A multi-channel data monitoring range adjustment method based on graph anomaly detection

Abstract

The present invention discloses a method for adjusting the monitoring range of multi-channel data based on graph anomaly detection, and relates to the technical field of manufacturing data monitoring. The present invention uses deep learning technology to identify anomalies occurring in multi-channel data, makes full use of the management relationship between channel data, avoids the problem of inaccurate identification caused by manual screening and simple statistics, and adaptively adjusts the scope of data monitoring according to the identified anomalies, so that monitoring can adaptively focus on links prone to anomalies, improves the ability to identify abnormal channel data, efficiently and dynamically monitors multi-channel data in the manufacturing industry, maintains the smooth circulation of the industrial chain, is suitable for monitoring applications of today's large-scale industrial chains, and at the same time improves the efficiency and focusing ability of monitoring, and better maintains the stable operation of the industrial chain.

Description

Technical Field

[0001] The present invention belongs to the technical field of manufacturing data monitoring, and in particular relates to a multi-channel data monitoring range adjustment method based on graph anomaly detection. Background Art

[0002] The industrial chain is an important form of modern economy. It is of great significance to ensure the stability and security of the industrial chain. As the scale of the industrial chain continues to expand, the impact and interference it faces become more prominent. Multi-channel data monitoring in the manufacturing industry refers to the monitoring and collection of channel data in the manufacturing industry chain. The monitoring and analysis of these data can timely and effectively reflect data anomalies. By taking targeted measures, the stability and security of the operation of the industrial chain can be ensured.

[0003] In today's globalized business environment, the security risks of industrial chain and supply chain are becoming increasingly prominent. A monitoring method is needed to identify abnormal data in multiple channels of manufacturing industry, provide timely and accurate information support to enterprise managers, and ensure the stable operation and sustainable development of the industrial chain.

[0004] Existing monitoring data collection methods are usually divided into global data collection, regional collection, random collection, etc. Fixed sampling refers to uniformly sampling all the data of the monitored object. Faced with the ever-expanding industrial chain, the amount of data collected by the full data collection method is huge and there is a lot of unnecessary data, which increases the workload of data analysis and processing; regional collection can only monitor a single link separately, and cannot utilize the collaborative relationship between multi-channel data, and the monitoring accuracy is low.

[0005] Existing data analysis methods mainly use statistical methods, which rely on assumptions about data distribution and cannot handle multi-channel data in the manufacturing industry with large changes in data distribution; rule-based methods require professional knowledge and experience, and data labeling requires a lot of manpower and time costs. In recent years, with the development of deep learning technology, graph neural networks have shown certain advantages in identifying anomalies in data. They organize data into graph structures and can effectively use the relationships and features between data to identify anomalies. However, most general anomaly detection methods are only applied to static graph structure data with known structures, and methods suitable for dynamic and changeable multi-channel data monitoring in the manufacturing industry have not yet been studied. Summary of the invention

[0006] In view of the shortcomings of the prior art, the present invention proposes a method for adjusting the monitoring range of multi-channel data based on graph anomaly detection, which uses deep learning technology to identify anomalies in multi-channel data, and then adaptively adjusts the scope of data monitoring to solve the problems of low efficiency and difficulty in focusing of traditional data monitoring methods, improves the ability to identify abnormal channel data, efficiently and dynamically monitors multi-channel data in the manufacturing industry, and maintains the smooth circulation of the industrial chain.

[0007] The technical solution of the present invention is:

[0008] A method for adjusting a multi-channel data monitoring range based on graph anomaly detection comprises the following steps:

[0009] Step 1: According to the operation of the industrial chain, obtain monitoring data sequences from multiple channels related to the industrial chain, and then obtain a multi-channel monitoring data set.

[0010] The multi-channel monitoring data set includes monitoring data sequences of several different channels, each monitoring data sequence is a univariate time series, including monitoring data collected by a monitoring point at different timestamps, and is used to characterize the safety and operation conditions of each channel.

[0011] Step 2: Divide the multi-channel monitoring dataset into training set and test set according to the set ratio.

[0012] Step 3: Use the K nearest neighbor method to construct a time series graph based on the monitoring data in the training set and the test set.

[0013] Specifically, each monitoring data is regarded as a node in the graph structure, the cosine similarity between nodes is calculated, and for each node, the K nodes with the largest cosine similarity are selected as neighbor nodes and connected to the node to form an edge, and a graph structure describing the relationship between each monitoring data is constructed, in which the edge represents the neighbor relationship between the monitoring data corresponding to the node. According to the collection time, multiple graph structures under different timestamps are combined into a time series graph.

[0014] The graph structure is represented as ,in, is the timestamp, for The set of nodes in the graph structure at time instant, for The feature matrix of the nodes in the graph structure at time, is the number of nodes, is the dimension of the node’s feature matrix, for The adjacency matrix of the nodes in the graph structure at time.

[0015] The feature matrix is ​​a matrix representation of the features of the nodes in the graph structure; the elements in the adjacency matrix represent the relationship between the edges between any two nodes in the graph structure.

