is formed into a vector, and then the similarity between any two vectors is calculated to form a similarity matrix.

[0020] Furthermore, the original time series data generated by the sensor is filtered, and the filtered data is aligned according to the set sliding window and then aggregated to obtain the data to be tested; the data filtering method is: detecting whether there is a single point anomaly in the original time series data generated by the sensor. If a single point anomaly occurs, the average value of the adjacent recorded data is used as the correction value of the single point anomaly.

[0021] A server, characterized in that it includes a memory and a processor, the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing each step in the above method.

[0022] A computer-readable storage medium stores a computer program thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0023] The advantages of the present invention are as follows:

[0024] First, the efficient unsupervised deep learning model in this patent utilizes a convolutional autoencoder architecture, which reduces the number of parameters and computational complexity. This enables the model to operate efficiently in resource-constrained environments, making it suitable for edge devices and edge nodes. Furthermore, the model has low overhead for transmitting and storing data, using encoding and decoding techniques to learn and represent sensory data, reducing the need for data transmission and storage.

[0025] Secondly, the highly efficient unsupervised deep learning model demonstrates excellent accuracy. By employing a convolutional autoencoder model, it learns implicit representations of sensory data and distinguishes relevant anomalies by comparing the reconstructed and original matrices. This unsupervised learning approach enables the model to capture anomalous patterns from large-scale sensory data without the need for human-labeled tags. As a result, the model can accurately detect various types of anomalies and demonstrates high robustness and reliability in real-world scenarios.

[0026] Finally, the efficient unsupervised deep learning model offers advantages in terms of model effectiveness. It not only provides a baseline approach for continuous sensory data but also designs improved methods to enhance system efficiency. By applying background knowledge and a skipping strategy, the model minimizes the number of sliding windows required for evaluation, reducing computational and processing complexity and improving the system's real-time performance and responsiveness. Furthermore, through a comprehensive analysis of theoretical analysis and experimental evaluation, the model demonstrates its effectiveness and feasibility in IoT environments.

[0027] In summary, this efficient unsupervised deep learning model offers advantages in terms of overall cost, accuracy, and effectiveness. It provides an efficient, accurate, and reliable solution for anomaly detection in edge-assisted IoT, which is of great significance for practical application scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 The following is the flowchart of the anomaly detection framework.

[0029] Figure 2 Schematic diagram of the UGA-CAE model structure. DETAILED DESCRIPTION

[0030] The present invention will be described in further detail below with reference to the accompanying drawings. The examples given are only used to explain the present invention and are not used to limit the scope of the present invention.

[0031] In response to the problems existing in the prior art, the present invention provides an anomaly detection framework based on the cosine similarity matrix, and designs a convolutional autoencoder (UGA-CAE) model based on unbalanced adversarial training to complete anomaly detection in multi-dimensional sensor time series data.

[0032] Design of anomaly detection framework based on cosine similarity matrix: This framework implements anomaly detection for N-dimensional sensor time series data in a given edge computing node. The overall flow chart of the anomaly detection framework is as follows: Figure 1 As shown, it is mainly divided into the following steps:

[0033] Step 1): Collect the original time series data generated by multiple sensors in smart city applications and aggregate the above data as the data to be tested.

[0034] Step 2): The data to be measured described in step 1) is divided by the time of data generation, such as daily or hourly, to form data samples to be measured. Assuming there are N sensors, the data samples to be measured form an N-dimensional time series. Data preprocessing is performed on the data samples to be measured, including data filtering, data alignment, and matrix initialization (to determine the dimensions of the similarity matrix).

[0035] Step 3): After the data preprocessing in step 2), the data samples are segmented and intercepted using a sliding window to form a total of L sliding windows, where the data in each sliding window is a time subsequence of the N-dimensional time series of the data in step 2).

[0036] Step 4): Calculate the cosine similarity between the column vectors of the intercepted data in each window in step 3), and record the calculation results in the corresponding positions in the similarity matrix.

[0037] Step 5): Using the similarity matrix from step 4) as input, the UGA-CAE model calculates the anomaly score for the data within the corresponding window. The UGA-CAE model uses its encoder to map the cosine similarity matrix into feature space. It then uses the primary decoder and support decoder to form two reconstruction matrices to calculate the loss function, outputting the function value as the anomaly score for the data within the window.

