A central air conditioning system anomaly detection method based on graph mining

Abstract

The application discloses a central air conditioning system anomaly detection method based on graph mining, and the method comprises the following steps: acquiring central air conditioning system operation data and outdoor meteorological data, and constructing a multi-source data set; performing data cleaning on continuous data in the multi-source data set, performing feature screening on the multi-source data set after the data cleaning is completed, and acquiring sensitive features of an anomaly detection model; constructing a data graph network, performing frequent subgraph mining on a historical data graph network, and acquiring frequent operation modes of the central air conditioning system; calculating an anomaly score of an anomaly data graph; determining a threshold according to an inflection point of the anomaly data graph, marking the frequent operation modes with anomaly scores exceeding the threshold as abnormal operation modes; and marking data that does not match the data graph network and the frequent subgraph under the same operation mode. The application solves the problem of high latitude and high coupling of equipment operation data, and improves the efficiency of graph mining.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of abnormal data detection, and particularly relates to a central air conditioning system abnormality detection method based on graph mining. BACKGROUND

[0002] Central air conditioning system abnormality detection refers to analyzing based on historical data, monitoring, analyzing and identifying abnormal states or behaviors in the running process of the central air conditioning system that are different from most running states, and features that are inconsistent with normal running modes, so as to realize timely detection and diagnosis of system abnormality. Through central air conditioning system abnormality detection, managers can help identify abnormal running modes in time, make adjustments, and improve the reliability, safety and efficiency of the system. In addition, abnormality detection also helps preventive maintenance, timely discovery of potential problems and repair, prolongs the service life of equipment, reduces operation and maintenance costs, and improves user experience and service quality.

[0003] The running data of the central air conditioning system has problems such as many running parameters, strong parameter coupling, and lack of abnormal label data. The increase in the number and types of running parameters can greatly increase the computational load and complexity of the model. The strong coupling between data increases the difficulty of air conditioning running state abnormality detection, and the lack of abnormal labels makes it difficult to apply supervised learning-based abnormality detection models to engineering practice, limiting the accuracy of abnormality detection. Among commonly used unsupervised anomaly detection methods, clustering methods are not suitable for high-dimensional data and are commonly used for low-dimensional anomaly detection work such as equipment failure or sensor failure; association rule mining methods are inefficient for large-scale data sets, lack structural information, and the mining results are relatively simple, lacking intuitiveness and integrity; self-organizing artificial neural network algorithms can effectively process complex data, but require selecting appropriate features, and the model lacks interpretability, making it difficult to determine the cause of the anomaly. SUMMARY

[0004] The main purpose of the present application is to overcome the shortcomings and deficiencies of the prior art, and to provide a central air conditioning system abnormality detection method based on graph mining, a high-dimensional data feature extraction method based on the DIFFI algorithm, which overcomes the shortcomings of commonly used feature selection algorithms for classification and regression problems, selects typical features for anomaly detection, and solves the problem of high-dimensional and highly coupled equipment running data, and improves the efficiency of graph mining.

[0005] In order to achieve the above purpose, the following technical solutions are adopted in the present application:

[0006] In a first aspect, the present application provides a central air conditioning system abnormality detection method based on graph mining, comprising the following steps:

[0007] Obtain central air conditioning system running data and outdoor meteorological data, and construct a multi-source data set;

[0008] The continuous data in the multi-source data set is cleaned, and the multi-source data set after data cleaning is subjected to feature screening to obtain sensitive features of the anomaly detection model; the continuous data includes non-steady-state data, mutation values, missing values and logical abnormal values;

[0009] According to the distribution mode of the running data, a data discretization method is selected, and the sensitive features are divided into corresponding intervals;

[0010] The correlation between various sensitive features is analyzed, and a data graph network is constructed; the historical data graph network is subjected to frequent subgraph mining to obtain frequent running modes of the central air conditioning system;

[0011] The data graph network and the frequent subgraph at each moment are compared, abnormal data graphs are identified, and the abnormal scores of the abnormal data graphs are calculated; a threshold value is determined according to the inflection point of the abnormal data graph, and the frequent running mode whose abnormal score exceeds the threshold value is marked as an abnormal running mode;

[0012] Data that does not match the data graph network and the frequent subgraph under the same running mode is marked.

[0013] As a preferred technical solution, the feature screening of the multi-source data set after data cleaning comprises:

[0014] S21, correlation analysis is performed by using the Pearson correlation coefficient to eliminate collinear features;

[0015] S22, the most sensitive data to the anomaly detection model is screened out by using a deep-based isolation forest feature selection algorithm.

