An abnormality detection method and device for satellite telemetry multi-dimensional time series data, medium and product

Abstract

The application provides a kind of satellite telemetry multidimensional time series data-oriented anomaly detection method, device, medium and product, it is related to satellite telemetry multidimensional time series data anomaly detection field, method includes: the satellite telemetry multidimensional time series data to be detected is input into anomaly detection model, and the fusion error of each time is output;Anomaly detection model includes denoising sparse auto-encoder and graph attention network;Denoising sparse auto-encoder learns the low-dimensional feature of input satellite telemetry multidimensional time series data, reconstructs satellite telemetry multidimensional time series data, generates reconstruction error;Graph attention network extracts the correlation between different reconstructed satellite telemetry multidimensional time series data from two levels of causality and similarity, generates prediction error;Generate the fusion error of each time, judge whether the satellite telemetry multidimensional time series data to be detected exists anomaly;If yes, record abnormal time point.The application can be suitable for satellite telemetry multidimensional time series data of different dimensions, improve anomaly detection precision.

Description

An anomaly detection method, device, medium, and product for satellite telemetry multidimensional time series data. Technical Field

[0001] This invention relates to the field of anomaly detection in satellite telemetry multidimensional time series data, and in particular to anomaly detection method, device, medium, and product for satellite telemetry multidimensional time series data. Background Technology

[0002] Satellites are highly sophisticated systems composed of numerous complex components that are interconnected and work in concert. However, satellites in orbit operate in the extreme and harsh conditions of outer space. Abnormal conditions such as high temperatures, extreme cold, and vibrations can cause satellite performance degradation, functional failure, and ultimately, system-wide shutdown. Early signs of satellite failure include anomalies; therefore, real-time detection and location of anomalies during satellite operation are crucial for routine maintenance and extending the lifespan of satellites in orbit.

[0003] During satellite operation, sensors on various components generate a large amount of time-series data. This data is collected by the sensors and eventually transmitted to the ground telemetry center for storage as telemetry time-series data. This data records key information such as temperature, voltage, current, and deflection angle of various satellite components, and contains rich interaction processes and status information, which is an important basis for detecting and predicting the satellite's operational status.

[0004] Satellite telemetry time series data is characterized by its large volume and high dimensionality. Traditional model-based anomaly detection methods require specialized domain knowledge, and many model-based methods are not effective. In recent years, deep learning methods have been highly developed, and the structure and computing power of deep learning have been further optimized and improved. They are widely used in various fields. Considering the advantages and characteristics of deep learning methods, deep learning anomaly detection methods have also begun to be widely used in anomaly detection of satellite telemetry time series data.

[0005] However, during satellite operation, changes in key indicators depend not only on historical information but also on the interactions between relevant variables. Past anomaly detection methods, whether traditional model-based or machine learning-based, could only capture linear relationships between different time series in a simple way. But in satellite systems, complex nonlinear correlations often exist between different telemetry time series data, leading to the limitations of previous methods.

[0006] Currently, prediction-based deep learning anomaly detection methods, represented by graph neural networks, treat each time series as a node on a graph and extract the correlation between different time series data by constructing feature maps. However, the performance of such methods depends too much on the size of the feature relationship graph, and graph neural networks are suitable for high-dimensional datasets. Therefore, when the graph is too sparse or the number of nodes in the graph is too small, it will cause a performance bottleneck for the model.

[0007] Existing deep learning anomaly detection methods based on reconstruction, such as autoencoders, use time-series data as training samples to input into the model, extract low-dimensional features from the original data, and finally reconstruct the original input. This approach is suitable when the graph is too sparse or the number of nodes in the graph is too small. However, this approach treats each input sample as an isolated sample, loses information in the time dimension, and isolates and ignores the correlation between time-series data. When the correlation between time-series data is strong, it will cause a performance bottleneck for the model.

[0008] Satellite telemetry time series data are usually multi-dimensional time series data. Since existing anomaly detection methods cannot take into account time series data of different dimensions, anomaly detection has the problem of low detection accuracy when performing anomaly detection on multi-dimensional time series data. Summary of the Invention

[0009] The purpose of this invention is to provide an anomaly detection method, device, medium, and product for multi-dimensional time-series satellite telemetry data, in order to solve the problem that existing anomaly detection methods cannot take into account time-series data of different dimensions, resulting in low anomaly detection accuracy.