[0038] Step 6): Based on the results of the UGA-CAE model from step 5), determine whether there are any anomalies in the time window. If the anomaly score in step 5 exceeds the threshold, the data in the sliding window is considered to be anomaly data, and the label of the time window is added to the anomaly detection result set. If it does not exceed the threshold, the data in the time window is considered normal data, and the model analysis results are output.

[0039] The above steps are the overall design ideas of the anomaly detection framework. Only the main objectives of each step are described. The details will be explained in detail later, mainly including basic instructions and symbolic representation, data sample preprocessing, UGA-CAE model, and UGA-CAE model anomaly detection method.

[0040] Basic description and symbolic representation: The device considered in this patent is equipped with multiple sensors as sensing components, which together form a network structure. The device is represented as F, the total number of sensors in the network structure is N, and each sensor is represented as S i , i=1,2,…,N represents the sensor number. The device contains a collection of multiple sensors, that is, In addition, the device also includes an edge node E0∈F to calculate and analyze the data generated by the above multi-sensor. Therefore, the device can be represented as F={{S i},E0}.

[0041] More specifically, the nodes are organized in a planar fashion, meaning each sensor node can communicate directly with an edge node. Sensors are pre-deployed at different locations within the facility and monitor the facility's operating conditions at a fixed frequency. Each of the N sensors in facility F operates independently, sensing, collecting, and capturing a continuous series of data points in chronological order.

[0042] For a single sensor S i For the sake of simplicity, this patent assumes that different sensors follow the same sampling frequency and their common time interval is ΔT. The sensing timestamps are t1, t2, ..., T, where t j =(j–1)·ΔT, time interval number j=1,2,…. Note that this patent is also applicable to sensor devices with different detection frequencies, which require data preprocessing and alignment. The specific method will be introduced later. When the same sampling frequency is used after data processing, the original sensor time series can be expressed as Where t represents the timestamp of data collection, T represents the end time of data collection, and i represents the sensor S i Number, x t Represents a column vector. Since matrix calculations are involved later, the common way to record matrices is to use column names to represent different sensors, and each row records data at different timestamps. Therefore, in the process of recording vectors, The element x in i,t The subscripts of are recorded in the form of columns first and rows later, where i still represents the sensor number and t represents the event stamp. T Represents the transpose of a vector. Since the transpose symbol {·} T This is close to the timestamp terminator T, for clarification.

[0043] For the facility F as a whole, it contains N sensors, and the data points generated at time t will contain N entries. Time t ranges from 1 to T. The whole can be recorded as a multidimensional time series This patent mainly considers the abnormal situation of a single facility, XF It can be simply expressed as X, and the detailed expression is:

[0044]

[0045] At different time points t, that is, in a single row of X, these data can be used to construct a detection dataset containing N entries, denoted as X t ={x 1,t ,x 2,t ,…,x N,t Since the sensor is used for a long time, it consumes too much resources to include all multi-dimensional time series in the calculation. Therefore, the original time axis is segmented to form a set of time intervals of equal length. The segmented time intervals are called sliding windows, denoted as W. More specifically, the original time axis [1, T] is segmented into a total of L sliding windows, that is, [1, T] → {W1, W2, …, W L The length of the sliding window is represented by the |·| operator, that is, for the lth sliding window W l , which contains |W l | timestamps of data. Each time window has the same length, abbreviated as |W|. The timestamp interception range of each sliding window can be expressed as:

[0046] [(l-1)·|W|,l·|W|-1],l=1,2,…,L

[0047] Where l represents the number of the sliding window.

[0048] The time series after the above segmentation is called a multidimensional time subsequence, which is expressed as The expression is:

[0049]

[0050] The above multidimensional time subseries

[0051] All sensors collect a set of detection data and regularly update the packaged data set to the edge node E0. This patent assumes that each set of detection data is uploaded only once. The edge node E0 will use the convolutional autoencoder model UGA-CAE based on unbalanced adversarial training to process the collected multi-dimensional time subsequence detection data in sequence according to the arrival time of each set of detection data. And detect abnormal patterns. UGA-CAE is an anomaly detection method based on similarity matrix analysis. The main structure of the UGA-CAE model will be described later. First, the anomaly detection process based on the similarity matrix is ​​introduced.

