A method, system, device, and medium for real-time detection of abnormal TDOA estimates

Abstract

A real-time detection method, system, device and medium for abnormal TDOA estimation value, the method comprising, constructing a TDOA data set for anomaly detection; implementing an improved KNN-based historical TDOA data anomaly detection algorithm; building an anomaly detection algorithm framework for real-time TDOA data stream based on LSTM prediction, including initialization module, data maintenance module, real-time data anomaly judgment module; the system and device based on the above method carry out real-time detection for TDOA abnormal value, detect and eliminate abnormal TDOA estimation value; the improved KNN-based historical TDOA data anomaly detection algorithm mainly processes long data segment historical TDOA data; double-ended queue is used to maintain normal data, and the real-time detection of next moment TDOA data is realized through the method based on prediction, so as to quickly identify and respond to abnormal conditions and reduce the occupation of invalid data on system resources.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of passive system positioning, and particularly relates to a real-time detection method, system, device and medium for abnormal TDOA estimation value. BACKGROUND

[0002] In actual passive positioning, factors such as failure of radar signal sorting algorithm, electronic interference, and dynamic changes in the environment will cause the precision of TDOA positioning parameters to deteriorate, resulting in unreliable target tracking results. To address this problem, abnormal value detection and elimination technology at the level of TDOA positioning parameters is needed to reduce the adverse effects of bad points in positioning parameters on the overall effect of target tracking. However, there is currently a lack of real-time abnormal detection research on TDOA positioning parameters. The following are related research literature on abnormal value detection in other fields.

[0003] The most basic method in anomaly detection is the statistical-based method. In 2005, Jun and his team used a non-Gaussian model to compare the relationship between the true value and the predicted value (Reference 1: Jun M C, Jeong H, Kuo C C J. Distributed spatio-temporal outlier detection in sensor networks [C] / / Digital Wireless Communications VII and Space Communication Technologies. SPIE, 2005, 5819: 273-284.) to achieve anomaly detection in wireless sensor networks, but this method requires prior knowledge of data distribution. In 2013, Branch et al. proposed using distance metrics to achieve global anomaly point detection (Reference 2: Branch J W, Giannella C, Szymanski B, et al. In-network outlier detection in wireless sensor networks [J]. Knowledge and information systems, 2013, 34: 23-54.), which continuously broadcasts between local abnormal nodes until the entire wireless sensor network identifies the abnormal value. In 2022, Qi Chao-shuai conducted anomaly detection on cooperative unmanned aerial vehicle data such as flight altitude and current barometric altitude (Reference 3: Qi Chao-shuai. Online anomaly detection technology for unmanned aerial vehicle flight data [D]. Xi'an University of Electronic Science and Technology, 2022.), using a combination of Isolation Forest and a class of support vector machines to overcome the high false detection problem of unmanned aerial vehicles in flight mode switching states.

[0004] The distribution, abnormal type and data dimension of data in different research fields are diverse, and it is important to select a suitable abnormal detection method. The change of the TDOA positioning parameter of the research object of the application is related to the relative position of the target and the monitoring device, the maneuvering characteristics, the external environmental interference and other factors, and these factors are difficult to be characterized by digital information, forming a special time series. This brings new challenges to the real-time abnormal detection of the TDOA estimated value.

[0005] In summary, the prior art has the following defects and deficiencies:

[0006] Most of the current technologies are for abnormal detection of multi-dimensional data with much prior information, while the positioning parameter TDOA is a time series with irregularity and little prior information, and no other scholars have studied the abnormal detection problem at the positioning parameter level. SUMMARY

[0007] In order to overcome the deficiencies of the prior art, the purpose of the application is to provide a real-time detection method, system, device and medium for abnormal TDOA estimated value, which performs real-time abnormal detection on the TDOA stream with abnormal values under different monitoring devices, so as to reduce the adverse effects of bad points of the positioning parameter on the overall effect of target tracking, ensure the ability of the positioning system to accurately position the target, and ultimately obtain a reliable target trajectory.