[0010] To achieve the above objectives, the present invention provides the following solution:

[0011] An anomaly detection method for multidimensional time-series satellite telemetry data includes:

[0012] The satellite telemetry multidimensional time-series data to be detected is input into an anomaly detection model, which outputs the fusion error at each time step. The anomaly detection model includes a denoising sparse autoencoder and a graph attention network. The denoising sparse autoencoder learns the low-dimensional features of the input satellite telemetry multidimensional time-series data and reconstructs the data based on these features, generating a reconstruction error. The graph attention network extracts the correlations between the reconstructed satellite telemetry multidimensional time-series data from both causal and similarity perspectives, generating a prediction error, and then generates the fusion error at each time step based on the reconstruction error and the prediction error. The correlations include causal and similarity relationships. The low-dimensional features are those below a set dimension.

[0013] The fusion error is used to determine whether there are any anomalies in the satellite telemetry multidimensional time series data to be detected;

[0014] If so, record the abnormal time point;

[0015] If not, check the satellite telemetry multidimensional time series data for the next moment.

[0016] Optionally, the construction process of the anomaly detection model specifically includes:

[0017] The denoised sparse autoencoder is used to learn the low-dimensional features of satellite telemetry multidimensional time series data;

[0018] Satellite telemetry multidimensional time series data are divided according to satellite subsystems, and the causal relationship of satellite telemetry multidimensional time series data within the same satellite subsystem is identified using an improved transfer entropy method.

[0019] Based on the aforementioned causal relationship, a similarity-based automatic learning method is used to identify the similarity relationships between satellite telemetry multidimensional time series data of different satellite subsystems;

[0020] Construct the graph structure in the graph attention network based on the causal relationship and the similarity relationship;

[0021] The low-dimensional features are input into a graph attention network with the graph structure to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next moment;

[0022] Based on the low-dimensional features, the satellite telemetry multi-dimensional time series data input by the denoised sparse autoencoder is reconstructed using a decoder to generate the reconstruction results of each satellite telemetry multi-dimensional time series data.

[0023] Based on the prediction results, the reconstruction results, and the reconstruction error between the input satellite telemetry multidimensional time series data, a fusion error is generated;

[0024] Construct a fusion loss function based on the fusion error;

[0025] Based on the fusion loss function, the anomaly detection model is trained using a sample training set to construct the anomaly detection model; the sample training set includes historical satellite telemetry multidimensional time series data.

[0026] Optionally, the construction process of the noise-reducing sparse autoencoder specifically includes:

[0027] Random noise is introduced into the input layer of the denoised sparse autoencoder, and the denoised sparse autoencoder is trained to take noisy satellite telemetry multidimensional time series data as input to recover noise-free satellite telemetry multidimensional time series data.

[0028] KL divergence is introduced as a penalty term to penalize the activation of the hidden layer of the denoised sparse autoencoder, thereby determining the loss function of the denoised sparse autoencoder.

[0029] Based on the loss function of the denoised sparse autoencoder, the denoised sparse autoencoder is trained to generate a trained denoised sparse autoencoder.

[0030] Optionally, an improved transfer entropy method can be used to identify causal relationships among satellite telemetry multidimensional time-series data belonging to the same satellite subsystem, specifically including:

[0031] Calculate the transfer entropy between telemetry multidimensional time-series data of two satellites within the same satellite subsystem;

[0032] The causal relationship diagram is determined based on the transfer entropy, and the causal relationship between satellite telemetry multidimensional time series data within the same satellite subsystem is determined based on the causal relationship diagram.

[0033] Optionally, based on the aforementioned causal relationship, a similarity-based automatic learning method is used to identify the similarity relationships between multidimensional time-series satellite telemetry data from different satellite subsystems, specifically including:

[0034] An embedding vector is randomly initialized for each dimension of satellite telemetry multidimensional time series data, and the similarity between the embedding vectors is used to reflect the similarity between different satellite telemetry multidimensional time series data.

[0035] For each node in the causal relationship graph, the causal relationships in the causal relationship graph are used as prior knowledge to determine the candidate relationship for each embedding vector; the candidate relationship is the neighbor node of the embedding vector; each node corresponds to satellite telemetry multidimensional time series data.

[0036] Based on the candidate relationship, the similarity between two embedding vectors is calculated; the similarity between the two embedding vectors is used to reflect the similarity between different satellite telemetry multidimensional time series data.