[0016] In the adjacency matrix, it represents the node The K nodes with the largest cosine similarity and the node The elements of the edge relationship between are:

[0017] (1)

[0018] in, Represents the node in the adjacency matrix With Node The elements of the edge relationship between and is the node number; Representation and Node The K nodes with the largest cosine similarity.

[0019] Step 4: Build an autoencoder based graph anomaly detection model.

[0020] The graph anomaly detection model based on the autoencoder includes a spatiotemporal feature encoding module, an encoder, a structure decoder, an attribute decoder, an anomaly judgment module and an anomaly scoring module.

[0021] The spatiotemporal feature encoding module is used to use a time window of a set size to extract a number of graph structures from the time series graph, simultaneously capture the spatiotemporal coupling information between monitoring data from different channels from the graph structure, and construct a spatiotemporal feature vector that integrates spatiotemporal information for each monitoring data.

[0022] The encoder captures the dependency between monitoring data by sequentially selecting nodes in the graph structure corresponding to the last timestamp t in the time window as target nodes, aggregating the spatiotemporal feature vectors of the neighboring nodes of the target node in all graph structures in the time window to the target node in the graph structure corresponding to timestamp t, and obtaining a low-dimensional embedding representation of each node in the graph structure corresponding to timestamp t; the encoder adopts a graph convolutional network with a fusion attention mechanism.

[0023] The structure decoder is used to reconstruct the adjacency matrix of the graph structure of the last timestamp in the time window according to the low-dimensional embedding representation of each node, so as to realize network reconstruction.

[0024] The attribute decoder is used to reconstruct the features of the nodes according to the learned low-dimensional embedding of the nodes, output the reconstructed feature matrix, and realize feature reconstruction.

[0025] The anomaly judgment module is used to calculate the network reconstruction error and the feature reconstruction error, and to judge whether there is an abnormally connected subgraph in the last timestamp graph structure within the time window; the abnormally connected subgraph is a subgraph formed by comparing the original graph structure with the reconstructed graph structure, and clustering nodes whose feature reconstruction errors are greater than a set threshold and edges whose network reconstruction errors are greater than a set threshold; the reconstructed graph structure is obtained based on the reconstructed feature matrix and the reconstructed adjacency matrix.

[0026] The anomaly scoring module is used to calculate the anomaly score of the abnormal connected subgraph using the anomaly scoring function to evaluate the severity of the anomaly.

[0027] Furthermore, the spatiotemporal feature vector includes original attributes, spatial features and temporal features in sequence.

[0028] The original attributes are monitoring data corresponding to the nodes in the graph structure.

[0029] The spatial feature represents the global structural information of the node in the entire time series graph.

[0030] The time feature represents the information of the node in the time dimension.

[0031] The spatiotemporal feature vector is:

[0032] (2)

[0033] in, For Node The space-time feature vector of For Node The original properties of For Node The spatial characteristics of node time characteristics.

[0034] Furthermore, the method for acquiring the spatial features is:

[0035] For a graph structure at a certain timestamp, first randomly sample a set of anchor points from the graph structure , m is the number of anchor points, calculate the shortest distance from each node to the anchor point in the graph structure, use this set of shortest distances as the data source, and use a learnable single-layer linear mapping function to calculate the spatial features of the node:

[0036] (3)

[0037] in, is a learnable single-layer linear mapping function, For cascade operation, For Node To Anchor The shortest distance.

[0038] Furthermore, the method for acquiring the time feature is:

[0039] The last timestamp t in the time window is compared with the different timestamps in the time window. The difference between is used as the data source, and the timestamp is calculated using a learnable single-layer linear mapping function. The time characteristics of each node in the corresponding structure diagram are: (4)

[0040] in, Indicates absolute value.

[0041] Furthermore, the specific process of the encoder is:

[0042] First, a learnable linear transformation is used to transform the spatiotemporal feature vector of each node in the time window:

[0043] (5)

[0044] in, is the transformed spatiotemporal feature vector, which is the input of the first attention layer in the graph convolutional network with fusion attention mechanism. is a trainable weight matrix shared among all nodes.

[0045] In the single-head attention mechanism l In the attention layer, the attention coefficient between the target node and the neighboring nodes is calculated:

[0046] ， (6)

[0047] (7)

[0048] in, For the l The query matrix of the attention layer, For the l The key matrix of the attention layer, For the l -1 output of the attention layer, and For the l The learnable weight matrix of the attention layer, For the l The target node calculated by the attention layer and neighbor nodes The attention coefficient between .

[0049] Normalize the attention coefficient:

[0050] (8)

[0051] in, is the normalized attention coefficient, is the softmax function, is the target node in the time window The set of neighbor nodes of is a neighbor node in the neighbor node set, For the l The target node calculated by the attention layer and neighbor nodes The attention coefficient between .

[0052] No. l The output vector of the attention layer is:

[0053] (9)

[0054] in, The target node In the l The output vector of the attention layer, is a nonlinear activation function, The target node In the l -1 output vector of the attention layer, Neighbor node In the l -1 output vector of the attention layer, The target node In the l The self-attention coefficient of the layer, For the l The learnable weight matrix of the attention layer.

