An Interpretable Temporal Data Anomaly Detection Method Based on Lightweight Reconstruction Networks

Abstract

This invention discloses an interpretable time-series data anomaly detection method based on a lightweight reconstruction network, comprising the following steps: acquiring time-series data and constructing a dataset; constructing an encoding network to obtain encoded latent features; obtaining dependencies between multiple sequence channels; inputting the updated latent features into a decoding network to obtain reconstructed data; constructing a generator and a discriminator and using adversarial training to optimize the parameters of the reconstruction network; inputting the data to be detected into the reconstructed network optimized by adversarial training, and judging the anomaly state of the data by analyzing the reconstruction error, and further inferring the anomaly state by combining the dependency graph. This invention achieves advancements in lightweight design and interpretability. The method not only focuses on simplifying the network structure and reducing the number of parameters for efficient deployment in resource-constrained environments, but also emphasizes the constructed dependencies, providing valuable information for interpreting anomalies.

Description

Technical Field

[0001] This invention relates to the field of industrial data anomaly processing technology, specifically to an interpretable time-series data anomaly detection method based on lightweight reconstructed networks. Background Technology

[0002] Anomaly detection typically requires processing massive data streams in real-time or near real-time. These streams are often high-frequency, high-dimensional, and dynamically changing, and may contain noise and redundant information. Therefore, processing this data necessitates efficient methods and data structures to improve computational efficiency and reduce storage overhead. Traditional anomaly detection methods primarily rely on statistics and thresholding techniques; however, in complex, high-dimensional datasets, these methods often struggle to capture potential anomalous patterns. The rapid development of deep learning technology has brought new opportunities for anomaly detection, particularly unsupervised anomaly detection methods based on reconstruction networks, which have become a research hotspot. These methods utilize deep neural networks and autoencoder techniques to reconstruct and learn representations of data in an unsupervised manner, thereby effectively capturing potential anomalous patterns in the data.

[0003] However, some known anomaly detection methods based on reconstructed networks generally suffer from several problems. First, some methods require a large number of parameters and computational resources, resulting in large and complex models that limit their application on lightweight devices. Second, due to the complexity of the network structure or the ambiguity of feature extraction, these methods have poor interpretability, making it difficult to provide transparent explanations to users or decision-makers, thus limiting their use in some key application areas. Summary of the Invention

[0004] To overcome the shortcomings of the existing technical solutions, this invention provides a method for anomaly detection in interpretable time-series data based on lightweight reconstruction networks. To achieve the above technical objective, this invention adopts the following technical solution:

[0005] An interpretable time-series data anomaly detection method based on lightweight reconstruction networks includes the following steps:

[0006] S1: Acquire time-series data and then construct a dataset;

[0007] S2: Construct an encoding network to obtain the encoded latent features;

[0008] S3: Construct a relation learning module to obtain the dependencies between multiple sequence channels;

[0009] S4: Utilize the latent features of the updated data based on the dependency relationship to construct a decoding network, and input the updated latent features into the decoding network to obtain reconstructed data;

[0010] S5: Construct generators and discriminators and use adversarial training methods to optimize the parameters of the reconstructed network, which consists of an encoding network, a relation learning module, and a decoding network;

[0011] S6: Input the data to be detected into the reconstructed network after adversarial training and optimization, and judge the abnormal state of the data by analyzing the reconstruction error. Combine the dependency graph to further infer the abnormal state.

[0012] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0013] This invention presents an interpretable time-series data anomaly detection method based on lightweight reconstructed networks, achieving advancements in both lightweight design and interpretability. This method focuses on simplifying the network structure and reducing the number of parameters for efficient deployment in resource-constrained environments. Simultaneously, it advances towards interpretability, providing valuable information for anomaly detection inferences and enhancing user trust and understanding of system decisions. The beneficial effects of this innovative method are twofold: firstly, by reducing network parameters, the system can operate more efficiently under limited resources, achieving feasibility in practical applications. Secondly, emphasizing interpretability allows users to gain a deeper understanding of the fundamentals of anomaly detection, providing more decision support while lowering the barrier to entry. These dual advantages make this method widely applicable, not only improving system performance but also strengthening the mutual trust between users and the system, laying a solid foundation for future technological development and applications. Attached Figure Description

[0014] To more clearly illustrate the technical solutions of the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0015] Figure 1 This is a flowchart of the method of the present invention.