[0037] The similarity relationship of satellite telemetry multidimensional time series data of different satellite subsystems is determined based on the similarity between two embedding vectors.

[0038] Optionally, the low-dimensional features are input into a graph attention network with the graph structure to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next time step, specifically including:

[0039] The embedding vector is concatenated with the satellite telemetry multidimensional time series data corresponding to the node, and the concatenated node feature representation is used as the input feature vector of the graph attention network; the input feature vector is used as the low-dimensional feature.

[0040] For the input feature vector, the feature vectors of neighboring nodes are aggregated using attention scores to generate an aggregated feature vector;

[0041] The aggregated feature vectors are input into the fully connected layer of the graph attention network to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next moment.

[0042] Optionally, the fusion loss function L total for:

[0043] L total =λL Forecasting +(1-λ)L Reconstruction ;

[0044] Where λ is the equilibrium parameter; L Forecasting For prediction error; L Rreconstruction This represents the reconstruction error.

[0045] A computer device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described anomaly detection method for multidimensional time-series satellite telemetry data.

[0046] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described anomaly detection method for multidimensional time-series satellite telemetry data.

[0047] A computer program product includes a computer program / instructions that, when executed by a processor, implement the steps of the above-described anomaly detection method for multidimensional time-series satellite telemetry data.

[0048] According to specific embodiments provided by the present invention, the following technical effects are disclosed: The embodiments of the present invention, by combining a denoised sparse autoencoder and a graph attention network, fully utilize the advantages of each. The denoised autoencoder learns a sparse latent representation (i.e., low-dimensional features) of the input data. This more expressive and robust latent representation is used for subsequent decoder reconstruction and as input to the graph attention network. In the graph attention network, latent relationships between different time series are extracted from both causal and similarity perspectives, which helps the model perform well on high-dimensional datasets. The present invention integrates two anomaly detection methods—denoised sparse autoencoders and graph attention networks—and is applicable to low-dimensional, medium-dimensional, and high-dimensional datasets, improving anomaly detection accuracy and significantly enhancing the applicability and robustness of the anomaly detection method. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 is a flowchart of the anomaly detection method for multi-dimensional time-series satellite telemetry data provided by the present invention.

[0051] Figure 2 is a schematic diagram of the construction of the anomaly detection model provided by the present invention;

[0052] Figure 3 is a schematic diagram of the construction of the graph structure in the graph attention network provided by the present invention;

[0053] Figure 4 is a diagram of the internal structure of the computer device provided by the present invention. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] The purpose of this invention is to provide an anomaly detection method, device, medium, and product for satellite telemetry multidimensional time series data, which can be applied to satellite telemetry multidimensional time series data of different dimensions and improve the accuracy of anomaly detection.

[0056] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0057] Example 1

[0058] As shown in Figure 1, this invention provides an anomaly detection method for multi-dimensional time-series satellite telemetry data, including:

[0059] Step 101: Input the satellite telemetry multidimensional time series data to be detected into the anomaly detection model and output the fusion error at each time step; the anomaly detection model includes a denoising sparse autoencoder and a graph attention network; the denoising sparse autoencoder is used to learn the low-dimensional features of the input satellite telemetry multidimensional time series data, and reconstruct the satellite telemetry multidimensional time series data according to the low-dimensional features to generate a reconstruction error; the graph attention network is used to extract the correlation between different reconstructed satellite telemetry multidimensional time series data from the perspectives of causality and similarity, generate a prediction error, and generate the fusion error at each time step according to the reconstruction error and the prediction error; the correlation includes causal relationships and similarity relationships; the low-dimensional features are features below a set dimension.

[0060] Step 102: Determine whether there is an anomaly in the satellite telemetry multidimensional time series data to be detected based on the fusion error; if yes, proceed to step 103; if no, proceed to step 104.

[0061] Step 103: Record the abnormal time points.

[0062] Step 104: Detect the satellite telemetry multidimensional time series data for the next moment.