[0008] In order to achieve the above purpose, the application adopts the following technical solutions:

[0009] A real-time detection method for abnormal TDOA estimated value, specifically comprising the following steps:

[0010] Step 1: Construct a TDOA data set for abnormal detection;

[0011] Step 2: According to the TDOA data set obtained in step 1, establish an improved KNN historical TDOA data abnormal detection method; realize dynamic threshold determination of abnormal score score;

[0012] Step 3: According to the TDOA data set obtained in step 1 and the improved KNN historical TDOA data abnormal detection method in step 2, build an abnormal detection algorithm framework for real-time TDOA data stream based on LSTM prediction, including an initialization module, a data maintenance module and a real-time data abnormality determination module.

[0013] The specific method of step 1 is:

[0014] 1.1 Collect TDOA original data, including the time T when the sensor node captures the target signal and the corresponding TDOA parameter value X, the time and the parameter value correspond to each other, to form a complete TDOA data set;

[0015] 1.2 Randomly and continuously missing 0-50% of the complete TDOA dataset in step 1.1 to obtain a time discontinuous TDOA dataset;

[0016] 1.3 Adding abnormal errors to the time discontinuous TDOA dataset in step 1.2, the floating range of the introduced abnormal errors is ±2us-±20us, to obtain a time discontinuous TDOA dataset with abnormal values;

[0017] 1.4 Normalizing the dataset obtained in step 1.3 by maximum and minimum to obtain a normalized time discontinuous TDOA dataset with abnormal values.

[0018] The specific method of step 2 is:

[0019] 2.1 Selecting K nearest neighbors (K-Nearest Neighbors, KNN) as an abnormal detection method based on historical TDOA data to build a basic KNN abnormal detection algorithm;

[0020] 2.1.1 Setting the number of nearest neighbors as k, calculating the average distance of each TDOA value and the k nearest neighbors, and taking the average distance as the abnormal score score of the current TDOA value;

[0021] 2.1.2 Calculating the abnormal score of the normalized time discontinuous TDOA dataset with abnormal values in step 1.3 according to step 2.1.1 to obtain an abnormal score set Scores[] of all TDOA values;

[0022] 2.2 Realize dynamic threshold to determine abnormal score score;

[0023] 2.2.1 Calculate the distribution histogram of the abnormal score set Scores[] in step 2.1.2, and select the first valley bottom range interval in the histogram as the selectable range of the dynamic threshold;

[0024] 2.2.2 Taking the mean value of the first valley bottom range interval as the final dynamic threshold Threshold;

[0025] 2.2.3 Abnormal judgment is performed on the abnormal score set Scores[], if Scores[i]>Threshold, the current TDOA value is abnormal, otherwise it is normal.

[0026] The specific method of step 3 is:

[0027] 3.1 Building an initialization module;

[0028] 3.1.1 Setting the initial sequence X length of initialization module 1 to M and the bidirectional queue Deque capacity length of initialization module 2 to L;

[0029] 3.1.2 Process the TDOA dataset in step 1 in a single data point sequence, simulate the characteristics of real-time TDOA data stream, when the number of TDOA parameter points accumulates to M, use the anomaly detection method based on historical TDOA data in step 2 to detect X to get the sequence Y marked with abnormal values;

[0030] 3.1.3 Store the normal values in sequence Y in time sequence from the tail of the double-ended queue Deque, after the data length reaches the capacity of Deque, if the data continues to be stored, Deque will automatically delete old data from the head and store new data, which ensures that the data in Deque after initialization is the latest L time point normal TDOA data;

[0031] 3.2 Construct data maintenance module: whenever new data point TDOA new comes, judge it through real-time data anomaly judgment module, if it is abnormal, directly eliminate it, continue to judge the abnormality of the next data point; if it is normal, store the new data point TDOA new from the tail of Deque;

[0032] 3.3 Construct TDOA prediction network based on LSTM;

[0033] 3.3.1 The structure of TDOA prediction network based on LSTM consists of one layer of LSTM and one layer of fully connected layer FC, set input dimension input_size, output dimension output_size, hidden layer dimension hidden_size, and data length length as the length L of Deque in step 3.1.1;

[0034] 3.3.2 The input data Input_Data is dimensioned to get data with shape input_size*length*1, after passing through one layer of LSTM, the data shape becomes Input_size*length*hidden_size, then after passing through one layer of FC, the data shape becomes output_size*1, finally the data is dimensioned to get one data Output_data predicted by the prediction network;

[0035] 3.3.3 Select adaptive matrix estimation Adam as the optimizer of the network training process; select mean absolute error MAE as the loss function of the network training process; calculate the absolute value of the difference between the network input value and the network output value, then sum and average to get MAE, the formula is as follows:

[0036]

[0037] 3.3.4 Train the prediction network in step 3.3.1 until the MAE value gradually decreases and eventually tends to be stable, that is, the network training is completed, and the obtained network can realize the prediction function of TDOA;

[0038] 3.4 Construct a real-time data anomaly judgment module; first set the judgment threshold to t, use Deque as the processing data, and use the LSTM network in step 3.3 to make a prediction to obtain the predicted value TDOA of the next normal data point to be stored in Deque predict , which is Output_data in step 3.3.2; by judging whether the absolute value of the difference between TDOA predict and TDOA new is within the acceptable threshold t, if TDOA diff >t, it is determined that the current TDOA diff is abnormal, otherwise the current TDOA new is normal; new

[0039] The system of the real-time detection method of the abnormal TDOA estimation value comprises:

[0040] A TDOA data set construction module is used in step 1, which can process the original complete data by random missing setting and random abnormal value introduction, and realize the distribution simulation of the real TDOA data;

[0041] An improved KNN-based historical TDOA anomaly detection module is used in step 2, which can detect the TDOA data in step 1 by improving the KNN algorithm, and realize the core algorithm of the initialization module in step 3;

[0042] An abnormal TDOA data stream detection module based on LSTM prediction is used in step 3, which is constructed and integrated by the initialization module, the data maintenance module and the real-time data anomaly judgment module, and realizes the real-time anomaly detection based on TDOA prediction.

[0043] The device of the real-time detection method of the abnormal TDOA estimation value comprises:

[0044] A memory is used to store a computer program;

[0045] A processor is used to execute the computer program to realize the real-time detection method of the abnormal TDOA estimation value in steps 1 to 3.

[0046] A computer readable storage medium stores a computer program, which can be executed by a processor to detect the real-time TDOA anomaly value based on the real-time detection method of the abnormal TDOA estimation value in steps 1 to 3.​

[0047] Compared with the prior art, the present application has the following advantages:

[0048] The present application takes TDOA data as the processing target, and considers the problem of unreliable target tracking in a passive positioning system to propose an abnormal TDOA positioning parameter detection method, detects and eliminates abnormal TDOA estimation values, and finally realizes the reliability of the positioning point. In view of the problems of abnormal values of TDOA positioning parameters and unreliable target tracking, there is a lack of corresponding solutions. And the existing data anomaly detection technology has not been studied for TDOA data in the field of passive positioning which has no regularity and strong correlation prior information. The real-time detection method of abnormal TDOA estimation values proposed in the present application provides a new solution angle, i.e. the positioning parameter level, to ensure the reliability of the final target tracking result.

[0049] The present application sets reasonable missing and abnormal values to the complete TDOA data set to simulate the data distribution characteristics of TDOA in a more realistic scenario, and provides a large number of data sets for the test of subsequent technologies. Then, the improved KNN-based historical TDOA data anomaly detection algorithm is realized, and the main processing object is the historical TDOA data of a long data segment. Considering the requirement of strong real-time performance of data analysis in the process of electronic countermeasure reconnaissance, the abnormal detection algorithm based on real-time TDOA data stream is realized on the basis of the historical TDOA data anomaly detection algorithm, a double-ended queue is used to maintain normal data, the real-time detection of TDOA data at the next moment is realized through the prediction-based method, and the purpose of quickly identifying and responding to abnormal situations and reducing the occupation of system resources by invalid data is achieved. BRIEF DESCRIPTION OF DRAWINGS

[0050] Figure 1 It is the initialization module 1 of the real-time detection framework of the present application.

[0051] Figure 2 It is the initialization module 2 of the real-time detection framework of the present application.

[0052] Figure 3 It is the data maintenance module of the real-time detection framework of the present application.

[0053] Figure 4 It is the TDOA prediction network structure based on LSTM of the present application.

[0054] Figure 5 It is the data anomaly judgment module of the real-time detection framework of the present application.

[0055] Figure 6 It is the overall flowchart of the abnormal detection algorithm based on real-time TDOA data stream of the present application.

[0056] Figure 7The accuracy ACC comparison curve diagram of the present application.

[0057] Figure 8 The false detection rate FPR comparison curve diagram of the present application.

[0058] Figure 9 The false detection rate FNR comparison curve diagram of the present application.