[0016] Figure 2 This is a diagram showing the interdependencies between channels constructed for this invention.

[0017] Figure 3 This is a diagram showing the reconstruction of data during testing for this invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] like Figure 1 As shown, an interpretable time-series data anomaly detection method based on lightweight reconstruction networks includes the following steps:

[0020] S1: Acquire time-series data and then construct a dataset;

[0021] Step S1 specifically includes:

[0022] S11: Data preprocessing: Preprocessing time series data, including handling missing values ​​and data format processing;

[0023] S12: Split the dataset: Divide the preprocessed data into a training set and a test set. The training set contains only normal data, while the test set contains both normal and abnormal data.

[0024] S13: Set the sliding window and the step size to cut the training and test set data into fixed-length subsequences, i.e. time period data, and transform them into a dataset suitable for model training.

[0025] S2: Construct an encoding network to obtain the encoded latent features;

[0026] Step S2 specifically includes:

[0027] An encoding network is constructed using a feature extraction method based on multi-period perspective temporal analysis and a parallel architecture based on multi-scale convolution. Time-period data is input into the encoding network for learning to obtain encoded latent features, specifically including:

[0028] S21: Construct a feature extraction layer based on multi-period viewpoints and multi-scale convolution in parallel;

[0029] Step S21 specifically includes:

[0030] S211: Converting 1D data into 2D data: For a multi-channel one-dimensional time series X 1D ∈R T×C Where 1D is one-dimensional, 2D is two-dimensional, T is the time length, C is the total number of channels, and R is the total number of channels. T×C In the space where the data resides, the periodicity of a one-dimensional time series is calculated by the Fast Fourier Transform of the time dimension, i.e.:

[0031]

[0032]

[0033]

[0034] in, C was selected i A one-dimensional time series with channel dimension m for The intensity of each frequency component is given by FFT(·), where FFT(·) is the Fast Fourier Transform and Amp(·) is the amplitude calculation. To select the top k intensities in ascending order, the selected intensities yield k corresponding frequencies {f1, ..., f2}. k}, f * The frequency values ​​corresponding to the intensity values, the k frequencies with the highest intensity {f1,…,f k} corresponds to the lengths of the k most significant periods {p1,…,p} k};

[0035] One-dimensional time series with multiple channels based on periodicity Remodeled into multiple two-dimensional tensors

[0036] in, This indicates that the input is arranged in a two-dimensional form according to the period, and Padding(·) means padding the time series with 0s along the time dimension so that it matches the reshaped p. i and f i compatible;

[0037] S212: Multi-scale feature extraction of the transformed 2D data: Features are extracted from the reshaped 2D tensor through lightweight multi-scale 2D convolution. Multi-scale convolution refers to using convolution kernels of various different scales. Furthermore, on top of the multi-scale, decomposition convolution is adopted, that is, the large convolution kernel is decomposed into two or more smaller convolution kernels.

[0038] S213: Transforming 2D data back to 1D space: the transformed 2D tensor Two-dimensional temporal features are obtained by extracting two-dimensional temporal variations through multi-scale two-dimensional separable convolution. Where l represents the layer number of the network, Representing a two-dimensional tensor The output after convolution in layer l;

[0039] Transform it back into one-dimensional space for information aggregation:

[0040]

[0041] in, Indicates according to the cycle pi Will The result of reshaping back into one-dimensional space, Indicates will Reshaping back to one-dimensional space, Trunc(·) represents zero-padding removal, resulting in a one-dimensional representation. The final output is obtained by weighting and summing the intensities of their corresponding frequencies:

[0042]

[0043] in, To be Mapped to the range of 0 to 1 according to relative size;

[0044] S22: Construct an encoding network by stacking feature extraction layers to obtain latent features corresponding to time-series data; N-dimensional time series data is represented as X=[x1,…,x…]. N ] T x i For the time series of the i-th dimension, for each x i , further expressed as t = 1, 2, ..., T represents the time dimension of the data, and the compressed representation obtained after passing through the encoding network for each dimension is h. n =F Enc (x n This allows us to stack the latent codes of all dimensions to obtain H = [h1, h2, ..., h N ] T Where n represents the channel dimension, h n F represents the latent encoding corresponding to channel dimension n. Enc This represents the function corresponding to the encoder, x. n It is N-dimensional time series data [x1,…,x] N ] T The time series corresponding to the channel dimension n is H, which is a feature matrix stacked from the one-dimensional latent features of all channel dimensions, and N is the input channel dimension, which is also the number of nodes.