[0063] In practical applications, as shown in Figure 2, the construction process of the anomaly detection model specifically includes: learning low-dimensional features of satellite telemetry multidimensional time-series data using the denoising sparse autoencoder; dividing the satellite telemetry multidimensional time-series data according to satellite subsystems, and using an improved transfer entropy method to identify causal relationships among satellite telemetry multidimensional time-series data within the same satellite subsystem; based on the causal relationships, using a similarity-based automatic learning method to identify similarity relationships among satellite telemetry multidimensional time-series data from different satellite subsystems; constructing the graph structure in the graph attention network based on the causal relationships and the similarity relationships; and inputting the low-dimensional features into the graph structure. In the constructed graph attention network, the prediction results of each satellite telemetry multidimensional time series data at the next moment are determined; based on the low-dimensional features, the satellite telemetry multidimensional time series data input by the denoising sparse autoencoder are reconstructed using a decoder to generate the reconstruction results of each satellite telemetry multidimensional time series data; a fusion error is generated based on the prediction results, the reconstruction results, and the reconstruction error between the input satellite telemetry multidimensional time series data; a fusion loss function is constructed based on the fusion error; based on the fusion loss function, the anomaly detection model is trained using a sample training set to construct the anomaly detection model; the sample training set includes historical satellite telemetry multidimensional time series data.

[0064] In practical applications, the construction process of the denoised sparse autoencoder specifically includes: introducing random noise into the input layer of the denoised sparse autoencoder to train it to take noisy satellite telemetry multidimensional time-series data as input to recover noise-free satellite telemetry multidimensional time-series data; introducing KL divergence as a penalty term to penalize the activation of the hidden layer of the denoised sparse autoencoder to determine the loss function of the denoised sparse autoencoder; and training the denoised sparse autoencoder based on its loss function to generate a trained denoised sparse autoencoder.

[0065] Furthermore, to learn a more expressive latent representation of the input data, this invention utilizes a denoising sparse autoencoder method to learn a sparse latent representation of the input telemetry data. A sparse autoencoder essentially adds sparse constraints to an autoencoder, enabling the neural network to extract features and structure from samples even with a large number of hidden layer neurons.

[0066] The principle of achieving sparsity is to use a penalty term to penalize the activation values ​​of the hidden layer, making the average value of the output of the hidden layer neurons close to 0. This invention uses KL divergence as the penalty term, and the formula for KL divergence is as follows:

[0067]

[0068] Where p and q are the probability distributions of the input data, which are essentially a measure of the difference between two probability distributions.

[0069] After introducing KL divergence, the loss function of the sparse autoencoder changes to:

[0070]

[0071] Where L2 represents the input data x and its reconstructed output. The mean squared error between them, the latter part of the formula represents the KL divergence term, that is, the KL divergence formula that satisfies the binomial distribution, where ρ represents the desired average activation value. This represents the average activation level of the i-th neuron node, each They will all move closer to ρ. β is the weight of the KL divergence, which controls the proportion of the KL divergence.

[0072] The sparse autoencoder is trained to minimize the reconstruction error and the distribution ρ. The distance between them is used to obtain more expressive low-dimensional features of the input data.

[0073] To enable the sparse autoencoder to learn more robust features, this invention introduces random noise into the input layer of the sparse autoencoder. Training the sparse autoencoder can use the noisy original data as input to recover the true original data, thus forming a more robust denoised sparse autoencoder. Since satellites operate in harsh outer space, the telemetry time series data they collect often contains noise. Therefore, the denoised sparse autoencoder can achieve better anomaly detection results on telemetry time series datasets.

[0074] Furthermore, regarding the graph neural network graph construction, this invention combines rule-based and learning-based graph construction methods to overcome the shortcomings of each method. It extracts the complex correlations between different telemetry time series features from the perspectives of causality and similarity, which is the basis for the anomaly detection model proposed in this invention to achieve excellent detection results in high-dimensional datasets, as shown in Figure 3.

[0075] In practical applications, the improved transfer entropy method is used to identify causal relationships among satellite telemetry multidimensional time-series data belonging to the same satellite subsystem. Specifically, this includes: calculating the transfer entropy between two satellite telemetry multidimensional time-series data within the same satellite subsystem; determining a causal relationship graph based on the transfer entropy; and determining the causal relationships among satellite telemetry multidimensional time-series data within the same satellite subsystem based on the causal relationship graph.

[0076] Specifically, a satellite is a complex industrial system composed of multiple satellite subsystems (hereinafter referred to as subsystems). The relationships between variables within a subsystem often exhibit causal relationships, while the relationships between subsystems mainly exhibit similarity relationships. Therefore, this invention first uses an improved transfer entropy method to extract the causal relationships between variables within a subsystem, and then uses the cosine similarity method to calculate the similarity relationships between subsystems.