[0055] The above single-head attention mechanism is extended to a multi-head attention mechanism, using the average of the output vector as the low-dimensional embedding of the node: (10)

[0056] in, The target node The low-dimensional embedding of No. The attention head l The attention coefficient of the layer, For the The attention headl The learnable weight matrix of the layer, The target node In the The attention head l The self-attention coefficient of the layer, is the number of the attention head, is the number of attention heads.

[0057] Furthermore, the adjacency matrix of the graph structure of the last timestamp in the time window reconstructed by the structure decoder is:

[0058] (11)

[0059] in, for sigmoid Function, used to capture nonlinear relationships, is the adjacency matrix of the reconstructed graph structure, is the low-dimensional embedding matrix of the node.

[0060] Furthermore, the attribute decoder uses a multi-layer perceptron to reconstruct the features of the node:

[0061] (12)

[0062] in, is a multi-layer perceptron, is the learnable weight matrix, is the reconstructed feature matrix.

[0063] Furthermore, the network reconstruction error is:

[0064] (13)

[0065] in, is the network reconstruction error, is the adjacency matrix of the original graph structure.

[0066] Furthermore, the feature reconstruction error:

[0067] (14)

[0068] in, is the feature reconstruction error, is the feature matrix of the original graph structure.

[0069] Furthermore, the abnormality scoring function is:

[0070] (15)

[0071] in, is the anomaly score, is a non-negative non-decreasing convex function, is the identified abnormal connected subgraph, and is the learnable weight vector, For Node The low-dimensional embedding of Neighbor node Low-dimensional embedding of .

[0072] Step 5: Use the time series graph obtained from the monitoring data in the training set to train the autoencoder-based graph anomaly detection model to obtain a trained autoencoder-based graph anomaly detection model.

[0073] The objective function of the anomaly judgment module in the graph anomaly detection model based on the autoencoder is:

[0074] (16)

[0075] in, It is a control parameter that balances the importance of network reconstruction and feature reconstruction.

[0076] The objective function of the anomaly scoring module is:

[0077] (17)

[0078] in, R is the set of all abnormally connected subgraphs, r The sum of the anomaly scores is calculated separately for the nodes in the anomaly connected subgraph.

[0079] Step 6: Input the time series graph obtained from the monitoring data in the test set into the trained autoencoder-based graph anomaly detection model for anomaly detection to obtain the abnormal connected subgraph and its corresponding anomaly score.

[0080] Step 7: Use the linear threshold model to predict the propagation process of the abnormal connected subgraph in the graph structure and determine the propagation range of the anomaly.

[0081] The eigenvalue decomposition of the adjacency matrix is ​​performed to obtain the eigenvector, and the activation threshold and influence weight of the node are set according to the centrality of the node's eigenvector.

[0082] Use the node's eigenvector centrality value as the influence weight:

[0083] (18)

[0084] in, is the maximum eigenvalue of the adjacency matrix, for The corresponding eigenvector, For Node The eigenvector centrality value of For Node The eigenvector centrality value of .

[0085] The activation threshold of a node is:

[0086] (19)

[0087] in, For Node The activation threshold, To adjust the parameters.

[0088] The nodes in the detected abnormal connected subgraph are used as the initial activated nodes to obtain the initial activated node set. Then, influence propagation is performed to predict the propagation range of the anomaly in the channel. Starting from the initial activated node, the anomaly gradually spreads to other nodes in the network. For each unactivated node v, when the cumulative influence of its activated neighboring nodes on it is greater than its activation threshold, the node v is activated; the activated node will continue to influence its neighboring nodes until no new nodes are activated in the new round of propagation, and the propagation process ends.

[0089] Step 8: Adaptively adjust monitoring parameters based on anomaly scores and propagation range, and then adjust the multi-channel manufacturing data monitoring range.

[0090] The monitoring parameter adjustment formula is:

[0091] (20)

[0092] in, is the original monitoring parameter, is the adjusted monitoring parameter, is the decay function, dis is the shortest distance between the affected node and the abnormal node, b is the offset parameter.

[0093] Compared with the prior art, the beneficial effects of the present invention are:

[0094] Compared with traditional technologies, the technical solution proposed in this invention uses an anomaly detection method based on graph neural networks to identify anomalies in multi-channel data, making full use of the management relationship between channel data and avoiding the problem of inaccurate identification caused by manual screening and simple statistics. By accurately identifying anomalies in the channel, monitoring can adaptively focus on links prone to anomalies, which is suitable for monitoring applications in today's large-scale industrial chains, while improving the efficiency and focusing ability of monitoring, and better maintaining the stable operation of the industrial chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] Figure 1 Flowchart of a method for adjusting a multi-channel data monitoring range based on graph anomaly detection in an embodiment of the present invention.

[0096] Figure 2 A graph anomaly detection framework based on an autoencoder in an embodiment of the present invention.

[0097] Figure 3 Schematic diagram of the node spatiotemporal feature vector encoding process in an embodiment of the present invention.

[0098] Figure 4 Schematic diagram of the node embedding process based on the attention mechanism in an embodiment of the present invention.

[0099] Figure 5 Schematic diagram of the process of reconstructing middle map information in an embodiment of the present invention.

[0100] Figure 6 Schematic diagram of the abnormal influence propagation process in an embodiment of the present invention.