[0016] As a preferred technical solution, the step S22 specifically comprises:

[0017] A random tree t is constructed, the abnormal scores of the samples in the random tree t are calculated, and abnormal points P i,t and normal points P O,t are obtained;

[0018] The IICs of each split point on the random tree are calculated;

[0019] The cumulative feature importance CFI value is updated, the split efficiency IICs and path length of the normal samples and the abnormal samples in the random tree t are normalized and combined, and the function value is updated by accumulation;

[0020] The C value is set to count the frequency of node v split, and the feature importance GFI value is calculated;

[0021] The feature importance GFI value is sorted, and the feature parameters with high ranking are selected.

[0022] As a preferred technical scheme, the sensitive features are divided into corresponding intervals, comprising:

[0023] A distribution model of the detection data set is detected, and the distribution model is used to determine whether the data conforms to a specific probability distribution;

[0024] According to the distribution model, a corresponding data discretization method is used to divide the sensitive features into corresponding intervals;

[0025] The discretization method includes equal-width discretization method, equal-frequency discretization method, natural breakpoint method based on KDE, and average value and standard deviation discretization.

[0026] As a preferred technical scheme, the correlation between various sensitive features is analyzed, and a data graph network is constructed, comprising:

[0027] The coupling relationship between different data in the central air conditioning cold source system is analyzed to obtain the correlation information;

[0028] For the correlation information between any data, a triple form is used to represent the data with a correlation relationship, and a line is connected to form a graph network model;

[0029] The triple includes a subject variable, an object variable and an association rule part, as follows:

[0030] G=(subject,target,action)

[0031] Wherein, subject represents the subject variable in an association attribute, target represents the object variable in an association attribute, and action represents the association rule between the subject variable and the object variable.

[0032] As a preferred technical scheme, the historical data graph network is subjected to frequent subgraph mining, comprising:

[0033] A quadruple is established, including node label information and edge information; the combination of the data graph network structure formed at each time T and its edge is taken as an edge set EDG; the support of the edge is calculated, and when the support of the edge is greater than the minimum support threshold of the frequent edge, it is determined as a frequent edge;

[0034] For the data graph network formed at each time, the infrequent edges are removed to obtain a graph network set; it is judged whether the graph network set exists isomorphic graph, if there is a data graph network with isomorphic graph, one of the data graph networks with isomorphic graph is retained, and the remaining isomorphic graphs are deleted;

[0035] The graph support of the data graph network is calculated, and when the graph support is greater than the support threshold of the frequent subgraph, it is determined as the maximum frequent subgraph.

[0036] As a preferred technical solution, the processing of infrequent graph networks is also included, specifically:

[0037] Mining a subgraph with one less edge than the non-frequent graph network, accumulating and calculating the subgraph support, when the subgraph support is greater than the set frequent subgraph support threshold, retaining it as the maximum frequent subgraph, otherwise adding the subgraph to the non-frequent subgraph set, in the next search, continue to look for a subgraph with one less edge than the subgraph, and determine whether the subgraph is a frequent subgraph, until the number of edges in the subgraph is 1, then stop the search.

[0038] As a preferred technical solution, the calculation of the abnormal score of the abnormal data graph is specifically as follows:

[0039] If the data graph network at a certain moment is different from the frequent subgraph, the operation mode at that moment is abnormal. The data graph anomaly score at each moment is calculated as follows:

[0040]

[0041] Among them, A T represents the abnormal score of the data graph at time T, Y represents the number of frequent subgraphs, N s,j represents j th The total number of edges and points in the frequent subgraph, D T,j Represents the data graph at time T and j th The number of distinct edges and distinct points in the frequent subgraph.

[0042] As a preferred technical solution, the data that does not match the data graph network and the frequent subgraph under the same abnormal row pattern is marked as follows:

[0043] Mark the data graph network and frequent subgraphs in the same operating mode. When the anomaly score of the data graph network at a certain moment is less than the set threshold, the data graph network and frequent subgraph at that moment are in the same operating mode.

[0044] Compare the abnormal data graph network with the frequent subgraph under the same operation mode, and mark the matching nodes using the first marking method; after marking, if there are any unmatched nodes, mark the unmatched nodes; mark the unmarked nodes as filtered nodes, and visualize the abnormal data graph network through neo4j;

[0045] Analyze the cause of the abnormality based on the marked abnormal data graph.

[0046] As an optimal technical solution, the marking of data nodes as mismatching nodes is specifically as follows: if the node value of the abnormal data graph network is higher than the node value of the frequent subgraph, the mismatching node is marked using the second marking method; if the node value of the abnormal data graph network is lower than the node value of the frequent subgraph.

[0047] Compared with the prior art, the present application has the following advantages and beneficial effects:

[0048] (1) The present application adopts graph mining data processing technology, uses the values of data and the relationship between data, constructs a data graph structure, mines the association patterns and frequent operation patterns between different parameters, and discovers potential abnormal conditions or irregular operation states by analyzing the patterns in the graph, and improves the interpretability of the model, and by marking the abnormal parameters in the visualized graph structure, it is convenient for operation and maintenance personnel to judge the abnormal reasons.