[0077] For two telemetry time series data points x and y to be analyzed, calculate the transfer entropy TE between them. x-＞y The improved transfer entropy formula is shown below:

[0078]

[0079] As shown in the above formula, Let represent two satellite telemetry time series, where n represents the length of the two time series, k and l are the implantation dimensions of the two time series, representing the influence of the current state x on the previous k x states and the previous l y states, i.e., the order of the Markov model. p(·|·) is the conditional probability density. and These represent the measured values ​​of x and y at the current moment, respectively. n+1 p(y) represents the measurement of y at the next future moment. n+1|y n (l) ,x n (k) () indicates that x and y take values ​​at the current time. In the case where y takes the value y in the next future moment. n+1 The conditional probability, similar to that, p(y) n+1 |y n (l) () indicates that y takes the value at the current moment. In the case where y takes the value y in the next future moment. n+1 The conditional probability.

[0080] TE x→y The transfer entropy value represents the transfer entropy from time series x to y. Calculating the transfer entropy between different time series first requires determining three parameters n, k, and l. As mentioned above, k and l are the implantation dimensions of x and y, and n is the total length of satellite telemetry time series data required to calculate the transfer entropy once for time series x and y. Past methods for determining parameters often relied on past experience or relevant domain knowledge. However, for multidimensional satellite telemetry time series data, since it is not a strictly Markov process and there is no prior knowledge from the relevant domain to provide for parameter determination, this invention uses grid search to determine k and l. The parameter that maximizes the transfer entropy of two time series is used as the final determined parameter. Simultaneously, this invention uses Fourier transform to determine the satellite's orbital period, using integer multiples of the satellite's orbital period as the value of parameter n.

[0081] Based on the aforementioned transfer entropy, a causal relationship graph can be obtained, as shown in the following equation:

[0082]

[0083] W represents the adjacency matrix of the cause-effect graph, X i X represents the telemetry time series data represented by time series feature i. j This indicates that time series feature j represents the telemetry time series data. To represent the time series x j To time series x i The propagation entropy value, ω j,i Let ω be the value of the element in row j and column i of the adjacency matrix. i,j ω represents the value of the element in row i and column j of the adjacency matrix. If the propagation entropy from time series feature i to time series feature j is greater than the propagation entropy from time series feature j to time series feature i, it means that the direction of the causal relationship between the two is i to j, i.e., ω i,j =1, and there are also edges pointing from i to j in the causal graph. In this way, the causal graph can be constructed.

[0084] In practical applications, based on the causal relationship, a similarity-based automatic learning method is used to identify the similarity relationships of satellite telemetry multidimensional time-series data from different satellite subsystems. Specifically, this includes: randomly initializing an embedding vector for each dimension of satellite telemetry multidimensional time-series data, and using the similarity between the embedding vectors to reflect the similarity between different satellite telemetry multidimensional time-series data; for nodes in the causal relationship graph, using the causal relationships in the graph as prior knowledge to determine candidate relationships for each embedding vector; the candidate relationships are the neighboring nodes of the embedding vector; each node corresponds to satellite telemetry multidimensional time-series data; based on the candidate relationships, calculating the similarity between two embedding vectors; the similarity between two embedding vectors is used to reflect the similarity between different satellite telemetry multidimensional time-series data; and determining the similarity relationships of satellite telemetry multidimensional time-series data from different satellite subsystems based on the similarity between the two embedding vectors.

[0085] Furthermore, the causal relationships analyzed using the transfer entropy method mainly exist between variables within a subsystem. However, for variables belonging to different subsystems, it is necessary to construct a graph from the perspective of similarity.

[0086] First, an embedding vector v is randomly initialized for each dimension of telemetry time series feature, i.e., telemetry time series data. i The similarity between embedded vectors reflects the similarity of different telemetry time series features.

[0087] For each node in the graph, the relationships obtained from the causal graph are used as prior knowledge. This prior knowledge can be flexibly represented as a set of candidate relationships C for each feature i. i That is, its neighboring nodes, the specific formula is as follows:

[0088]

[0089] The remaining similarity relationships are constructed using an automatic learning method. For a node i, the cosine similarity between its embedding vector and the embedding vector of its many potential neighbor node j is calculated according to the following formula.