[0059] Figure 10 The real-time detection running time comparison of the present application.

[0060] Figure 11 The flowchart of the present application. DETAILED DESCRIPTION

[0061] The present application will be described in detail below with reference to the accompanying drawings.

[0062] Referring to Figure 11 A real-time detection method of abnormal TDOA estimation value, specifically comprising the following steps:

[0063] Step 1: Construct a TDOA data set for anomaly detection; the specific method of step 1 is:

[0064] 1.1 Collect TDOA original data, including the time T when the sensor node captures the target signal and the corresponding TDOA parameter value X, the time and the parameter value correspond one by one to form a complete TDOA data set;

[0065] 1.2 Randomly and continuously missing 0-50% of the complete TDOA data set in step 1.1 to obtain a time discontinuous TDOA data set;

[0066] 1.3 Adding abnormal errors to the time discontinuous TDOA data set in step 1.2, the floating range of the introduced abnormal error is ±2us-±20us, to obtain a time discontinuous TDOA data set with abnormal values;

[0067] 1.4 Normalizing the data set obtained in 1.3 to obtain a normalized time discontinuous TDOA data set with abnormal values.

[0068] Step 2: According to the TDOA data set obtained in step 1, establish an improved KNN historical TDOA data anomaly detection method; realize dynamic threshold determination of abnormal score score; the specific method of step 2 is:

[0069] 2.1 Select K nearest neighbor (K-Nearest Neighbors, KNN) as the abnormal detection method based on historical TDOA data, and build a basic KNN anomaly detection algorithm;

[0070] 2.1.1 Set the number of nearest neighbors as k, calculate the average distance of each TDOA value and the k nearest neighbors, and take the average distance as the anomaly score score of the current TDOA value;

[0071] 2.1.2 The time discontinuity and abnormal value of the TDOA data set after normalization in step 1.3 is calculated according to step 2.1.1 to obtain the anomaly score set Scores[] of all TDOA values;

[0072] 2.2 Realize dynamic threshold determination of anomaly score score;

[0073] 2.2.1 Calculate the distribution histogram of the anomaly score set Scores[] in step 2.1.2, and select the first valley bottom range interval in the histogram as the optional range of the dynamic threshold;

[0074] 2.2.2 Take the mean value of the first valley bottom range interval as the final dynamic threshold Threshold;

[0075] 2.2.3 Abnormal judgment is performed on the anomaly score set Scores[], if Scores[i]>Threshold, the current TDOA value is abnormal, otherwise it is normal.

[0076] Step 3: According to the TDOA data set obtained in step 1 and the improved KNN historical TDOA data anomaly detection method in step 2, an abnormal detection algorithm framework for real-time TDOA data stream based on LSTM prediction is built, including initialization module, data maintenance module and real-time data anomaly judgment module. The specific method of step 3 is:

[0077] 3.1 Build an initialization module;

[0078] 3.1.1 Set the initial sequence X length of initialization module 1 to M, and the capacity length of bidirectional queue Deque of initialization module 2 to L;

[0079] 3.1.2 Process the TDOA data set in step 1 in single data point sequence, simulate the characteristics of real-time TDOA data stream, when the number of TDOA parameter points accumulates to M, use the abnormal detection method based on historical TDOA data in step 2 to detect X and obtain the sequence Y marked with abnormal values; The flowchart of the initialization module 1 of the real-time detection process is shown in the accompanying Figure 1 ;

[0080] 3.1.3 The normal values in sequence Y are stored in the double-ended queue Deque in chronological order from the end of the queue. When the data length reaches the capacity of Deque, if the data continues to be stored, Deque will automatically delete the old data from the front of the queue and store the new data, thus ensuring that the data in Deque after initialization is the latest L time point normal TDOA data. The data storage process is the initialization module 2 of the real-time detection process, and the flowchart is shown in FIG. 3.1.3. Figure 2

[0081] 3.2 Construction of data maintenance module: when the new data point TDOA new arrives, it is determined by the real-time data anomaly determination module. If it is abnormal, it is directly excluded, and the next data point is determined. If it is normal, the new data point TDOA new is stored from the end of the Deque queue. The data maintenance module flowchart is shown in FIG. 3.2. Figure 3

[0082] 3.3 Construction of TDOA prediction network based on LSTM;

[0083] 3.3.1 The TDOA prediction network structure based on LSTM consists of one layer of LSTM and one layer of fully connected layer FC. The input dimension input_size is set to 1, the output dimension output_size is set to 1, the hidden layer dimension hidden_size is set to 64, and the data length length is set to the length L of Deque in step 3.1.1.