[0052] Upon receiving the above multidimensional time subsequence After that, the corresponding similarity matrix will be calculated, and based on the comparison of each element in the similarity matrix with the pre-set threshold value, a comprehensive anomaly score will be obtained to complete the judgment of anomaly detection. There are various forms of similarity matrices. This patent uses the cosine similarity matrix. The cosine similarity matrix is ​​composed of multidimensional time subsequences. A total of N vectors in The cosine similarity of the two vectors is calculated, where Indicates the same sensor S i The data formed in a time window W l There are N vectors in total. Finally, an N×N cosine similarity feature matrix is ​​constructed, which is expressed as Abbreviated as M l A more detailed expression is:

[0053]

[0054] in Where i, j∈{1,2,…,N}. Use n to represent a time window W l The total number of samples in sensor S i With sensor S j Time subseries of The formula for calculating the cosine similarity between is as follows: Since the above calculations are commutative and the diagonal elements are all 1, we only need to calculate the upper triangular matrix.

[0055] The symbols used in this patent are summarized in Table 1:

[0056] Table 1 is a summary of the symbols.

[0057]

[0058]

[0059] Data sample preprocessing:

[0060] In order to fully learn normal perception data in edge-assisted systems, different sensors continuously collect perception data at a certain frequency and adopt a batch upload strategy to encode a set of perception data into continuous data packets and transmit them to the edge node. In this way, each perception record is reported only once to reduce bandwidth consumption. However, due to environmental instability and inconsistency in perception frequency, the perception data of different devices usually have differences in noise and volume. Based on the above problems, the main goal of data preprocessing is to customize perception data for anomaly detection, including denoising and aligning data generated by different devices. The three main steps include data filtering, data alignment, and matrix initialization.

[0061] Data filtering: Considering the instability of the monitoring environment and the limited perception capabilities of sensors, the perception data of IoT devices are usually noisy and need to be filtered before further analysis. This framework adopts a threshold-based filtering method, and the selection of the threshold needs to consider the maximum and minimum values ​​of each sensor. First, process each sensor S i The collected sensory data sequence Two types of outliers are identified: single points, where one or a few isolated sensory records are outside the normal range, and continuous values, where a series of sensory records all exceed the threshold.

[0062] For the first type of outliers, interpolation method is used to replace them. For example, suppose sensor S i Records of x it Exceeds the upper bound Max i , then we have The first type of anomaly is a single-point anomaly. Since there is individual noise in the sensor data, and the model of this patent focuses on detecting the correlation anomaly of the sensor data over a period of time, the first type of anomaly is not the focus of investigation and has little impact on the model results. The main focus is on the second type of anomaly with continuous values.

[0063] The average value of the adjacent records of the first type of outlier is used as the correction value of the outlier. When several consecutive values ​​are out of range, an iterative strategy is further introduced. Assume that the outlier value is {x it , x it+1 ,...,x it+k Then, from x it and x it+k Start by updating each x it+j The update formula is:

[0064] For the second type of outliers, that is, the abnormal interval with multiple abnormal detection points in a row, the framework will retain the original data without additional processing. This continuous anomaly helps to indicate the potential pattern in the perceived data and is the focus of correlation anomaly detection. For a series of outliers, the minimum length of the continuous anomaly should be l min , can be considered as a continuous anomaly.

[0065] Data alignment: In actual scenarios, different sensing devices have different sensing frequencies due to differences in application fields and device capabilities. This patent uses a method based on continuous sliding windows for correlation anomaly detection. This method requires that the data it processes must be aligned before subsequent calculations can be performed. The data alignment process mainly adjusts and adapts different sliding windows for each sensor to achieve frequency consistency for sensors with different frequencies after processing. Assume that there are N sensors S1, S2, ..., S N, the corresponding sensor frequencies are recorded as freq1, freq2,…, freq N , select the lowest frequency, expressed as Adjust all sensor frequencies to the lowest sensor frequency When converting from high frequency to low frequency, the average value method is used to compress redundant data and realize frequency conversion.