[0101] Figure 7 Schematic diagram of the monitoring range adjustment process in an embodiment of the present invention. DETAILED DESCRIPTION

[0102] The present invention is described in detail below with reference to the accompanying drawings and embodiments.

[0103] The key points of the present invention are as follows:

[0104] The present invention takes into account that in a complex multi-channel manufacturing system, the operational relationship between monitoring data can better reflect the operating status of the manufacturing industry chain than just focusing on each single data monitored. This method mainly monitors the operation of channel data. The collected multi-channel data is constructed into a time series graph, in which the graph nodes are the monitoring data in each channel, the edges are the associations between the monitoring data, and the timestamp is the date of data collection.

[0105] A graph anomaly detection framework based on autoencoder and attention mechanism is designed to encode the attributes, time and space information of monitoring data, and aggregate them to maximize the feature relationship between data. A model describing the normal operation of the industrial chain is established using non-abnormal data. When the monitoring data cannot be well fitted by the pre-trained model, it will be regarded as an anomaly.

[0106] At the same time, taking into account the chain reaction of anomalies in the industrial chain, the impact of abnormal data is predicted. Finally, the monitoring parameters are adjusted according to the anomalies and their propagation range to find the monitoring range that should be focused on.

[0107] like Figure 1As shown, a method for adjusting the monitoring range of multi-channel data based on graph anomaly detection includes the following steps:

[0108] Step 1: According to the operation status of the industrial chain, obtain monitoring data sequences from multiple channels related to the industrial chain, and then obtain a multi-channel monitoring data set; the multi-channel monitoring data set includes monitoring data sequences of several different channels, each monitoring data sequence is a univariate time series, including monitoring data collected by a monitoring point at different timestamps, which is used to characterize the safety and operation status of each channel.

[0109] Step 2: Divide the multi-channel monitoring dataset into training set and test set according to the set ratio.

[0110] In this implementation, the multi-channel monitoring data set is divided into a training set and a test set in a ratio of 8:2 for subsequent model training and verification, wherein the training set is used in the model training process to capture the potential patterns between the monitoring data; the test set is used to evaluate the performance of the model to ensure its generalization ability on unseen data.

[0111] Step 3: Use the K nearest neighbor method to construct a time series graph based on the monitoring data in the training set and the test set.

[0112] Specifically, each monitoring data is regarded as a node in the graph structure, the cosine similarity between nodes is calculated, and for each node, K nodes with the largest cosine similarity are selected as neighbor nodes and connected to the node to form an edge, and a graph structure describing the relationship between each monitoring data is constructed, in which the edge represents the neighbor relationship between the monitoring data corresponding to the node, that is, the monitoring data with edge relationship have a strong correlation. According to the collection time, multiple graph structures under different timestamps are combined into a time series graph, and then new multi-channel monitoring data are collected according to the monitoring scope to update the time series graph.

[0113] The graph structure is represented as ,in, is the timestamp, for The set of nodes in the graph structure at time instant, for The feature matrix of the nodes in the graph structure at time, is the number of nodes, is the dimension of the node’s feature matrix, for The adjacency matrix of the nodes in the graph structure at time.

[0114] The feature matrix is ​​a matrix representation of the features of the nodes in the graph structure; the elements in the adjacency matrix represent the relationship between the edges between any two nodes in the graph structure.

[0115] The cosine similarity is calculated as follows:

[0116] (twenty one)

[0117] in, is the cosine similarity between nodes, is the first nodes, is the first nodes, yes The norm of yes The norm of .

[0118] In the adjacency matrix, it represents the node The K nodes with the largest cosine similarity and the node The elements of the edge relationship between are:

[0119] (twenty two)

[0120] in, Represents the node in the adjacency matrix With Node The elements of the edge relationship between and is the node number; Representation and Node The K nodes with the largest cosine similarity.

[0121] Step 4: Build Figure 2 The autoencoder based graph anomaly detection model shown.

[0122] The graph anomaly detection model based on the autoencoder includes a spatiotemporal feature encoding module, an encoder, a structure decoder, an attribute decoder, an anomaly judgment module and an anomaly scoring module.

[0123] The spatiotemporal feature encoding module is used to use a time window of a set size to extract a number of graph structures from the time series graph, simultaneously capture the spatiotemporal coupling information between monitoring data from different channels from the graph structure, and construct a spatiotemporal feature vector that integrates spatiotemporal information for each monitoring data.

[0124] like Figure 3 As shown, the spatiotemporal feature vector includes original attributes, spatial features and temporal features in sequence.

[0125] The original attributes are monitoring data corresponding to the nodes in the graph structure.

[0126] The spatial feature represents the global structural information of the node in the entire time series graph.

[0127] The time feature represents the information of the node in the time dimension.

[0128] The method for obtaining the spatial features is:

[0129] For a graph structure at a certain timestamp, first randomly sample a set of anchor points from the graph structure , m is the number of anchor points, calculate the shortest distance from each node to the anchor point in the graph structure, use this set of shortest distances as the data source, and use a learnable single-layer linear mapping function to calculate the spatial features of the node:

[0130] (twenty three)

[0131] in, For Node The spatial characteristics of is a learnable single-layer linear mapping function, For cascade operation, For Node To Anchor The shortest distance.