[0049] (2) The present application adopts data preprocessing and feature selection technology, reduces the calculation amount of the subsequent graph mining model under the premise of retaining as much valid information of normal operation data as possible. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0051] Figure 1 The flowchart of the central air conditioning system anomaly detection method based on graph mining of the embodiment of the present application;

[0052] Figure 2 The flowchart of the mutation value detection of the embodiment of the present application;

[0053] Figure 3 The DIFFI feature selection flowchart of the embodiment of the present application;

[0054] Figure 4 The air conditioning system data parameter correlation analysis heat map of the embodiment of the present application;

[0055] Figure 5 The schematic diagram of the central air conditioning system graph network model of the embodiment of the present application;

[0056] Figure 6 The flowchart of the frequent edge screening of the embodiment of the present application;

[0057] Figure 7 The flowchart of the top-down frequent subgraph mining submodule of the embodiment of the present application;

[0058] Figure 8 The overall flowchart of the top-down frequent subgraph mining of the embodiment of the present application;

[0059] Figure 9 The maximum frequent subgraph of the embodiment of the present application;

[0060] Figure 10 This is a flowchart of data node marking according to an embodiment of the present invention;

[0061] Figure 11 Schematic diagram of anomaly scoring of a data graph network according to an embodiment of the present invention;

[0062] Figure 12 is an abnormality score histogram according to an embodiment of the present invention;

[0063] Figure 13 This is an example diagram of anomaly detection results according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0065] References to "embodiments" in this application mean that a particular feature, structure, or characteristic described in connection with the embodiment may be included in at least one embodiment of the application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor does it constitute an independent or alternative embodiment that is mutually exclusive of other embodiments. It is understood, both explicitly and implicitly, by those skilled in the art that the embodiments described in this application may be combined with other embodiments.

[0066] See also Figure 1 This embodiment provides a central air-conditioning system anomaly detection method based on graph mining, comprising the following steps:

[0067] S1. Obtain central air-conditioning system operation data and outdoor meteorological data to construct a multi-source dataset.

[0068] Obtain historical central air conditioning operation data and outdoor weather data from the central air conditioning energy-saving control platform. Central air conditioning system operation data includes, but is not limited to, chilled water inlet temperature, chilled water outlet temperature, chilled water inlet temperature, and chilled water outlet temperature. Outdoor weather data includes dry-bulb temperature, wet-bulb temperature, and dew point temperature. If the energy consumption monitoring platform cannot obtain outdoor weather data, it can be obtained from the local meteorological department. There are 68 parameters in total, and the specific parameter names are shown in Table 1.

[0069] Table 1

[0070]

[0071]

[0072] S2. Clean the continuous data in the multi-source dataset and perform feature screening on the cleaned multi-source dataset to obtain sensitive features of the anomaly detection model; the continuous data includes non-stationary data, mutation values, missing values, and logical outliers.

[0073] It is worth explaining that, first, non-steady-state data refers to data that is not in the equipment switching period and debugging period.

[0074] Second, sensitive features are present in the anomaly detection model and have a significant impact on the model's output. Changes in these features can significantly alter the model's predictions. Identifying sensitive features helps understand the model's decision-making process, facilitate model debugging and improvement, and ensure model fairness and transparency. Refer to step S3 for subsequent processing.

[0075] Third, missing values ​​and mutation values ​​may be caused by factors such as network interruption, sensor failure, network delay, etc. during data collection, transmission, and storage. Missing values ​​are numerically expressed as mutation zero values. The double quartile method can be used to detect mutation values ​​and missing values, and eliminate the influence of extreme data caused by equipment failure. The specific process is as follows: Figure 2 The formula for the quartile method is as follows:

[0076]

[0077] Q1 is the lower quartile, which represents the 25% percentile of the data, arranged in ascending order from smallest to largest. Q3 is the upper quartile, corresponding to Q1, representing the 75% percentile of the data. IQR is the interquartile range, and UA and UB are the upper and lower limits of the mutation data. A sample value is considered abnormal if it is less than the lower threshold for abnormality at the time or greater than the upper threshold for abnormality at the time.

[0078] However, in addition to mutation values, abnormalities may also be caused by failures. Data cleaning is not about eliminating all extreme values, but about finding mutation data. Mutation data can be found through two quartiles. First, find all extreme data using the quartile method, and then construct a time period 12 hours before and after the moment to find the extreme data within that moment and determine it as a mutation value.

[0079] Fourth, logical outliers refer to data whose distribution does not conform to theoretical logical laws due to sensor failure or other interference factors. Logical outliers can be judged by expert rules.

[0080] In the specific implementation scenario, the cold source system of the central air-conditioning system has a large system and a small system. When the steady-state operation mode is executed, the number of refrigeration hosts turned on for both the large system and the small system is one, one cooling water pump is turned on, one chilled water pump is turned on, and the number of cooling towers turned on is one to four for both the large system and the small system.