[0084] 3.3.2 The input data Input_Data is dimensioned to obtain data with a shape of input_size*length*1. After passing through one layer of LSTM, the data shape becomes Input_size*length*hidden_size. Then, after passing through one layer of FC, the data shape becomes output_size*1. Finally, the data is dimensioned to obtain one data Output_data predicted by the prediction network. The network structure flowchart is shown in FIG. 3.3.2. Figure 4

[0085] 3.3.3 Select adaptive matrix estimation Adam as the optimizer of the network training process; select mean absolute error MAE as the loss function of the network training process; calculate the absolute value of the difference between the network input value and the network output value, then sum and average to obtain MAE, and the formula is as follows:

[0086]

[0087] ​​​3.3.4 Train the prediction network in step 3.3.1 until the MAE value gradually decreases and eventually stabilizes. At this point, the network training is considered complete and the resulting network can perform the prediction function of TDOA.

[0088] 3.4 Constructing a Real-Time Data Anomaly Detection Module: First, set the detection threshold to t. Using Deque as the data to be processed, use the LSTM network from step 3.3 to perform prediction, obtaining the predicted value TDOA of the next normal data point to be stored in Deque. predict This refers to Output_data in step 3.3.2; by determining TDOA predict With TDOA new The absolute value of the difference TDOA diff Is it within the acceptable threshold t range? If it is within TDOA diff >t then determines the current TDOA new If it is an exception, otherwise the current TDOA new This is normal; the real-time data anomaly detection process is attached. Figure 5 The overall flowchart of the anomaly detection algorithm based on real-time TDOA data stream is shown in the attached figure. Figure 6 As shown.

[0089] A system for real-time detection of abnormal TDOA estimates includes:

[0090] The TDOA dataset construction module is used in step one to process the original complete data by setting random missing values ​​and introducing random outliers, thereby simulating the distribution of real TDOA data.

[0091] The historical TDOA anomaly detection module based on the improved KNN is used in step two. By improving the KNN algorithm, anomalies can be detected in the TDOA data in step one, realizing the core algorithm of the initialization module in step three.

[0092] The anomaly detection module for real-time TDOA data stream based on LSTM prediction is used in step three. By integrating the initialization module, data maintenance module, and real-time data anomaly judgment module, real-time anomaly detection based on TDOA prediction is achieved.

[0093] Devices for real-time detection of abnormal TDOA estimates include:

[0094] Memory, used to store computer programs;

[0095] A processor is used to implement the real-time detection method for abnormal TDOA estimates described in steps 1 to 3 when executing the computer program.

[0096] A computer-readable storage medium storing a computer program, which, when executed by a processor, is capable of real-time detection of TDOA outliers based on the real-time detection method for outlier TDOA estimates described in steps 1 to 3.

[0097] Simulation Analysis

[0098] Historical TDOA data was processed sequentially in chronological order to simulate the characteristics of real-time data streams. The Isolation Forest method and the KNN algorithm were selected for comparison. The KNN algorithm is a major method for anomaly detection based on historical data. The advantages and disadvantages of the three detection methods were comprehensively evaluated using three assessment metrics: accuracy (ACC), false positive rate (FNR), false negative rate (FPR), and real-time detection speed.

[0099] (1) Comparative analysis of real-time detection effects

[0100] Keeping the initialization and data maintenance modules unchanged, the methods in the real-time data anomaly detection module were replaced with KNN and Isolation Forest, and comparative experiments were conducted. The curves comparing the three metrics, ACC, FPR, and FNR, are shown in the attached figures. Figure 7 , 8 As shown in Figures 9 and 9.

[0101] As shown in the curve comparison chart, the real-time detection performance of the three detection algorithms—LSTM, KNN, and Isolation Forest—changes with the increase in the proportion of outlier data. Overall, for the LSTM-based real-time detection method, as the proportion of outlier data increases, the ACC (Adjustable Acceptance Rate) decreases but remains above 90%; the FPR (Failure Rate to Predict) increases but remains below 10%; and the FNR (Failure Rate to Predict) increases but remains below 20%.