[0066] Matrix initialization: The last step of data preprocessing is to generate the similarity matrix, which will be used as the input of the UGA-CAE model and perform anomaly detection. The similarity matrix is ​​denoted as M l , used to record the lth sliding window W l The data correlation in is expressed as:

[0067]

[0068] m i,j It's W l Medium S i and S j The correlation between the perceptual data sequences, such as cosine similarity. In addition, the matrix satisfies the symmetry, that is, m i,j =m j,i and m i,i =1, only the values ​​of the upper triangle of the matrix can be calculated during calculation to reduce the amount of calculation.

[0069] UGA-CAE Model:

[0070] The UGA-CAE model of convolutional autoencoder based on unbalanced adversarial training consists of three parts: an encoder and two decoders. The model structure is shown in the figure below. Figure 2 shown.

[0071] First, the detailed design method of the UGA-CAE model is introduced, followed by the method of generative adversarial training of the model, and finally the anomaly detection method based on UGA-CAE is introduced.

[0072] CAE design: Convolutional autoencoder (CAE) is a variant of autoencoder (AE). It uses convolutional layers and pooling layers to replace the fully connected layers in the autoencoder, enabling it to fully characterize and monitor the correlation and distribution of data. The first part of CAE is the data convolution encoding stage, which is connected to the data input layer. l As the input of the model, the encoder first l Perform convolution coding and map it into the hidden space. Cosine similarity matrix M l ∈R N×N , N represents the matrix dimension: In the process of data encoding, each matrix input is encoded to obtain multiple hidden feature maps Mmid , the convolutional coding process can be described as:

[0073] M mid =σ(conv(x)+b)

[0074] Where conv(·) is the convolution operation, b is the bias term, and σ represents the activation function. Feature extraction is completed by converting the original data into the hidden space.

[0075] The decoder reconstructs the original data based on the reduced-dimensional data and obtains the N×N output again. Deconvolution decoding is performed on the feature data in the latent space, and the information in the latent space is restored to the same state as the input dimension through the decoding method. For the vector obtained after feature extraction, the reconstructed data can be obtained after decoding. The decoding process can be described as:

[0076]

[0077] Among them, d_conv(·) is the deconvolution operation, c is the bias term, and σ represents the activation function.

[0078] Finally, CAE calculates the loss function based on the difference between the original data and the reconstructed data Optimize parameters. The commonly used loss function MSE is as follows:

[0079]

[0080] where y i ∈M l , Finally, optimizing the model according to the loss function enables the convolutional autoencoder model to learn the pattern information in the original data.

[0081] UGA-CAE model structure: Based on the CAE model, the UGA-CAE model increases the number of decoders and introduces an unbalanced adversarial training mechanism. It also modifies the selection of subsequent loss functions. To further optimize the calculation speed of the model, a calculation strategy based on sliding window skipping is proposed. UGA-CAE consists of three parts: an encoder and two decoders. The encoder is represented by E, which still converts the similarity matrix M l As input, considering that the operation of the matrix is ​​independent of the index l of the sliding window, that is, the processing flow of all matrices is the same, the correlation matrix is ​​abbreviated as M. The encoder E maps the correlation code of the matrix to the feature space as an intermediate result, and the result is represented by M mid=E(M). The encoder consists of a five-layer convolutional neural network, with each layer using small kernels and small strides to minimize information loss. Specifically, it consists of layers of sizes 64×64, 32×32, 16×16, 8×8, and 4×4. The neural network uses a padding value of 1 and a convolution kernel size of 3×3.

[0082] The two decoders are called the main decoder and the support decoder, denoted as D1 and D2. These two encoders are heterogeneous, and the network structure and number of layers are different. The main decoder D1 is a deconvolution network symmetrical to the encoder E, mainly composed of five deconvolution layers of 4×4, 8×8, 16×16, 32×32 and 64×64. Each layer uses a 3×3 convolution kernel with a step size of 1. In addition, each deconvolution layer contains a batch normalization BN layer and uses the ReLU function as its activation function. The main decoder uses the similarity matrix M in the feature space mid As input, it is reconstructed and the output reconstruction result is expressed as D1(M mid ).