[0081] Logical outliers can be judged based on expert rules, which are the following 7 rules.

[0082] 1) Teo ≥ Tei, that is, the chilled water outlet temperature is greater than or equal to the chilled water return temperature;

[0083] 2) Tco≤Tci, that is, the cooling water outlet temperature is less than or equal to the cooling water return temperature;

[0084] 3) Peo ≥ Pei, that is, the cooling water outlet pressure is greater than or equal to the cooling water return pressure;

[0085] 4) Pco≤Pci, that is, the chilled water outlet pressure is less than or equal to the chilled water return pressure;

[0086] 5) Twb ≥ Tci, that is, the outdoor ambient wet-bulb temperature is greater than or equal to the cooling return water main temperature;

[0087] 6) Twb ≥ Tod, that is, the outdoor ambient wet-bulb temperature is greater than or equal to the outdoor dry-bulb temperature;

[0088] 7)PDcw≤0, that is, the pressure loss on the refrigeration side is less than 0.

[0089] After outlier analysis, we determined that the abnormal data requiring cleaning accounted for 3.12% of the total data, a relatively small proportion, and could be directly deleted. Null values ​​accounted for 2.44%, non-stationary data accounted for 0.25%, logical outliers accounted for 0.01%, and mutation outliers accounted for 0.41%. After removing the outliers, 8,487 data points remained.

[0090] In this embodiment, in order to complete the feature screening of multi-source data sets after data cleaning, first, the Pearson correlation coefficient is used to perform correlation analysis to eliminate collinearity features. Collinearity features will reduce the generalization ability of the model, increase the instability of the model, and affect the interpretability of the model. The expression of the Pearson correlation coefficient is as follows:

[0091]

[0092] Among them, r A,B Represents the Pearson correlation coefficient between features A and B, r A,B The value range is [-1,1]. The larger the absolute value, the stronger the correlation between the two features; when r A,BWhen r > 0, there is a positive correlation between the characteristics, and vice versa. When r A,B When r equals 1 or -1, there is a collinearity relationship between the two characteristics, and one of them needs to be removed.

[0093] Then, the data most sensitive to the anomaly detection model is screened out by the depth-based isolation forest feature selection algorithm (DIFFI), which is an unsupervised feature selection algorithm based on isolation forest. The feature importance evaluation of DIFFI relies on two assumptions: important features can allow abnormal data to be identified in a shorter path; and important features will not allow normal data to be separated in a shorter path.

[0094] Further, in order to realize the screening of the data most sensitive to the anomaly detection model, as shown in Figure 3 , the embodiment gives a specific process:

[0095] S221, a random tree t is constructed, the anomaly score of the sample in the random tree t is calculated, and the abnormal point Pi,t and the normal point P O,t ;

[0096] S222, the IICs of each partition point on the random tree are calculated, wherein the IICs is used to measure the partition efficiency of the partition point;

[0097] S223, the cumulative feature importance CFI value is updated, the partition efficiency IICs and the path length of the normal sample and the abnormal sample in the path experienced in the random tree t are appropriately normalized and combined, and the function value is updated by accumulation;

[0098] S224, the feature importance GFI value is calculated, if the j feature is frequently selected as the node feature to establish the random tree, it will have a higher CFI value than other features, therefore, a value C is set to count the number of times that the feature corresponding to the partition node v is f, and GFI is used as a feature importance evaluation index, according to the assumption, GFI should be positively correlated with the CFI of the abnormal sample, and negatively correlated with the CFI of the normal sample, and DIFFI should select the feature parameter with the highest feature importance ranking.

[0099] Taking a large machine system as an example, the correlation analysis of the air conditioning system is performed, as shown in Figure 4 .

[0100] It can be observed from the heat map that the evaporation temperature and the evaporation pressure, and the condensation temperature and the condensation pressure are collinear features, and in order to reduce the subsequent analysis, the evaporation pressure and the condensation pressure can be removed.

[0101] In addition, the host refrigeration side pressure loss and the chilled water pressure difference, the cooling outlet water temperature and the cooling return water temperature are also collinear features, therefore, the chilled water pressure difference and the cooling return water temperature data are removed.

[0102] Therefore, 8-dimensional features, including the large system-evaporation pressure, the large system-condensing pressure, the large system-chilled water pressure difference, the large system-cooling return water temperature, the small system-evaporation pressure, the small system-condensing pressure, the small system-chilled water pressure difference and the small system-cooling return water temperature, are removed, and there are still 60-dimensional feature parameters.

[0103] DIFFI feature importance analysis is performed on the remaining 60-dimensional feature parameters, and the top 50% of 30-dimensional parameters are selected as the input parameters for graph mining, and the DIFFI feature selection results are shown in Table 2.