[0102] Unlike the trend of change based on the LSTM real-time detection method, the real-time detection method based on KNN and Isolation Forest increases the ACC index and the FPR index as the proportion of abnormal data increases, and the FNR index decreases. This is due to the difference in the trend of change caused by the characteristics of real-time data different from historical data. For KNN and Isolation Forest, both methods have an "edge effect", that is, the most marginal normal data points may be judged as abnormal because of their relatively few neighboring points, resulting in false detection. They detect a uniformly distributed data segment, that is, a data segment without abnormal data, and cannot first determine whether the data segment has abnormalities. Instead, they directly identify that there are abnormalities in the data and find relatively abnormal data points as abnormal data. As the proportion of abnormalities increases, the number of abnormal data increases, the FPR increases, and more and more abnormal data are maintained as normal data by the double-ended queue to support the detection of real-time data points. The introduction of abnormal points, on the other hand, solves the edge effect to some extent and ensures that the data segment for real-time detection is an abnormal data segment, which reduces the FNR of the two methods and improves the ACC.

[0103] However, this trend does not mean that increasing the proportion of abnormalities is an effective means to improve detection performance, because too high a proportion of abnormalities may interfere with the pattern of normal data. As can be seen from the comparison chart, the real-time detection method based on LSTM proposed in this chapter always maintains better detection performance regardless of the proportion of abnormalities.

[0104] (2) Real-time detection speed comparison and analysis

[0105] In real-time anomaly detection, detection speed is an important indicator of the performance of different detection methods. This is because real-time systems usually require fast response to handle abnormal situations in a timely manner, ensure stable system operation, reduce potential risks and losses, and improve user experience. Figure 10 Comparison of single TDOA data anomaly determination time for three real-time detection methods.

[0106] Based on the test, the running time of the real-time detection algorithm based on LSTM for processing a single TDOA data is 0.0026 seconds, the running time of the real-time detection algorithm based on Isolation Forest for processing a single TDOA data is 0.04740 seconds, and the running time of the real-time detection algorithm based on KNN for processing a single TDOA data is 0.02208 seconds. The real-time detection algorithm proposed in this application runs faster, KNN is second, and Isolation Forest runs the slowest.

[0107] In summary, whether from the accuracy of the detection results or the real-time detection speed, the real-time TDOA detection algorithm based on LSTM proposed in this application is the best.

Claims

1. A method for real-time detection of abnormal TDOA estimates, characterized in that, Specifically comprising the following steps: Step 1: Construct a TDOA data set for anomaly detection; 1.1 Collect TDOA raw data, including the time T when the sensor node captures the target signal and the corresponding TDOA parameter value X, which are one-to-one corresponding, to form a complete TDOA data set; 1.2 Randomly and continuously missing 0-50% of the complete TDOA data set in step 1.1 to obtain a time discontinuous TDOA data set; 1.3 Adding abnormal errors to the time discontinuous TDOA data set in step 1.2, the floating range of the introduced abnormal error is ±2us-±20us, to obtain a time discontinuous TDOA data set with abnormal values; 1.4 Normalizing the data set obtained in step 1.3 to obtain a time discontinuous TDOA data set with abnormal values after normalization; Step 2: According to the TDOA data set obtained in step 1, establish an improved KNN historical TDOA data anomaly detection method; Realize dynamic threshold determination of abnormal score; Step 3: According to the TDOA data set obtained in step 1 and the improved KNN historical TDOA data anomaly detection method in step 2, build an abnormal detection algorithm framework for real-time TDOA data stream based on LSTM prediction, including initialization module, data maintenance module and real-time data anomaly judgment module.

2. The real-time detection method of abnormal TDOA estimated value according to claim 1, wherein the specific method of step 2 is: 2.1 Select K nearest neighbor KNN as the abnormal detection method based on historical TDOA data, and build a basic KNN abnormal detection algorithm; 2.1.1 Set the number of nearest neighbors as k, calculate the distance average of each TDOA value and the k nearest neighbors, and take the distance average as the abnormal score score of the current TDOA value; 2.1.2 Calculate the abnormal score of the normalized time discontinuous TDOA data set with abnormal values in step 1.3 according to step 2.1.1 to obtain an abnormal score set Scores []; 2.2 Realize dynamic threshold determination of abnormal score; 2.2.1 Calculate the distribution histogram of the abnormal score set Scores [] in step 2.1.2, and select the first valley bottom range interval in the histogram as the selectable range of the dynamic threshold; 2.2.2 Take the mean value of the first valley bottom range interval as the final dynamic threshold Threshold; 2.2.3 Abnormal judgment is performed on the abnormal score set Scores [], if Scores [i] > Threshold, the current TDOA value is abnormal, otherwise it is normal.