[0083] Compared to the main decoder, the support decoder is a lighter deconvolutional network with fewer layers. It consists of a three-layer deconvolutional neural network with network layers of size 64×64, 32×32, and 8×8, respectively. The convolution kernel size is 3×3 and the stride is 1. This layer also contains a batch normalization (BN) layer and uses the ReLU function as its activation function. The support decoder functions similarly to the main decoder, but is independent of it. The support decoder also uses the similarity matrix M in the feature space. mid As input, the reconstruction result of the output is expressed as D2(M mid ).

[0084] Table 2 is a summary of the network layers of the encoder, main decoder, and support decoder of this patent.

[0085]

[0086]

[0087] Generative adversarial training of the UGA-CAE model: In order to fully learn the distribution of normal perception data, the two decoders of UGA-CAE are trained separately. The core idea is to make the main decoder D1 reconstruct the original matrix M as much as possible, while the support decoder D2 acts as a discriminator, trying to identify the data D1 (M reconstructed by the main decoder) mid )=D1(E(M)) and the difference between the original data M. In this process, this patent applies the idea of ​​generative adversarial learning.

[0088] The training process is divided into two stages. In the first stage, the two decoders share the output of the encoder M mid , both decoders learn how to reconstruct the original matrix from the feature space. The goal is to enable the two decoders to learn the ability to extract data correlation patterns so that the reconstruction results are as similar as possible to the input correlation matrix. More specifically, in the first stage, the training sample M constructed by the similarity matrix of the perceptual data is input into the encoder E, denoted as M mid =E(M). Then, both decoders input M mid , respectively forming reconstruction matrices with the same dimensions as the input cosine similarity matrix Expressed as Where i = 1 represents the main decoder and i = 2 represents the support decoder. Finally, the parameters are learned based on minimizing the loss function:

[0089]

[0090] where α and β represent the hyperparameters of the loss functions of the main decoder and support decoder, satisfying α>β.

[0091] In the second stage, a generative adversarial learning strategy is adopted to further improve the anomaly detection capability of the entire model. Generally, the amount of correlated abnormal data is small and difficult to detect. When performing conventional analysis, its data performance is very similar to normal perception data. Therefore, it is necessary to use the idea of ​​generative adversarial learning to enhance the model's ability to distinguish normal data from abnormal data, and to distinguish sparse and tiny abnormal signals. To achieve this goal, the second stage adopts the idea of ​​a two-player zero-sum game in game theory, setting two decoders D1 and D2 as opponents, with the main decoder D1 as the generator and the support decoder D2 as the discriminator, forcing both players to adjust each other's parameters to achieve Nash equilibrium. Specifically, the main decoder is still based on M mid As input, it is responsible for generating a reconstruction matrix D1 (M mid The discriminator uses the reconstruction matrix D1 (M mid ) passes through the encoder E again and the result in the feature space is E(D1(M mid )) and the result M in the feature space after the real data M passes through the encoder mid The union of is input, and the calculated D2(E(D1(M mid ))), identify whether the input data comes from the original data M or the data D1(M generated by the main decoder mid ).

[0092] In this way, the main decoder can learn the pattern of original data correlation in more detail, while the support decoder can learn to distinguish the sparse and small differences between the original matrix and the reconstructed matrix. The above two-player zero-sum game can be expressed as:

[0093]

[0094] Based on the above game objective, this patent further decomposes the equation to obtain the training objectives of the generator D1 and the discriminator D2:

[0095]

[0096]

[0097] During this multi-round training process, samples of the similarity matrix are sequentially fed into the encoder, generator, and discriminator. The parameters are updated in a way that minimizes the global loss function:

[0098]

[0099] Considering the difference in complexity between the generator and the discriminator, we similarly pre-set α>β to adjust the contribution of the two components. This patent uses this parameter adjustment method, which means that compared with the correctness of the discriminator, this patent attaches more importance to the similarity between the generator's generated results and the original data. The pseudo code of the overall training algorithm of the UGA-CAE model (including the first and second stages) is shown in Algorithm 1:

[0100]

[0101]

[0102] UGA-CAE model anomaly detection method:

[0103] Baseline method: Ideally, the anomaly detection model should detect all sensory data to ensure that it can handle all abnormal patterns, thereby enhancing its robustness. Most previous solutions tend to process continuous sequences. The sensory data collected at each upload is divided into different subsequences, which are then processed by the anomaly detection model. Sequences with scores exceeding a given threshold are marked as abnormal sequences. However, some abnormal sensory data sequences may appear in multiple adjacent data packets. This strategy is insufficient for IoT systems, and some irregular sequences may be ignored. Each test group can only cover part of the area and cannot accurately make the score of each subsequence exceed the threshold.