[0104] Table 2

[0105]

[0106]

[0107] S3, according to the distribution mode of the operation data, a data discretization method is selected to divide the sensitive features into corresponding intervals.

[0108] The distribution model of the detection data set is detected, and the data distribution model detection is to determine whether the data conforms to a specific probability distribution model, and the probability distribution model of the data can be divided into the following four categories:

[0109] (1) Multi-peak distribution

[0110] Kernel density estimation (KDE) is a non-parametric statistical method for smoothing estimation of the probability density function of a data set, which can more clearly present the distribution model of the data. In the KDE graph, the multi-peak distribution appears as multiple peaks on the curve, and the number of peaks in the data set can be estimated by calculating the number of points where the second derivative of the kernel density function is zero, so as to infer whether the data is a multi-peak distribution.

[0111] (2) Symmetric or anti-symmetric distribution

[0112] When the data is unimodal distribution, a statistic T Skew is constructed using skewness γ Skew The calculation formula of T

[0113]

[0114] Where σ is the standard deviation, μ is the mean, and N is the number of data. If the data conforms to the symmetric distribution, the statistic T SkewThe chi-square distribution with 1 degree of freedom, set the significance level α = 0.05, then the critical value of T Skew is 3.8415, when greater than the critical value, the data is anti-symmetric distribution.

[0115] (3) Uniform distribution

[0116] When the data is unimodal symmetric distribution, only the implementation of uniform distribution test. Can be constructed by calculating the kurtosis (Kurtosis) λ statistics T Kurto to detect whether the data set is uniformly distributed. Kurtosis λ is a measure of the degree of data distribution peak, measures the degree of peak value of the data distribution curve around the mean. λ and T Kurto calculation formula, as follows:

[0117]

[0118]

[0119] If the data is consistent with the non-uniform distribution, the statistics T Kurto chi-square distribution with 1 degree of freedom, set the significance level α = 0.05, T Kurto critical value is 6.6349, when greater than the critical value, the data is uniformly distributed.

[0120] (4) Normal distribution

[0121] When the data distribution is unimodal symmetric non-uniform distribution, only the implementation of normal distribution test. Using J-B test method, the skewness γ and kurtosis λ of the distribution function are calculated, and the difference between the skewness and kurtosis of the normal distribution is used to judge whether the data conforms to the normal distribution. The constructed statistics JB is shown in the following formula:

[0122]

[0123] If the variable is subject to normal distribution, JB statistics asymptotically subject to chi-square distribution with 2 degrees of freedom, set the significance level α = 0.05, then the critical value of JB is 5.99, when greater than the critical value, the data does not conform to the normal distribution.

[0124] According to the distribution model, select the appropriate discretization method, there are 4 common discretization methods:

[0125] (1) Equal width discretization method (EWD): continuous data is divided into k equal width subspaces according to the value range.

[0126] (2) Equal frequency discretization method (EFD): continuous data is evenly divided into k subspaces, each subspace has the same number of data.

[0127] (3) KDE-based natural break method (KDE-NB): Find the positions where the gradient of the probability density curve changes significantly through kernel density estimation, which indicates the change of probability density from high to low or from low to high, i.e. potential natural break, divide the data set into multiple intervals according to the natural break, recalculate the probability density function for each interval, then calculate the difference between the density peak and the density valley in the interval, merge the intervals with smaller difference with the adjacent intervals, and make the subspaces classified by the KDE natural break method as much as possible.

[0128] (4) Average value and standard deviation discretization (AVST): According to the average value and standard deviation, the discrete intervals are divided at equal width.

[0129] Different data distribution models correspond to different data discretization methods.

[0130] After analysis, the multi-dimensional data has multi-peak distribution, anti-symmetry distribution and symmetry distribution, and the KDE-NB discretization method is adopted for data discretization.

[0131] S4, analyze the relevance between various sensitive features, and construct a data graph network; frequent subgraph mining is performed on the historical data graph network to obtain the frequent operation mode of the central air conditioning system.

[0132] In particular, the relevance between various sensitive features in step S4 of the embodiment is analyzed to construct a data graph network, including:

[0133] S41, analyze the correlation between different parameters: there is a coupling relationship between different data of the central air conditioning cold source system, such as air conditioning system energy consumption and cooling water main temperature difference, wet bulb temperature and cooling water return temperature, wet bulb temperature and cooling tower energy consumption, etc. The traditional data analysis method ignores the structural relationship of the data itself, thus missing the key global information of the data;

[0134] S42, construct a graph network model: for the correlation attributes between any data, the composition includes three parts: subject variable, object variable and association rule, which can be represented in triple form, as follows:

[0135] G = (subject, target, action)

[0136] Wherein, subject represents the subject variable in a correlation attribute, target represents the object variable in a correlation attribute, and action represents the association rule between the subject variable and the object variable.

[0137] Connect the data with correlation relationship with a line to form a graph network model, as shown in Figure 5 .