[0045] S3: Construct a relation learning module to obtain the dependencies between multiple sequence channels;

[0046] Step S3 specifically includes:

[0047] S31: Randomly initialize nodes: Each node is randomly initialized, represented by a matrix X. node

[0048] S32: Construct a shallow network using a fully connected neural network for representation learning: After representation learning, the node representation E = F is obtained.rep (X node ), where F rep This indicates a learning network;

[0049] S33: Construct the dependencies between nodes: according to the formula A = LeakyReLU(tanh(EE) T Construct a relation matrix A, where E represents each channel node, and Tanh and LeakyReLU are activation functions. To ensure the sparsity of the adjacency matrix, each node retains its k neighbors with the highest weights, thus according to the formula... We obtain the degree matrix, where A 1j This represents the first row and j-th column of matrix A. This means that the degree of the first node is calculated based on its neighboring nodes; then, according to the formula... Obtain the relation matrix Where I represents the identity matrix, and D -1 Inverse of the degree matrix, here the relation matrix is... That is, the inter-channel dependencies of multidimensional time series.

[0050] S4: Utilize the latent features of the updated data based on the dependency relationship to construct a decoding network, and input the updated latent features into the decoding network to obtain reconstructed data;

[0051] Step S4 specifically includes:

[0052] S41: Using the relation matrix The relationships are integrated into the latent features to form the final latent feature H′, which retains its original state with a 1-γ ratio while sharing information propagated from the neighborhood with a γ ratio:

[0053]

[0054] S42: The decoder and encoder are symmetrical in form, employing the same feature extraction method and also sharing weights. The decoder is responsible for mapping features from the latent space to the original space. Since this process is performed channel-by-channel, concatenation is required to obtain the complete multidimensional reconstructed data. The output of each dimension's compressed encoding after passing through the decoding network is... F Dec The function h represents the structure of the decoding network. n This represents one dimension of the potential encoding. This indicates the corresponding reconstruction result, obtained by stacking the outputs of all dimensions. This means that the reconstruction results of one dimension are concatenated with the reconstruction results of other dimensions, and then transposed to make them consistent with the input format of the network to complete the data reconstruction.

[0055] S5: Construct generators and discriminators and use adversarial training methods to optimize the parameters of the reconstructed network, which consists of an encoding network, a relation learning module, and a decoding network;

[0056] Step S5 specifically includes:

[0057] S51: Constructing the generator G: Adversarial training is performed on the reconstructed network, that is, the reconstructed network is used as the generator G of the generative adversarial network;

[0058] S52: Constructing the discriminator D: Select a fully connected neural network and use an activation function to construct the discriminator D. The input layer of the discriminator D receives the input data X fed into the reconstruction network and the result data reconstructed by the reconstruction network.

[0059] S53: Design the loss function for the generator; the training objective of the generator includes three tasks:

[0060] S531: Constructing the objective function for the reconstruction task: From the generator's perspective, define a reconstruction error loss to measure the performance of the reconstruction network, aiming to make the reconstructed data as close to the real data as possible, as shown below:

[0061]

[0062] Where W represents the number of inputs used in training. This represents the data after the network has been reconstructed, that is, the reconstruction of the input. This represents the distance between two variables;

[0063] S532: Construct the objective function for adversarial training; define an adversarial loss to enable the generator to produce more realistic data samples to deceive the discriminator, as shown below:

[0064]

[0065] Where D is the discriminator, and G(X) is the result of the data passing through the generator and then being fed into the discriminator, denoted as D[G(X)].

[0066] S533: Construct the objective function for relation learning; combine the objective of the relation learning module to construct stable linear dependencies along the channel dimension. Each channel reconstructs itself by examining its neighborhood through linear regression. The relation learning loss is shown below:

[0067]

[0068] S54: Design the loss function of the discriminator; from the perspective of the discriminator, distinguish between real samples and reconstructed samples as accurately as possible, thereby assisting the training of the generator, as shown below:

[0069]

[0070] S55: Adversarial training generator and discriminator, optimizing and reconstructing network parameters.