[0104] To solve the above problem, the baseline method of this patent adopts an incremental strategy to traverse all subsequences. This method divides the entire dataset X into continuous sliding windows, where That is, the adjacent window W l and W l+1 There is only one data point X l and X l+L0+1 The difference, and each data point X j Appears in L0 sliding windows. For each W l , this method inputs the correlation matrix M into the trained UGA-CAE model and generates a reconstructed matrix and The expressions are Among them, M mid represents the result of the correlation matrix M after the trained encoder. The anomaly detection score is estimated by the following formula:

[0105]

[0106] in and represents the comprehensive difference between the original matrix and the reconstructed matrix. The pseudo code of the baseline method is shown in Algorithm 2.

[0107]

[0108]

[0109] Since UGA-CAE is trained on a normal dataset, the score A(M) of the abnormal sequence will be significant and may exceed the threshold λ used for anomaly detection. Then, the corresponding window with A(M) ≥ λ is reported to the system user with the following formula:

[0110]

[0111] Take the top-K sensor ID and timestamp pairs (i, j) and add them to the outlier set.

[0112] Finally, the system user can monitor the reported results and annotate the anomalous periods. In this case, the method will skip the sliding window covering the anomaly and start from the first W without an anomalous pattern. l Otherwise, the baseline method will continue to process the next sliding window.

[0113] Improved method based on sliding window skipping: The baseline strategy continuously detects anomalies in IoT devices and does not skip any relevant anomalies. However, this global detection approach significantly increases algorithmic overhead. Considering that the sliding window traverses all sensor data, there are many redundant processing steps. Therefore, this patent improves the algorithm's execution efficiency by evaluating the number of sliding windows. This patent designs an improved algorithm that minimizes the number of sliding windows, called the improved method with window skipping strategy, abbreviated as IMWS. The details are as follows:

[0114] The improved IMWS method applies the background knowledge of anomaly detection. Specifically, correlation anomalies usually occur within a certain time period. Data fluctuations on very small time scales are often caused by the randomness caused by the environment. The numerical anomalies will be more significant, but the correlation anomalies are not obvious enough. On the contrary, data fluctuations on very large time scales generally indicate serious system errors. The proportion of correlation anomalies in the algorithm is too high, causing the model to mistakenly learn this error pattern as a normal model. This error with a large time span should be physically monitored by the user for further analysis. For this reason, it can be assumed that the focus interval of the correlation anomaly is [L min ,L max ], which are the minimum and maximum number of consecutive data points required to observe anomalies, that is, the interval of consecutive abnormal data should be in L min to L max Considering the randomness of anomalies, IMWS should ensure that any continuous subsequence of sensing data within this range should appear as a whole in at least one anomaly detection window.

[0115] The main process of IMWS is as follows: when receiving sensor data from IoT devices, the edge node inputs the first sliding window into the UGA-CAE model. When a related anomaly occurs, the method follows the same process as the baseline solution. Otherwise, the method skips the next L0-L max +1 window and re-enter the sliding window in the next round into the UGA-CAE model. Meanwhile, the method pauses when the IoT device has not yet reported the corresponding data. The remaining details of the method are similar to those of the baseline solution. The pseudo code of the improved algorithm based on the window skipping strategy is shown in Algorithm 3.

[0116]

[0117] While specific embodiments of the present invention have been disclosed for illustrative purposes, intended to facilitate understanding and implementation of the present invention, those skilled in the art will appreciate that various substitutions, variations, and modifications are possible without departing from the spirit and scope of the present invention and the appended claims. Therefore, the present invention should not be limited to the disclosure of the preferred embodiments, and the scope of protection claimed in the present invention shall be determined by the scope of the claims.