[0138] Further, in a specific example, the cold source system is divided into overall operation data, large machine system operation data, and small machine system operation data, and the corresponding relationship between the subject variable and the object variable in the established associated attribute is shown in Table 3.

[0139] Table 3

[0140]

[0141]

[0142]

[0143] Next, in step S4, the historical data graph network is subjected to frequent subgraph mining to obtain the frequent operation mode of the central air conditioning system, including:

[0144] S43, please refer to Figure 6 , a four tuple is established, including node label information and edge information; the combination of the data graph network structure formed at each time T and its edge is taken as an edge set EDG; the support degree of the edge is calculated, and when the support degree of the edge is greater than the set minimum support threshold of the frequent edge, it is determined as a frequent edge.

[0145] Further, the four tuple is expressed as edg: (a, b, s, k), wherein a is the feature corresponding to the subject variable, b is the feature corresponding to the object variable, s is the subspace label corresponding to the subject variable value after discretization, and k is the subspace label corresponding to the object variable value after discretization.

[0146] Further, the set minimum support threshold of the frequent edge is expressed as follows:

[0147]

[0148] wherein, represents the support degree of edg T,I , represents the number of edges in EDG that are the same as edg T,I and include edg T,I .

[0149] Sup_T edg = ratio x t

[0150] wherein, Sup_T edg represents the minimum support threshold of the frequent edge, ratio represents a proportion parameter, and t represents the total number of graphs.

[0151] S44. For the data graph network formed at each moment, remove infrequent edges to obtain a graph network set; determine whether there is an isomorphic graph in the graph network set. If there is a data graph network with an isomorphic graph, retain one of the data graph networks with the isomorphic graph and delete the remaining isomorphic graphs. For details, please refer to Figure 7 .

[0152] For the graph network formed at each moment, infrequent edges are removed, because a graph containing infrequent edges is not a frequent graph. After removing infrequent edges, the graph network formed at each moment forms a graph network set. It is determined whether there are identical graph structures in the graph network set, that is, isomorphic graphs. For graph networks with isomorphic graphs, all other isomorphic graphs are deleted, and only one graph network structure is retained. The expression of graph support is as follows:

[0153] sup Gr =N del-Gr +1

[0154] Among them, sup Gr represents the graph support, N del-Gr Indicates the number of deleted isomorphic graphs.

[0155] S45. Calculate the graph support of the data graph network. When the graph support is greater than the set frequent subgraph support threshold, it is determined to be the maximum frequent subgraph. Figure 8 .

[0156] Set the support threshold Sup_T of the frequent subgraph Gr , when the support of the retained graph network is greater than the threshold Sup_T Gr , then it is judged to be the largest frequent subgraph. For non-frequent graph networks, the subgraph Gr with one less edge than it is mined. inf , its cumulative support expression is shown as follows. Greater than the threshold Sup_T Gr When , it is retained as the maximum frequent subgraph. If Less than the threshold Sup_T Gr , then Gr inf Add the infrequent subgraph set and continue to search for Gr in the next search. inf For a subgraph with one less edge, determine whether it is a frequent subgraph. When the number of edges in the subgraph reaches 1, stop searching.

[0157]

[0158] Where, Representation graph Gr inf The cumulative support of sup Gr Represents Gr inf The support degree of the hypergraph Gr corresponding to the graph, sup Gr Representation graph Grinf support.

[0159] In this embodiment, by mining the frequent subgraphs of the discretized central air-conditioning system data, since the frequent edges appear more frequently, a higher frequent edge threshold is set, and the ratio is set to 0.2. Then Sup_T edg At the same time, in order to mine the largest frequent subgraph in a larger range, the minimum support Sup_T of the frequent subgraph is set Gr is 800. The final number of frequent subgraphs output is 314, of which the largest frequent subgraph has 17 edges and its support is 850, as shown in Figure 9 shown.

[0160] S5. Compare the data graph network and the frequent subgraph at each moment, identify the abnormal data graph, and calculate the anomaly score of the abnormal data graph; determine the threshold according to the inflection point of the abnormal data graph, and mark the frequent operation mode with anomaly score exceeding the threshold as an abnormal operation mode.

[0161] S51. If the data graph network at a certain moment is different from the frequent subgraph, the operation mode at that moment is abnormal. Calculate the data graph anomaly score at each moment as follows:

[0162]

[0163] Among them, A T Indicates the abnormal score of the data graph at time T, A T.j The anomaly score of the data graph network at a certain moment, Y represents the number of frequent subgraphs, N s,j represents j th The total number of edges and points in the frequent subgraph, D T,j Represents the data graph at time T and j th The number of distinct edges and distinct points in the frequent subgraph.