[0071] Step S55 specifically includes:

[0072] During training, both reconstruction error and adversarial loss will be optimized simultaneously. The training process consists of the following steps:

[0073] S551: Given the original input, generate reconstructed data using a generator;

[0074] S552: Input the real data sample and the generated reconstructed data into the discriminator respectively, and calculate the discriminator's loss for the real data and the loss for the generated data;

[0075] S553: ​​Update the parameters of the discriminator to reduce its loss and enable it to better distinguish between real and generated data;

[0076] S554: Calculate the total loss of the generator, i.e., the data sample that the discriminator wants to mistake for real data;

[0077] S555: Taking into account adversarial loss, reconstruction error loss and relation learning loss, the generator parameters are updated to generate more realistic data samples and enable the autoencoder to better reconstruct the input data;

[0078] S556: Repeat the above training process multiple times, and optimize the generator and discriminator iteratively to enable the reconstruction network to better reconstruct the input.

[0079] S6: Input the data to be detected into the reconstructed network after adversarial training and optimization, and judge the abnormal state of the data by analyzing the reconstruction error. Combine the dependency graph to further infer the abnormal state.

[0080] Step S6 specifically includes:

[0081] S61: Calculate the reconstruction error of the data to be detected; load the reconstruction network model from step S5, input the time series data to be detected into the reconstruction network model to obtain the corresponding reconstructed data, and calculate the error between the data to be detected and the corresponding reconstructed data. The reconstruction error is obtained, where t represents the time point and x... t This represents a vector containing all channel dimensions at time point t. It is the corresponding reconstruction result, e t It is an error;

[0082] S62: Determine the threshold to judge the data status; record the reconstruction error of all dimensions at the current time point, analyze it to understand the degree of difference between the data and the model reconstruction data, select the threshold with the goal of balancing the model's recall and accuracy, and judge the time step with reconstruction error exceeding the threshold as abnormal, and other time steps as normal.

[0083] S63: Further infer the anomaly detection status; after the test data is determined to be abnormal, the dependency graph is used to further diagnose the anomaly. Figure 2 This is a graph showing the inter-channel dependencies learned from the public dataset PSM. It displays the correlations between channels learned from the dataset. For example, the more prominent colors of neighboring channels 13, 14, and 15 indicate a certain correlation between these neighboring channels. If channels 13, 14, and 15 all show anomalies simultaneously, it is highly likely that a system error has occurred. This information can be used to interpret system diagnostic results. When testing multidimensional time-series data over a certain period, it was found that the reconstruction error of the data significantly exceeded the threshold within a short time interval. Retrieving the reconstructed data for each channel easily revealed poor consistency in the reconstruction of channels 13, 14, and 15 within the same time interval. Figure 3 The original data and reconstructed data of channels 13, 14 and 15 are displayed. The gray parts represent the real abnormal segments. During this period, these three channels simultaneously experienced large reconstruction errors, which further verifies the accuracy of the above inference.

Claims

1. An explainable time series data anomaly detection method based on a lightweight reconstruction network, characterized in that, Comprise the following steps: S1: obtaining time series data and then constructing a dataset; S2: constructing an encoding network to obtain encoded latent features; S3: constructing a relationship learning module to obtain the dependency relationship between multiple sequence channels; Step S3 specifically comprises: S31: Randomly initialize nodes: Each node is randomly initialized, expressed as a matrix ; S32: use a fully connected neural network to build a shallow network for representation learning: get node representation after representation learning wherein, representation learning network; S33: Constructing the dependency relationship between each node: according to the formula Constructing the relationship matrix A, where E is each channel node, Tanh and LeakyReLU are activation functions, and is to ensure the sparsity of the adjacency matrix. Each node retains the largest weight of neighbors, so as to obtain the degree matrix according to the formula , where represents the first row and the jth column of the A matrix, represents the first node calculating the degree of the first node according to the neighbor nodes; and according to the formula , the relationship matrix is obtained , where I represents the unit matrix, D -1 represents the inverse of the degree matrix, and the relationship matrix is the inter-channel dependency relationship of the multi-dimensional time series. S4: updating the latent features of the data using the dependency relationship, constructing a decoding network, and inputting the updated latent features into the decoding network to obtain reconstructed data; S5: constructing a generator and a discriminator and optimizing the parameters of the reconstruction network composed of the encoding network, the relationship learning module and the decoding network using an adversarial training method; S6: inputting the data to be detected into the reconstruction network optimized by the adversarial training, and judging the abnormal state of the data by analyzing the reconstruction error, and further inferring the abnormal state in combination with the dependency graph.