3. The real-time detection method of abnormal TDOA estimated value according to claim 1, wherein the specific method of step 3 is: 3.1 Construct an initialization module; 3.1.1 Set the initial sequence X length of initialization module 1 to M, and the capacity length of bidirectional queue Deque of initialization module 2 to L; 3.1.2 Process the TDOA dataset in step 1 in a single data point sequence, simulate the characteristics of real-time TDOA data stream, when the number of TDOA parameter points accumulates to M, use the anomaly detection method based on historical TDOA data in step 2 to detect X to get the sequence Y marked with abnormal values; 3.1.3 Store the normal values in sequence Y in the double-ended queue Deque in time sequence from the tail, after the data length reaches the capacity of Deque, if the data continues to be stored, Deque will automatically delete old data from the head and store new data, which ensures that the data in Deque after initialization is the latest L time points of normal TDOA data; 3.2 Construction of data maintenance module: whenever new data point TDOA new comes, it is judged by real-time data anomaly judgment module, if it is abnormal, it is directly eliminated, and the next data point is judged; if it is normal, the new data point TDOA new is stored from the deque tail. 3.3 Construct a TDOA prediction network based on LSTM; 3.3.1 The TDOA prediction network structure based on LSTM consists of one layer of LSTM and one layer of fully connected layer FC, set the input dimension input_size, the output dimension output_size, the hidden layer dimension hidden_size, and the data length length as the length L of Deque in step 3.1.1; 3.3.2 The input data Input_Data is upgraded to get data with shape input_size*length*1, after passing through one layer of LSTM, the data shape becomes Input_size*length*hidden_size, then after passing through one layer of FC, the data shape becomes output_size*1, and finally the data is downsampled to get one data Output_data predicted by the prediction network; 3.3.3 Select adaptive matrix estimation Adam as the optimizer in the network training process; select mean absolute error MAE as the loss function in the network training process; calculate the absolute value of the difference between the network input value and the network output value, then sum and average to get MAE; 3.3.4 Train the prediction network in step 3.3.1 until the MAE value gradually decreases and finally tends to be stable, that is, the network training is completed, and the obtained network can realize the prediction function of TDOA; 3.4 Constructing real-time data anomaly judgment module: first set the judgment threshold t, take Deque as the processing data, use the LSTM network in step 3.3 to make prediction, and get the predicted value TDOA of the next normal data point to be stored in Deque predict , that is, Output_data in step 3.3.2; by judging whether the absolute value of the difference between TDOA predict and TDOA new is within the acceptable threshold t, if TDOA diff is within the acceptable threshold t, if TDOA diff > t, it is determined that the current TDOA new is abnormal, otherwise the current TDOA new is normal.

4. System for real-time detection based on the abnormal TDOA estimation value according to any one of claims 1 to 3, characterized in that, Comprising: TDOA dataset construction module, used in step 1, capable of processing original complete data and realizing distribution simulation of real TDOA data through random missing setting and random abnormal value introduction; Improved KNN-based historical TDOA anomaly detection module, used in step 2, capable of detecting abnormal values in TDOA data in step 1 through improved KNN algorithm, realizing the core algorithm of the initialization module in step 3; Real-time TDOA data stream anomaly detection module based on LSTM prediction, used in step 3, capable of realizing real-time anomaly detection based on TDOA prediction through the construction and integration of initialization module, data maintenance module and real-time data anomaly judgment module.

5. A device for real-time detection based on the estimated value of the abnormal TDOA according to any one of claims 1 to 3, characterized in that Comprising: a memory for storing a computer program; a processor for executing the computer program to realize the real-time detection method of abnormal TDOA estimation value in steps 1 to 3.

6. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 5. The computer program can be executed by a processor to perform real-time detection of the TDOA abnormal value based on the real-time detection method of the abnormal TDOA estimation value according to any one of claims 1 to 3.

Images