[0164] Furthermore, if the current data is detected online, the data graph network at this moment is compared with the frequent subgraph to determine whether it is in an abnormal operation mode, as in step S51. If the data graph at this moment is different from the frequent subgraph, the data graph network at this moment is determined to be abnormal, and the anomaly score is calculated.

[0165] The calculation of the anomaly score here does not need to be based on the same operating mode, but is compared with all frequent subgraphs. Because through experiments, it is found that the same operating mode is relatively strict, in some cases only one or two frequent subgraphs can be matched, and many matched frequent subgraphs are small, and many parameters cannot be compared. Some parameters are the same even in different operating modes, and there is a correlation between the parameters. Here, only abnormal operating states are filtered out, so strict matching is not required. In a specific example, such as Figure 11Given a diagram of anomaly detection based on a graph network, since the discretization symbol of C is different in the frequent subgraph and the data graph, the edges b and c are also different in the two graphs, and the anomaly score is Where 7 is the total number of edges and points in the frequent subgraph, and is the number of different points and edges between the frequent subgraph and the data graph.

[0166] In other examples, anomaly scores were performed on 8,487 data graphs throughout the year, and the final results are plotted over time. January, February, March, and December, as transitional seasons between hot summers and warm winters in regions with warmer temperatures and winter, result in higher anomaly scores. Central air conditioning equipment has a higher rated cooling capacity, and during certain periods, the equipment operates at low load and switches frequently, resulting in more anomaly data and fewer frequently matched operating modes. Furthermore, extreme outliers occur throughout the year. To mitigate the impact of seasonality on anomaly scores, a larger threshold, greater than 0.7, is required.

[0167] according to Figure 12 We selected the inflection point of 0.72 as the anomaly score threshold. Data graphs with an anomaly score greater than 0.72 were considered anomaly graphs. Finally, we selected 100 anomaly graphs.

[0168] S6. Mark the data that does not match the data graph network and frequent subgraph in the same operating mode, such as Figure 10 shown.

[0169] In particular, step S6 includes:

[0170] S61. Mark the data graph network and frequent subgraphs in the same operating mode. T.j When it is less than 0.6, judge the data graph at time T and j th Frequent subgraphs are of the same operating mode;

[0171] S62. Compare the abnormal data graph network with the frequent subgraph under the same operation mode, mark the matching nodes in green; after marking, mark the unmatched nodes. When the node value of the abnormal data graph network is higher than the node value of the frequent subgraph, it is marked in orange; when it is lower than the node value of the frequent subgraph, it is marked in red. Finally, mark the unmarked nodes as filtered nodes in yellow, and visualize the abnormal hourly data graph through neo4j;

[0172] S63. Analyze the cause of the abnormality based on the marked abnormal data graph.

[0173] like Figure 13As shown, the host load factor in the small system is low, which corresponds to low condenser temperature and low cooling water supply and return temperature difference. This is because the wet-bulb temperature is low, falling within the boundary between two discrete intervals, while the cooling water flow rate is high relative to the host load. In the large system, the cooling water pump activation frequency is high. Furthermore, the chilled water flow rate is high, but the chilled water temperature difference is low, indicating that the chilled water pump activation frequency is high. Furthermore, the actual chilled water outlet temperature in both the large and small systems is lower than the set value. Under steady-state conditions, the actual chilled water outlet temperature should be equal to the set value, indicating that the system is in a fluctuating state.

[0174] It should be noted that, for the sake of convenience, the aforementioned method embodiments are all expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited to the described order of actions, because according to the present invention, certain steps can be performed in other orders or simultaneously.

[0175] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0176] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be considered as equivalent replacement methods and are included in the scope of protection of the present invention.

Claims

1. A central air-conditioning system anomaly detection method based on graph mining, characterized in that: The steps include: Obtain central air conditioning system operation data and outdoor meteorological data to build a multi-source data set; Perform data cleaning on continuous data in multi-source datasets, and perform feature screening on the cleaned multi-source datasets to obtain sensitive features of the anomaly detection model; the continuous data includes non-stationary data, mutation values, missing values, and logical outliers; Select the data discretization method according to the distribution pattern of the operating data and divide the sensitive features into corresponding intervals; Analyze the correlation between various sensitive features and construct a data graph network; perform frequent subgraph mining on the historical data graph network to obtain the frequent operating modes of the central air conditioning system; Compare the data graph network and the frequent subgraph at each moment, identify the abnormal data graph, and calculate the abnormal score of the abnormal data graph; determine the threshold according to the inflection point of the abnormal data graph, and mark the frequent operation mode with an abnormal score exceeding the threshold as an abnormal operation mode; the calculation of the abnormal score of the abnormal data graph is specifically as follows: If the data graph network at a certain moment is different from the frequent subgraph, the operation mode at that moment is abnormal. The data graph anomaly score at each moment is calculated as follows: Among them, A T represents the abnormal score of the data graph at time T, Y represents the number of frequent subgraphs, N s,j represents j th The total number of edges and points in the frequent subgraph, D T,j Represents the data graph at time T and j th The number of different edges and different points in the frequent subgraph; Mark the data that does not match the data graph network and frequent subgraph in the same running mode.