[0090]

[0091] e jiThe similarity between the embedded vectors of telemetry time series features j and i is represented by the similarity between the embedded vectors. This invention uses the similarity between the embedded vectors to reflect the similarity between different telemetry features. The specific calculation method is shown in the above formula. The numerator represents the inner product of the embedded vectors of time series features i and j, and the denominator is the product of the magnitudes of the two vectors. The above calculation result is essentially the cosine similarity between the two embedded vectors. The larger the cosine similarity, the more similar the two vectors are, and it also reflects the similarity relationship between time series features.

[0092] From these similarity measures, an element of the adjacency matrix can be defined as follows.

[0093]

[0094] A j,i =1 In the graph structure, the node representing telemetry time series feature j and the node representing telemetry time series feature i are neighboring nodes, and there are edges connecting them. A j,i The result is the similarity relationship obtained through similarity calculation.

[0095] That is, first calculate e ji e ji Embed normalized dot products of vectors for nodes i and j, then determine a hyperparameter K, which can be adjusted in subsequent experiments based on the anomaly detection performance. Finally, select the largest k-|c i The indices corresponding to the normalized dot products are used as the neighboring nodes of this node. i | indicates the number of relationships that the node has already defined in the causal graph. The formula in parentheses indicates that the above edge connections are made after excluding edges already constructed in the causal graph. If the edge e calculated using similarity is used... ki The set C of edges that exist in the construction of the causal graph i Then, there is no need to repeat the construction. Finally, the edges obtained from the causal graph are merged with the edges obtained from the similarity calculation to complete the construction of the graph structure.

[0096] To address the issue of excessively time-consuming training in graph learning methods, this invention proposes an early termination strategy. Specifically, experiments have shown that the edges in most graph structures are composed of causal relationships. Since causal relationships remain unchanged during the training process of graph learning methods, while similarity-based relationships need to be adjusted based on the input data each time training begins, excessive training adjustments are unnecessary due to the relatively small proportion of similarity relationships. Therefore, this invention stipulates that graph learning stops when the causal graph is identical for three consecutive times, and the graph structure of the last occurrence is used as the final graph attention network structure.

[0097] In practical applications, the low-dimensional features are input into a graph attention network with the graph structure to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next moment. Specifically, this includes: concatenating the embedding vector with the satellite telemetry multi-dimensional time series data corresponding to the node, and using the concatenated node feature representation as the input feature vector of the graph attention network; the input feature vector is used as the low-dimensional feature; for the input feature vector, the feature vectors of neighboring nodes are aggregated using attention scores to generate an aggregated feature vector; the aggregated feature vector is input into the fully connected layer of the graph attention network to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next moment.

[0098] Furthermore, this invention employs a Graph Attention Network (GAT) as the prediction module of the anomaly detection model to predict future telemetry time-series data. The Graph Attention Network uses the learned graph structure to construct the graph.

[0099] Unlike traditional GAT which directly inputs the telemetry time-series features of nodes into the computation, this method concatenates the embedding vectors and the node's time-series features as input. The specific implementation is shown in the following equation:

[0100] h i (t) =v i ||ωz i (t) .

[0101] Where || represents the join operation. This represents the input features of node i in layer t. This represents the feature representation of the i-th node after the connection.

[0102] Graph attention networks aggregate the feature vectors of neighboring nodes using attention, given an input feature vector. The attention score α... i,j Calculate using the following formula:

[0103]

[0104] The normalized attention score, e, is given by the above formula. i,j These are the attention coefficients before normalization, and the calculation process is shown in the following formula:

[0105] e i,j =Leaky Re LU(α) T ·(h i (t) ||h j (t) )).

[0106] α TLet h be the weight matrix. i (t) h is the feature representation of the i-th node. j (t) is the feature representation of the j-th node, and LeakyReLU is a non-linear activation function.

[0107] The aggregate representation of the final node Z i Defined as follows:

[0108]

[0109] Where ReLU is a non-linear activation function, a i,j z represents the attention coefficient between feature i and feature j, ω represents the weight matrix, and z represents the attention coefficient between feature i and feature j. i and z j This represents the temporal characteristics of the current node i and node j.

[0110] Finally, the final result is input into the fully connected layer to obtain the final prediction output, and the difference between the prediction output and the actual data is calculated to obtain the prediction error.