2. The method of claim 1, wherein the method is based on a lightweight reconstruction network. Step S1 specifically comprises: S11: data preprocessing: preprocessing the time series data, including missing value processing and data format processing; S12: dividing the dataset: dividing the preprocessed data into a training set and a test set, wherein the training set only contains normal data, and the test set contains both normal data and abnormal data; S13: setting a sliding window and a moving step, cutting the training set and test set data into fixed-length subsequences, i.e. time period data, and converting them into a dataset suitable for model training.

3. The method of claim 1, wherein the method is based on a lightweight reconstruction network-based explainability time series anomaly detection method. Step S2 comprises: Using a feature extraction method based on multi-cycle perspective time series analysis and multi-scale convolution parallel architecture to construct an encoding network, inputting the time period data into the encoding network for learning to obtain encoded latent features, specifically comprising: S21: constructing a feature extraction layer based on multi-cycle perspective and multi-scale convolution in parallel; Step S21 specifically comprises: S211: Transforming 1D data into 2D data: for multi-channel one-dimensional time series where 1D is one-dimensional, 2D is two-dimensional, T is time length, C is the total number of channels, is the space where the data is located. For one-dimensional time series, the periodicity is calculated by the fast Fourier transform of the time dimension, that is: wherein, is selected from a one-dimensional time series of the channel dimension, is the intensity of each frequency component, FFT(·) is the fast Fourier transform, Amp(·) is the calculation of the amplitude, arg is the selection of the first k intensities in the order of magnitude, from the selected intensities the k frequency components corresponding thereto are obtained, is the frequency value corresponding to the intensity value, from the frequency components the most significant period lengths corresponding thereto are calculated;​ Period-based multi-channel one-dimensional time series Reshaped into multiple two-dimensional tensors ; wherein, represents arranging the input in a two-dimensional form by period, represents padding the time series with 0 along the time dimension so that it has the same shape as the reshaped and compatible; S212: multi-scale feature extraction on the converted 2D data: feature extraction on the reshaped two-dimensional tensor through lightweight multi-scale two-dimensional convolution, wherein the multi-scale convolution refers to using multiple convolution kernels of different scales, and further using decomposition convolution on the multi-scale, i.e. decomposing a large convolution kernel into two or more smaller convolution kernels; S213: convert 2D data back to 1D space: converted two-dimensional tensor extract two-dimensional temporal features by multi-scale two-dimensional separation convolution wherein represents the number of layers of the network, represents a two-dimensional tensor the output of the layer after convolution the output of the layer after convolution Converting it back to one-dimensional space for information aggregation: where, represents the periodicity will be reshaped back to one-dimensional space, represents the reshaping back to one-dimensional space, reshaped back to one-dimensional space, represents the zero padding removal, the resulting one-dimensional representation weighted sum of the intensities at their corresponding frequencies, resulting in the final output: wherein ; to map to the range 0-1 according to relative size; S22: build the encoding network by stacking the feature extraction layers, and obtain the latent features corresponding to the time period data; the N-dimensional time series data is represented as , is the time series of the i th dimension, and for each , it is further represented as , is the time dimension of the data, and the compressed representation obtained after each dimension passes through the encoding network is represented as , and then the latent encodings of all dimensions are stacked to obtain , where n represents the channel dimension, represents the latent encoding corresponding to the channel dimension n , represents the function corresponding to the encoder, is the time series corresponding to the channel dimension of the N-dimensional time series data n , and H is the feature matrix stacked by the single-dimensional latent features of all channel dimensions, and N is the number of input channels, which is also the number of nodes.