2. The central air-conditioning system anomaly detection method based on graph mining according to claim 1 is characterized in that: The multi-source data set that has completed data cleaning is subjected to feature screening, including: S21, correlation analysis was performed using the Pearson correlation coefficient to eliminate collinearity features; S22. The data that is most sensitive to the anomaly detection model is screened out through the depth-based isolation forest feature selection algorithm.

3. The central air-conditioning system anomaly detection method based on graph mining according to claim 2 is characterized in that: The step S22 is specifically as follows: Construct a random tree t, calculate the abnormal score of the sample in the random tree t, and obtain the abnormal point P i,t and normal point P O,t ; Calculate the segmentation efficiency IICs of each segmentation point on the random tree; Update the cumulative feature importance CFIs value, combine the segmentation efficiency IICs and path length normalization of normal samples and abnormal samples in the path of the separation point in the random tree t, and update the function value by accumulation; Set the C value to count the frequency of node v being split and calculate the feature importance GFI value; Sort the feature importance GFI values ​​and select the top-ranked feature parameters.

4. The central air-conditioning system anomaly detection method based on graph mining according to claim 1 is characterized in that: The dividing of sensitive features into corresponding intervals includes: Detect the distribution model of the data set, which is used to determine whether the data conforms to a specific probability distribution; According to the distribution model, the corresponding data discretization method is used to divide the sensitive features into corresponding intervals; The discretization methods include equal-width discretization method, equal-frequency discretization method, natural breakpoint method based on KDE and discretization method based on mean value and standard deviation.

5. The central air-conditioning system anomaly detection method based on graph mining according to claim 1 is characterized in that: The analysis of the correlation between various sensitive features and the construction of a data graph network include: Analyze the coupling relationship between different data in the central air conditioning cooling system and obtain related information; The association information between any data is represented in triple form, and the data with association relationships are connected online to form a graph network model; The triplet includes subject variables, object variables and association rule parts, as shown in the following formula: G=(subject, target, action) Among them, subject represents the subject variable in an association attribute, target represents the object variable in an association attribute, and action represents the association rule between the subject variable and the object variable.

6. The central air-conditioning system anomaly detection method based on graph mining according to claim 1 is characterized in that: The frequent subgraph mining of the historical data graph network includes: Establish a quadruple, including node label information and edge information; take the data graph network structure formed at each time T and the combination of its edges as the edge set EDG; calculate the edge support, and when the edge support is greater than the set minimum support threshold of the frequent edge, it is determined to be a frequent edge; For the data graph network formed at each moment, remove infrequent edges to obtain a graph network set; determine whether there is an isomorphic graph in the graph network set. If there is a data graph network with an isomorphic graph, retain one of the data graph networks with the isomorphic graph and delete the remaining isomorphic graphs; The graph support of the data graph network is calculated. When the graph support is greater than the set support threshold of the frequent subgraph, it is judged to be the maximum frequent subgraph.

7. The central air-conditioning system anomaly detection method based on graph mining according to claim 6 is characterized in that: It also includes the processing of non-frequent graph networks, specifically: Mining a subgraph with one less edge than the non-frequent graph network, accumulating and calculating the subgraph support, when the subgraph support is greater than the set frequent subgraph support threshold, retaining it as the maximum frequent subgraph, otherwise adding the subgraph to the non-frequent subgraph set, in the next search, continue to look for a subgraph with one less edge than the subgraph, and determine whether the subgraph is a frequent subgraph, until the number of edges in the subgraph is 1, then stop the search.

8. The central air-conditioning system anomaly detection method based on graph mining according to claim 1 is characterized in that: The data that does not match the data graph network and the frequent subgraph in the same operating mode is specifically marked as: Mark the data graph network and frequent subgraphs in the same operating mode. When the anomaly score of the data graph network at a certain moment is less than the set threshold, the data graph network and frequent subgraph at that moment are in the same operating mode. Compare the abnormal data graph network with the frequent subgraph under the same operation mode, and mark the matching nodes using the first marking method; after marking, if there are any unmatched nodes, mark the unmatched nodes; mark the unmarked nodes as filtered nodes, and visualize the abnormal data graph network through neo4j; Analyze the cause of the abnormality based on the marked abnormal data graph.

9. The central air-conditioning system anomaly detection method based on graph mining according to claim 8 is characterized in that: The marking of unmatched nodes is specifically as follows: if the node value of the abnormal data graph network is higher than the node value of the frequent subgraph, the unmatched nodes are marked using the second marking method; if the node value of the abnormal data graph network is lower than the node value of the frequent subgraph, the unmatched nodes are marked using the third marking method.

Images