[0111] Furthermore, to accomplish the anomaly detection task, it is first necessary to jointly optimize the denoising sparse autoencoder and the graph attention network. Unlike simple reconstruction-based and prediction-based models, the fusion model needs to jointly optimize the two models mentioned above and minimize the fusion loss function, which is defined as follows:

[0112] L total =λL Forecasting +(1-λ)L Reconstruction .

[0113] Where λ represents the balancing parameter, which takes values ​​from 0 to 1, and is used to balance the prediction error and the balancing error. Forecasting The prediction error is represented by the root mean square error (RMSE) defined in this invention. Reconstruction This indicates the reconstruction error.

[0114] The fusion model is jointly optimized using the aforementioned fusion error function to obtain a trained fusion anomaly detection model. Since the model employs a parallel joint optimization scheme for reconstruction and prediction, two sets of anomaly scores will be obtained at the end of training. Therefore, to compensate for erroneous predictions made by either the reconstruction or prediction model, this invention uses a weighted harmonic mean to calculate the fusion anomaly score. Then, using the fusion anomaly score as a sample, and employing an anomaly threshold determined in the validation set as a threshold, when the fusion anomaly score exceeds the threshold, it is determined that the satellite telemetry multidimensional time-series data to be detected is abnormal, and the time point of the anomaly is recorded.

[0115] This invention provides an unsupervised method for anomaly detection in multidimensional time-series data based on a denoised sparse autoencoder and a graph attention network. Complex correlations often exist between multidimensional time series. Although machine learning and deep learning methods have shown great potential in anomaly detection in recent years, they often overlook the complex relationships between different time series and face bottlenecks when dealing with low- to medium-dimensional datasets. This invention proposes a multidimensional time-series fusion anomaly detection method based on a denoised sparse autoencoder and a graph attention network. The denoised sparse autoencoder learns a sparse latent representation of the input data. This more expressive and robust latent representation is used for subsequent decoder reconstruction and as input to the graph attention network. A causal graph learning method is designed in the causal graph attention module to extract the complex relationships between different time series data from both causal and correlation perspectives. Joint optimization of the reconstruction-based model and the prediction-based model makes the fusion anomaly detection model more robust, combining the advantages of both models. Therefore, it can be applied to low-, medium-, and high-dimensional anomaly detection telemetry time-series datasets.

[0116] Example 2

[0117] A computer device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor. The processor executes the computer program to implement the steps of the anomaly detection method for multidimensional time-series satellite telemetry data in Embodiment 1.

[0118] Example 3

[0119] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the anomaly detection method for satellite telemetry multidimensional time-series data in Embodiment 1.

[0120] Example 4

[0121] A computer program product includes a computer program that, when executed by a processor, implements the steps of the anomaly detection method for multidimensional time-series satellite telemetry data in Embodiment 1.

[0122] Example 5

[0123] A computer device, which may be a database, has an internal structure as shown in Figure 4. The computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores pending transactions. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the anomaly detection method for multi-dimensional time-series satellite telemetry data in Embodiment 1.

[0124] It should be noted that the object information (including but not limited to object device information, object personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this invention are all information and data authorized by the object or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0125] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided by this invention can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided by this invention may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided by this invention may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0126] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0127] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for anomaly detection in multidimensional time-series satellite telemetry data, characterized in that, include: The satellite telemetry multidimensional time series data to be detected is input into the anomaly detection model, and the fusion error at each time point is output. The anomaly detection model includes a denoised sparse autoencoder and a graph attention network; The denoising sparse autoencoder is used to learn the low-dimensional features of the input satellite telemetry multidimensional time-series data, and reconstruct the satellite telemetry multidimensional time-series data based on the low-dimensional features to generate a reconstruction error; the graph attention network is used to extract the correlation between different reconstructed satellite telemetry multidimensional time-series data from two levels: causality and similarity, to generate a prediction error, and to generate a fusion error for each time step based on the reconstruction error and the prediction error; the correlation includes causal relationships and similarity relationships; the low-dimensional features are features with a dimension lower than a set value. The construction process of the anomaly detection model specifically includes: learning low-dimensional features of satellite telemetry multidimensional time-series data using the denoised sparse autoencoder; dividing the satellite telemetry multidimensional time-series data according to satellite subsystems, and identifying causal relationships between satellite telemetry multidimensional time-series data within the same satellite subsystem using an improved transfer entropy method, specifically including: calculating the transfer entropy between two satellite telemetry multidimensional time-series data within the same satellite subsystem; determining a causal relationship graph based on the transfer entropy, and determining causal relationships between satellite telemetry multidimensional time-series data within the same satellite subsystem based on the causal relationship graph; identifying similarity relationships between satellite telemetry multidimensional time-series data from different satellite subsystems based on the causal relationships and the similarity relationships; constructing the graph structure in the graph attention network based on the causal relationships and the similarity relationships; and inputting the low-dimensional features into a graph with... In a graph attention network with the aforementioned graph structure, the prediction results of each satellite telemetry multidimensional time series data at the next time step are determined. Based on the low-dimensional features, the satellite telemetry multidimensional time series data input to the denoised sparse autoencoder are reconstructed using a decoder to generate reconstruction results for each satellite telemetry multidimensional time series data. A fusion error is generated based on the prediction results, the reconstruction results, and the reconstruction error between the input satellite telemetry multidimensional time series data. A fusion loss function is constructed based on the fusion loss function. The anomaly detection model is trained using a sample training set to construct an anomaly detection model. The sample training set includes historical satellite telemetry multidimensional time series data. The anomaly is determined based on the fusion error. If anomalies are found in the satellite telemetry multidimensional time series data to be detected, the anomaly time point is recorded. If not, the satellite telemetry multidimensional time series data at the next time step is detected.