[0132] The method for obtaining the time feature is:

[0133] The last timestamp t in the time window is compared with the different timestamps in the time window. The difference between is used as the data source, and the timestamp is calculated using a learnable single-layer linear mapping function. The time characteristics of each node in the corresponding structure diagram are: (twenty four)

[0134] in, represents the absolute value, For timestamp The corresponding nodes in the structure diagram time characteristics.

[0135] The spatiotemporal feature vector is:

[0136] (25)

[0137] in, For Node The space-time feature vector of For Node The original properties.

[0138] The encoder captures the dependency between monitoring data by sequentially selecting nodes in the graph structure corresponding to the last timestamp t in the time window as target nodes, aggregating the spatiotemporal feature vectors of the neighboring nodes of the target node in all graph structures in the time window to the target node in the graph structure corresponding to timestamp t, and obtaining a low-dimensional embedding representation of each node in the graph structure corresponding to timestamp t; the encoder adopts a graph convolutional network with a fusion attention mechanism.

[0139] Specifically, the encoder uses a multi-head attention mechanism and stacks multiple attention layers to improve the performance of the model, such as Figure 4 As shown, the specific process of the encoder is:

[0140] In order to obtain sufficient expressive power, a learnable linear transformation is first used to transform the spatiotemporal feature vector of each node in the time window:

[0141] (26)

[0142] in, is the transformed spatiotemporal feature vector, which is the input of the first attention layer in the graph convolutional network with fusion attention mechanism. is a trainable weight matrix shared among all nodes.

[0143] In the single-head attention mechanism l In the attention layer, the attention coefficient between the target node and the neighboring nodes is calculated:

[0144] ， (27)

[0145] (28)

[0146] in, For the l The query matrix of the attention layer, For the l The key matrix of the attention layer, For the l -1 output of the attention layer, and For the l The learnable weight matrix of the attention layer, For the l The target node calculated by the attention layer and neighbor nodes The attention coefficient between .

[0147] In the calculation process of dynamic graphs, it is necessary to jointly consider the target nodes in multiple time windows And its first-order neighbors, in order to make the attention coefficients between different nodes easier to compare, the attention coefficients are normalized:

[0148] (29)

[0149] in, is the normalized attention coefficient, is the softmax function, is the target node in the time window The set of neighbor nodes of is a neighbor node in the neighbor node set, For the l The target node calculated by the attention layer and neighbor nodes The attention coefficient between .

[0150] No. l The output vector of the attention layer is:

[0151] (30)

[0152] in, The target node In the l The output vector of the attention layer, is a nonlinear activation function, The target node In the l -1 output vector of the attention layer, Neighbor node In the l -1 output vector of the attention layer, The target node In the l The self-attention coefficient of the layer, For the l The learnable weight matrix of the attention layer.

[0153] In addition, in order to strengthen the learning process of the attention method, the above single-head attention mechanism is extended to a multi-head attention mechanism to learn multiple different attention distributions, and the average value of the output vector is used as the low-dimensional embedding of the node: (31)

[0154] in, The target node The low-dimensional embedding of No. The attention head l The attention coefficient of the layer, For the The attention head l The learnable weight matrix of the layer, The target node In the The attention head l The self-attention coefficient of the layer, is the number of the attention head, is the number of attention heads.

[0155] like Figure 5 As shown, the structure decoder is used to reconstruct the adjacency matrix of the graph structure of the last timestamp in the time window according to the low-dimensional embedding representation of each node, thereby realizing network reconstruction.

[0156] (32)

[0157] in, for sigmoid Function, used to capture nonlinear relationships, is the adjacency matrix of the reconstructed graph structure, is the low-dimensional embedding matrix of the node.

[0158] The attribute decoder is used to reconstruct the features of the node according to the learned low-dimensional embedding of the node, output the reconstructed feature matrix, and realize feature reconstruction;

[0159] Use a multilayer perceptron to reconstruct the features of the nodes:

[0160] (33)

[0161] in, is a multi-layer perceptron, is the learnable weight matrix, is the reconstructed feature matrix.

[0162] The anomaly judgment module is used to calculate the network reconstruction error and the feature reconstruction error, and to judge whether there is an abnormally connected subgraph in the last timestamp graph structure within the time window; the abnormally connected subgraph is a subgraph formed by comparing the original graph structure with the reconstructed graph structure, and clustering nodes whose feature reconstruction errors are greater than a set threshold and edges whose network reconstruction errors are greater than a set threshold; the reconstructed graph structure is obtained based on the reconstructed feature matrix and the reconstructed adjacency matrix.

[0163] The network reconstruction error is:

[0164] (34)

[0165] in, is the network reconstruction error, is the adjacency matrix of the original graph structure.

[0166] Feature reconstruction error:

[0167] (35)

[0168] in, is the feature reconstruction error, is the feature matrix of the original graph structure.

[0169] Evaluate the degree of abnormality in each abnormal area. The abnormalities identified by the above method are mainly divided into two types: point anomalies and sub-graph anomalies. Point anomalies correspond to an abnormality in a single link in a single channel. The impact of this anomaly is limited to the abnormal link, and the impact on the manufacturing industry chain is small, and the degree of abnormality is low; sub-graph anomalies indicate that related links in multiple channels have abnormalities at the same time. This anomaly may cause multiple links in the upstream and downstream of the manufacturing industry chain to be affected, forming a chain reaction, with a larger impact range and a higher degree of abnormality.