Claims

1. A method for anomaly detection based on unbalanced adversarial training convolutional autoencoder, comprising the following steps: 1) Collect the original time series data generated by N sensors in smart city applications and aggregate them as the data to be tested; 2) Dividing the data to be measured according to the time when the data was generated, and treating the original time series data generated by each sensor at the same sampling moment as an N-dimensional data sample to be measured; 3) sorting the data samples to be tested by time and segmenting the sorted data samples to be tested using a sliding window to obtain L time subsequences; each time subsequence includes multiple data samples to be tested; 4) calculating the similarity between each pair of sensor data in each time subsequence to form a similarity matrix; 5) The similarity matrix is ​​input into the convolutional autoencoder model UGA-CAE based on unbalanced adversarial training to calculate the anomaly score of each time subsequence; if the anomaly score of a time subsequence exceeds the set threshold, it is considered that all sensor data in the time subsequence are abnormal data, and the label of the time window corresponding to the time subsequence is added to the anomaly detection result set; wherein, the convolutional autoencoder model UGA-CAE includes an encoder E, a main decoder D1 and a support decoder D2; the encoder E is used to map the input similarity matrix M to the feature space to obtain the similarity matrix M mid And input them into the main decoder D1 and the support decoder D2 respectively; the main decoder D1 is based on the input similarity matrix M mid Reconstruct the similarity matrix M to obtain The support decoder D2 is based on D1 (M mid )The result after passing through the encoder E again is E(D1(M mid ))Reconstruction Then calculate the similarity matrix M respectively with The sum of the differences is taken as the abnormality score of the time subsequence corresponding to the similarity matrix M.

2. The method according to claim 1, characterized in that The anomaly score of the time subsequence corresponding to the similarity matrix M 3. The method according to claim 1, characterized in that The method for training the convolutional autoencoder model UGA-CAE is as follows: in the first stage, the encoder E maps the input similarity matrix M to the feature space to obtain the similarity matrix M mid And input them into the main decoder D1 and the support decoder D2 respectively; the main decoder D1 is based on the input similarity matrix M mid Reconstruct the similarity matrix M to obtain the first similarity matrix D1(M mid ); The support decoder D2 is based on the similarity matrix M of the input mid Reconstruct the similarity matrix M to obtain the second similarity matrix D2 (M mid ); In the second stage, the main decoder D1 is used as a generator and the support decoder D2 is used as a discriminator. The generator converts the first similarity matrix D1 (M mid ) is sent to the encoder E, and the encoder E converts the input D1(M mid ) is mapped to the feature space to obtain the similarity matrix E(D1(M mid )) and input it to the discriminator; the discriminator converts the similarity matrix E(D1(M mid )) and M mid As the input, reconstruct the similarity matrix M to obtain the third similarity matrix D2(D1(M mid )); Then based on minimizing the loss function Optimize and update the parameters of the main decoder D1 and the supporting decoder D2; where α>β, 4. The method according to claim 1 or 2, characterized in that The encoder E includes a first convolutional neural network with a size of 64×64, a second convolutional neural network with a size of 32×32, a third convolutional neural network with a size of 16×16, a fourth convolutional neural network with a size of 8×8, and a fifth convolutional neural network with a size of 4×4, which process the input data in sequence, and the convolution kernel size of each convolutional neural network is 3×3; the main decoder D1 is a deconvolution network symmetrical to the encoder E, and each deconvolution layer in the deconvolution network contains a batch normalization BN layer and uses the ReLU function as its activation function; the support decoder D2 includes a first deconvolutional neural network with a size of 64×64, a second deconvolutional neural network with a size of 32×32, and a third deconvolutional neural network with a size of 8×8, which process the input data in sequence, and the convolution kernel size of each deconvolution neural network is 3×3, and each deconvolution neural network contains a batch normalization BN layer and uses the ReLU function as its activation function.

5. The method according to claim 1, wherein The time subsequence corresponding to the lth sliding window is The data of the same sensor in the time subsequence corresponding to the lth sliding window is formed into a vector, and then the similarity between any two vectors is calculated to form a similarity matrix.

6. The method according to claim 1, characterized in that The original time series data generated by the sensor is filtered, the filtered data is aligned according to the set sliding window, and then summarized to obtain the data to be tested; the data filtering method is: to detect whether there is a single point anomaly in the original time series data generated by the sensor. If a single point anomaly occurs, the average value of the adjacent recorded data is used as the correction value for the single point anomaly.

7. A server, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, the computer program is configured to be executed by the processor, and the computer program includes instructions for executing the steps of the method according to any one of claims 1 to 6.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images