4. The method of claim 1, wherein the method is based on a lightweight reconstruction network-based explainability time series data anomaly detection method. Step S4 specifically comprises: S41: Utilize the relation matrix Fusing the relation into the latent features to form the final latent features , which keeps the original state of the ratio while sharing information from the neighborhood in the ratio , which keeps the original state of the ratio while sharing information from the neighborhood in the ratio​ S42: The decoder is symmetrical with the encoder in form, adopts the same feature extraction method and also has the weight sharing feature; the decoder is responsible for mapping the features in the latent space to the original space, since this process is performed channel by channel, it is necessary to splice after that to obtain complete multi-dimensional reconstructed data, and the output obtained after the decoding network for each dimension of the compressed code is , denotes a function composed of a decoding network, denotes one dimension of the latent code, denotes the corresponding reconstruction result, and the outputs of all dimensions are stacked to obtain , denotes the reconstruction result of a certain dimension, and the reconstruction results of other dimensions are spliced, and then transposed to make it consistent with the input form of the network to complete data reconstruction.

5. The method of claim 1, wherein the method is based on a lightweight reconstruction network-based explainability time series anomaly detection method. Step S5 specifically comprises: S51: constructing a generator G: adversarial training of the reconstruction network, i.e. using the reconstruction network as a generator G of the generative adversarial network; S52: constructing discriminator D: selecting a fully connected neural network and adopting an activation function to construct discriminator D, an input layer of discriminator D receives input data sent to the reconstruction network and the result data reconstructed by the reconstruction network ; S53: designing the loss function of the generator; the training target of the generator contains three tasks: S531: constructing the objective function of the reconstruction task: from the perspective of the generator, define a reconstruction error loss to measure the performance of the reconstruction network, so that the reconstructed data approximates the real data as much as possible, as follows: wherein, W represents the number of inputs participating in the training, represents the data that has passed through the reconstruction network, i.e. the reconstruction of the input, represents the distance between two variables; S532: constructing the objective function of the adversarial training; define an adversarial loss to make the generator generate more realistic data samples to deceive the discriminator, as follows: wherein D is a discriminator, is the result of data passing through the generator, and then sent to the discriminator, denoted as ; S533: constructing the objective function of relationship learning; combine the target of the relationship learning module to construct a stable linear dependency relationship along the channel dimension, and each channel checks its neighborhood through linear regression to reconstruct itself, and the relationship learning loss is as follows: S54: design the loss function of the discriminator; from the perspective of the discriminator, try to accurately distinguish the real samples and the reconstructed samples, so as to assist the training of the generator, as follows: S55: train the generator and the discriminator in an adversarial manner, and optimize the reconstruction network parameters.

6. The method of claim 5, wherein the method is based on a lightweight reconstruction network. Step S55 specifically includes: During the training process, the reconstruction error and the adversarial loss will be optimized simultaneously, and the training process is divided into the following steps: S551: given the original input, generate reconstructed data through the generator; S552: input the real data samples and the generated reconstructed data into the discriminator respectively, and calculate the loss of the discriminator for the real data and the loss for the generated data; S553: update the parameters of the discriminator to reduce its loss, so that it can better distinguish the real and generated data; S554: calculate the total loss of the generator, that is, the data samples generated are expected to be mistaken by the discriminator as real data; S555: considering the adversarial loss, the reconstruction error loss and the relationship learning loss, update the parameters of the generator, so as to generate more realistic data samples, and make the autoencoder better reconstruct the input data; S556: repeat the above training process for several times, and optimize the generator and the discriminator through iteration, so that the reconstruction network can better reconstruct the input.

7. The method of claim 1, wherein the method is based on a lightweight reconstruction network-based explainability time series anomaly detection method. Step S6 specifically includes: S61: Calculate the data reconstruction error to be detected; load the reconstruction network model of step S5, input the time series data to be detected into the reconstruction network model, obtain the corresponding reconstruction data, and calculate the error between the data to be detected and the corresponding reconstruction data , to obtain the reconstruction error, wherein, t represents a time point, represents a vector containing all channel dimensions at a time point t , is the reconstruction result corresponding thereto, is the error; S62: determine the threshold to judge the data state; record the reconstruction error and of all dimensions at the current time point, analyze the difference between the data and the reconstructed data of the model, and select the threshold to balance the recall rate and the accuracy of the model, and according to the determined threshold, judge the time steps whose reconstruction error exceeds the threshold as abnormal, and judge the other time steps as normal; S63: further infer the abnormality detection state; after the test data is judged as abnormal, further diagnose the abnormality in combination with the dependency graph.

Images