[0170] The anomaly scoring module is used to calculate the anomaly score of the abnormal connected subgraph using the anomaly scoring function to evaluate the severity of the anomaly.

[0171] Anomaly scoring function:

[0172] (36)

[0173] in, is the anomaly score, is a non-negative non-decreasing convex function, is the identified abnormal connected subgraph, and is the learnable weight vector, For Node The low-dimensional embedding of Neighbor node Low-dimensional embedding of .

[0174] Step 5: Use the time series graph obtained from the monitoring data in the training set to train the autoencoder-based graph anomaly detection model to obtain a trained autoencoder-based graph anomaly detection model.

[0175] In order to jointly learn the above two reconstruction errors for anomaly detection, the objective function of the anomaly judgment module in the graph anomaly detection model based on the autoencoder is:

[0176] The objective function of the anomaly judgment module in the graph anomaly detection model based on the autoencoder is:

[0177] (37)

[0178] in, It is a control parameter that balances the importance of network reconstruction and feature reconstruction. By minimizing the above objective function until the objective function converges, the graph anomaly detection model based on the autoencoder can approximate the features and edges of the nodes of the original time series graph based on the low-dimensional embedding of the nodes.

[0179] Minimizing the error between the reconstructed graph structure and the original graph structure enables the autoencoder-based graph anomaly detection model to model the normal operation mode of the industrial chain.

[0180] The objective function of the anomaly scoring module is:

[0181] (38)

[0182] in, R is the set of all abnormally connected subgraphs, r The sum of the anomaly scores is calculated separately for the nodes in the abnormal connected subgraph. This objective function can be optimized together with the objective function of the anomaly judgment module to build the entire framework in an end-to-end manner and realize anomaly detection and evaluation.

[0183] Step 6: Input the time series graph obtained from the monitoring data in the test set into the trained autoencoder-based graph anomaly detection model for anomaly detection to obtain the abnormal connected subgraph and its corresponding anomaly score.

[0184] The trained autoencoder-based graph anomaly detection model is used to model and reconstruct the monitoring data, and the errors between the reconstructed graph structure and the original graph structure are compared to identify the anomaly areas, namely the abnormal connected subgraphs. The autoencoder-based graph anomaly detection model that describes the normal operation of the industrial chain is established using non-abnormal data. The test data that cannot be fitted by the pre-trained autoencoder-based graph anomaly detection model is regarded as abnormal.

[0185] Step 7: Figure 6 As shown, the linear threshold model is used to predict the propagation process of abnormal connected subgraphs in the graph structure and determine the propagation range of the anomaly.

[0186] In linear algebra, the eigenvector obtained by eigenvalue decomposition of the adjacency matrix can effectively represent the importance of each node in the network. The eigenvector centrality evaluates the importance of a node in the network based on the importance of the node's connections and its neighbors. The activation threshold and influence weight of the node are set according to the centrality of the node's eigenvector. Not only the centrality of the node itself but also the centrality of the connected nodes should be considered, which reflects the importance of the node in the entire network structure.

[0187] Using the eigenvector centrality value of the node as the influence weight, it can be obtained by calculating the eigenvector of the adjacency matrix:

[0188] (39)

[0189] in, is the maximum eigenvalue of the adjacency matrix, for The corresponding eigenvector, For Node The eigenvector centrality value of For Node The eigenvector centrality value of .

[0190] The activation threshold of a node is:

[0191] (40)

[0192] in, For Node The activation threshold, To adjust the parameters.

[0193] The nodes in the detected abnormal connected subgraph are used as the initial activated nodes to obtain the initial activated node set. Then, influence propagation is performed to predict the propagation range of the anomaly in the channel. Starting from the initial activated node, the anomaly gradually spreads to other nodes in the network. For each unactivated node v, when the cumulative influence of its activated neighboring nodes on it is greater than its activation threshold, the node v is activated; the activated node will continue to influence its neighboring nodes until no new nodes are activated in the new round of propagation, and the propagation process ends.

[0194] Step 8: Figure 7 As shown, the monitoring parameters are adaptively adjusted according to the anomaly score and the propagation range, thereby adjusting the monitoring range of multi-channel manufacturing data.

[0195] In the time series diagram of multi-channel monitoring data, each edge has a weight as a monitoring parameter, which reflects the monitoring range. When an abnormality is detected in the channel, the monitoring parameter is adaptively adjusted according to the degree of abnormality and the propagation range. The monitoring parameter adjustment formula is:

[0196] (41)

[0197] in, is the original monitoring parameter, is the adjusted monitoring parameter, is the decay function, disis the shortest distance between the affected node and the abnormal node, b is an offset parameter used to gradually return the monitoring parameters to normal values.