2. The anomaly detection method for multi-dimensional time-series satellite telemetry data according to claim 1, characterized in that, The construction process of the denoised sparse autoencoder specifically includes: introducing random noise into the input layer of the denoised sparse autoencoder to train it to take noisy satellite telemetry multidimensional time-series data as input to recover noise-free satellite telemetry multidimensional time-series data; introducing KL divergence as a penalty term to penalize the activation values ​​of the hidden layer of the denoised sparse autoencoder to determine the loss function of the denoised sparse autoencoder; and training the denoised sparse autoencoder based on its loss function to generate a trained denoised sparse autoencoder.

3. The anomaly detection method for multidimensional time-series satellite telemetry data according to claim 1, characterized in that, Based on the causal relationship, a similarity-based automatic learning method is used to identify the similarity relationships of satellite telemetry multidimensional time-series data from different satellite subsystems. Specifically, this includes: randomly initializing an embedding vector for each dimension of satellite telemetry multidimensional time-series data, and using the similarity between the embedding vectors to reflect the similarity between different satellite telemetry multidimensional time-series data; for nodes in the causal relationship graph, using the causal relationships in the graph as prior knowledge, determining candidate relationships for each embedding vector; the candidate relationships are the neighboring nodes of the embedding vector; each node corresponds to satellite telemetry multidimensional time-series data; calculating the similarity between two embedding vectors based on the candidate relationships; the similarity between two embedding vectors is used to reflect the similarity between different satellite telemetry multidimensional time-series data; and determining the similarity relationships of satellite telemetry multidimensional time-series data from different satellite subsystems based on the similarity between the two embedding vectors.

4. The anomaly detection method for multidimensional time-series satellite telemetry data according to claim 3, characterized in that, The low-dimensional features are input into a graph attention network with the graph structure to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next time step. Specifically, this includes: concatenating the embedding vector with the satellite telemetry multi-dimensional time series data corresponding to the node, and using the concatenated node feature representation as the input feature vector of the graph attention network; the input feature vector is used as the low-dimensional feature; for the input feature vector, the feature vectors of neighboring nodes are aggregated using attention scores to generate an aggregated feature vector; the aggregated feature vector is input into the fully connected layer of the graph attention network to determine the prediction results of the multi-dimensional time series data of each satellite telemetry at the next time step.

5. The anomaly detection method for multidimensional time-series satellite telemetry data according to claim 1, characterized in that, The fusion loss function for: ;in, For balance parameters; This represents the prediction error; This represents the reconstruction error.

6. A computer device, comprising: The memory and processor contain a computer program stored in the memory and executable on the processor, characterized in that the processor executes the computer program to implement the steps of the anomaly detection method for satellite telemetry multidimensional time series data as described in any one of claims 1-5.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the anomaly detection method for satellite telemetry multidimensional time-series data as described in any one of claims 1-5.

8. A computer program product, comprising a computer program, characterized in that, When the computer program / instruction is executed by the processor, it implements the steps of the anomaly detection method for multidimensional time-series satellite telemetry data as described in any one of claims 1-5.

Images