Claims

1. A method for adjusting the monitoring range of multi-channel data based on graph anomaly detection, characterized in that: The following steps are involved: Step 1: According to the operation of the industrial chain, obtain monitoring data sequences from multiple channels related to the industrial chain, and then obtain a multi-channel monitoring data set; The multi-channel monitoring data set includes monitoring data sequences of several different channels, each monitoring data sequence is a univariate time series, including monitoring data collected by a monitoring point at different timestamps, which is used to characterize the safety and operation conditions of each channel; Step 2: Divide the multi-channel monitoring data set into a training set and a test set according to a set ratio; Step 3: Use the K nearest neighbor method to construct a time series graph based on the monitoring data in the training set and the test set; Step 4: Build an autoencoder-based graph anomaly detection model; The graph anomaly detection model based on the autoencoder includes a spatiotemporal feature encoding module, an encoder, a structure decoder, an attribute decoder, an anomaly judgment module and an anomaly scoring module; The spatiotemporal feature encoding module is used to extract a plurality of graph structures from the time series graph using a time window of a set size, and simultaneously capture the spatiotemporal coupling information between monitoring data of different channels from the graph structure, and construct a spatiotemporal feature vector integrating spatiotemporal information for each monitoring data; The encoder captures the dependency between monitoring data by sequentially selecting nodes in the graph structure corresponding to the last timestamp t in the time window as target nodes, aggregating the spatiotemporal feature vectors of the neighboring nodes of the target node in all graph structures in the time window to the target node in the graph structure corresponding to timestamp t, and obtaining a low-dimensional embedding representation of each node in the graph structure corresponding to timestamp t; The encoder adopts a graph convolutional network with a fusion attention mechanism; The structure decoder is used to reconstruct the adjacency matrix of the graph structure of the last timestamp in the time window according to the low-dimensional embedding representation of each node, so as to realize network reconstruction; The attribute decoder is used to reconstruct the features of the node according to the learned low-dimensional embedding of the node, output the reconstructed feature matrix, and realize feature reconstruction; The abnormal judgment module is used to calculate the network reconstruction error and the feature reconstruction error, and judge whether there is an abnormal connected subgraph in the last timestamp graph structure in the time window; the abnormal connected subgraph is a subgraph formed by comparing the original graph structure with the reconstructed graph structure, and gathering nodes with feature reconstruction errors greater than a set threshold and edges with network reconstruction errors greater than a set threshold; the reconstructed graph structure is obtained according to the reconstructed feature matrix and the reconstructed adjacency matrix; The anomaly scoring module is used to calculate the anomaly score of the abnormal connected subgraph using the anomaly scoring function to evaluate the severity of the anomaly; Step 5: Use the time series graph obtained from the monitoring data in the training set to train the graph anomaly detection model based on the autoencoder to obtain a trained graph anomaly detection model based on the autoencoder; Step 6: Input the time series graph obtained from the monitoring data in the test set into the trained autoencoder-based graph anomaly detection model for anomaly detection to obtain the abnormal connected subgraph and its corresponding anomaly score; Step 7: Use the linear threshold model to predict the propagation process of the abnormal connected subgraph in the graph structure and determine the propagation range of the anomaly; Step 8: Adaptively adjust monitoring parameters based on anomaly scores and propagation range, and then adjust the multi-channel manufacturing data monitoring range.

2. According to claim 1, a method for adjusting the multi-channel data monitoring range based on graph anomaly detection is characterized in that: The step 3 is specifically as follows: taking each monitoring data as a node in the graph structure, calculating the cosine similarity between the nodes, selecting K nodes with the largest cosine similarity as neighbor nodes for each node and connecting them with the node to form an edge, constructing a graph structure describing the relationship between the monitoring data, wherein the edge represents the neighbor relationship between the monitoring data corresponding to the node, and combining multiple graph structures under different timestamps into a time series graph according to the collection time; The graph structure is represented as ,in, is the timestamp, for The set of nodes in the graph structure at time instant, for The feature matrix of the nodes in the graph structure at time, is the number of nodes, is the dimension of the node’s feature matrix, for The adjacency matrix of nodes in the graph structure at the moment; The feature matrix is ​​a matrix representation of the features of the nodes in the graph structure; the elements in the adjacency matrix represent the relationship between the edges of any two nodes in the graph structure; In the adjacency matrix, it represents the node The K nodes with the largest cosine similarity and the node The elements of the edge relationship between are: （1） in, Represents the node in the adjacency matrix With Node The elements of the edge relationship between and is the node number; Representation and Node The K nodes with the largest cosine similarity.

3. According to the method for adjusting the multi-channel data monitoring range based on graph anomaly detection in claim 1, it is characterized in that: The spatiotemporal feature vector includes original attributes, spatial features and temporal features in sequence; The original attribute is the monitoring data corresponding to the node in the graph structure; The spatial feature represents the global structural information of the node in the entire time series graph; The time feature represents the information of the node in the time dimension; The spatiotemporal feature vector is: （2） in, For Node The space-time feature vector of For Node The original properties of For Node The spatial characteristics of node The temporal characteristics of The method for obtaining the spatial features is: For a graph structure at a certain timestamp, first randomly sample a set of anchor points from the graph structure , m is the number of anchor points, calculate the shortest distance from each node to the anchor point in the graph structure, use this set of shortest distances as the data source, and use a learnable single-layer linear mapping function to calculate the spatial features of the node: （3） in, is a learnable single-layer linear mapping function, For cascade operation, For Node To Anchor The shortest distance; The method for obtaining the time feature is: The last timestamp t in the time window is compared with the different timestamps in the time window. The difference between is used as the data source, and the timestamp is calculated using a learnable single-layer linear mapping function. The time characteristics of each node in the corresponding structure diagram are: (4) in, Indicates absolute value.

4. The method for adjusting the multi-channel data monitoring range based on graph anomaly detection according to claim 3 is characterized in that: The specific process of the encoder is: First, a learnable linear transformation is used to transform the spatiotemporal feature vector of each node in the time window: （5） in, is the transformed spatiotemporal feature vector, which is the input of the first attention layer in the graph convolutional network with fusion attention mechanism. is a trainable weight matrix, shared among all nodes; In the single-head attention mechanism l In the attention layer, the attention coefficient between the target node and the neighboring nodes is calculated: ， （6） （7） in, For the l The query matrix of the attention layer, For the l The key matrix of the attention layer, For the l -1 output of the attention layer, and For the l The learnable weight matrix of the attention layer, For the l The target node calculated by the attention layer and neighbor nodes The attention coefficient between Normalize the attention coefficient: （8） in, is the normalized attention coefficient, is the softmax function, is the target node in the time window The set of neighbor nodes of is a neighbor node in the neighbor node set, For the l The target node calculated by the attention layer and neighbor nodes The attention coefficient between No. l The output vector of the attention layer is: （9） in, The target node In the l The output vector of the attention layer, is a nonlinear activation function, The target node In the l -1 output vector of the attention layer, Neighbor node In the l -1 output vector of the attention layer, The target node In the l The self-attention coefficient of the layer, For the l The learnable weight matrix of the attention layer; The above single-head attention mechanism is extended to a multi-head attention mechanism, using the average of the output vector as the low-dimensional embedding of the node: (10) in, The target node The low-dimensional embedding of No. The attention head l The attention coefficient of the layer, For the The attention head l The learnable weight matrix of the layer, The target node In the The attention head l The self-attention coefficient of the layer, is the number of the attention head, is the number of attention heads.

5. The method for adjusting the multi-channel data monitoring range based on graph anomaly detection according to claim 1, characterized in that: The adjacency matrix of the graph structure of the last timestamp in the time window reconstructed by the structure decoder is: （11） in, for sigmoid Function, used to capture nonlinear relationships, is the adjacency matrix of the reconstructed graph structure, is the low-dimensional embedding matrix of the node; The attribute decoder uses a multi-layer perceptron to reconstruct the features of the node: （12） in, is a multi-layer perceptron, is the learnable weight matrix, is the reconstructed feature matrix.

6. The method for adjusting the multi-channel data monitoring range based on graph anomaly detection according to claim 5 is characterized in that: The network reconstruction error is: （13） in, is the network reconstruction error, is the adjacency matrix of the original graph structure; The feature reconstruction error: （14） in, is the feature reconstruction error, is the feature matrix of the original graph structure; The anomaly scoring function is: （15） in, is the anomaly score, is a non-negative non-decreasing convex function, is the identified abnormal connected subgraph, and is the learnable weight vector, For Node The low-dimensional embedding of Neighbor node Low-dimensional embedding of .

7. The method for adjusting the multi-channel data monitoring range based on graph anomaly detection according to claim 6 is characterized in that: The objective function of the anomaly judgment module in the graph anomaly detection model based on the autoencoder in step 5 is: (16) in, is a control parameter that balances the importance of network reconstruction and feature reconstruction; The objective function of the anomaly scoring module is: （17） in, R is the set of all abnormally connected subgraphs, r The sum of the anomaly scores is calculated separately for the nodes in the anomaly connected subgraph.

8. The method for adjusting the multi-channel data monitoring range based on graph anomaly detection according to claim 7 is characterized in that: The step 7 is specifically as follows: The eigenvalue decomposition of the adjacency matrix is ​​performed to obtain the eigenvector, and the activation threshold and influence weight of the node are set according to the centrality of the node's eigenvector; Use the node's eigenvector centrality value as the influence weight: （18） in, is the maximum eigenvalue of the adjacency matrix, for The corresponding eigenvector, For Node The eigenvector centrality value of For Node The eigenvector centrality value of The activation threshold of a node is: （19） in, For Node The activation threshold, To adjust the parameters; The nodes in the detected abnormal connected subgraph are used as the initial activated nodes to obtain the initial activated node set. Then, influence propagation is performed to predict the propagation range of the anomaly in the channel. Starting from the initial activated node, the anomaly gradually spreads to other nodes in the network. For each unactivated node v, when the cumulative influence of its activated neighboring nodes on it is greater than its activation threshold, the node v is activated; the activated node will continue to influence its neighboring nodes until no new nodes are activated in the new round of propagation, and the propagation process ends.

9. The method for adjusting the multi-channel data monitoring range based on graph anomaly detection according to claim 6 is characterized in that: The monitoring parameter adjustment formula in step 8 is: （20） in, is the original monitoring parameter, is the adjusted monitoring parameter, is the decay function, dis is the shortest distance between the affected node and the abnormal node, b is the offset parameter.

Images