Equipment anomaly detection method and system based on time-frequency characteristic interaction

Abstract

The invention discloses an equipment anomaly detection method and system based on time-frequency characteristic interaction. The method comprises the following steps: acquiring time sequence data generated in an equipment operation process; encoding the time sequence data to obtain preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation; respectively extracting time-frequency features of the local embedded data and the global embedded data to obtain local time-frequency features and global time-frequency features; adding the local time-frequency feature and the global time-frequency feature to obtain a spliced feature; performing feature extraction on the spliced features, and adding the extracted features with the preliminary embedded representation to obtain reconstructed data; and obtaining an equipment anomaly detection result according to the reconstruction data. And the accuracy of equipment anomaly detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of time series industrial detection, and in particular to a device anomaly detection method and system based on time-frequency feature interaction. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] With the development of industrial intelligence, equipment will generate a variety of time series data during operation. In order to ensure the normal operation of the equipment, it is necessary to perform abnormal detection on the equipment based on the time series data generated during the operation of the equipment.

[0004] Related technologies propose to use deep learning methods to analyze the time series data generated by the device, extract time domain features from the time series data, and then identify the time domain features to obtain device anomaly detection results.

[0005] However, when this method performs equipment anomaly detection, it only utilizes the time domain characteristics of the data, and does not consider the frequency domain characteristics of the data; and when performing equipment anomaly detection, it does not consider the correlation between multiple variables; resulting in a low accuracy rate for equipment anomaly detection. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a device anomaly detection method and system based on time-frequency feature interaction, which realizes accurate detection of device anomalies.

[0007] To achieve the above object, the present invention adopts the following technical solution:

[0008] First, a device anomaly detection method based on time-frequency feature interaction is proposed, including:

[0009] Obtain the time series data generated during the operation of the equipment;

[0010] Encode the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation;

[0011] Extracting the time-frequency features of local embedded data and global embedded data respectively to obtain local time-frequency features and global time-frequency features;

[0012] Add the local time-frequency features and the global time-frequency features to obtain the concatenated features;

[0013] After feature extraction, the concatenated features are added to the preliminary embedding representation to obtain the reconstructed data;

[0014] According to the reconstructed data, the device anomaly detection result is obtained.

[0015] Further, position coding and time coding are performed on the time series data to obtain position coding data and time coding data;

[0016] Add the positional encoding data and the time encoding data to obtain a preliminary embedding representation;

[0017] The initial embedding representation is upgraded in two ways to obtain the upgraded local embedding data and global embedding data.

[0018] Furthermore, a dual-branch time-frequency feature extraction network is used to extract time-frequency features of local embedded data and global embedded data respectively; the dual-branch time-frequency feature extraction network takes local embedded data or global embedded data as input, and outputs local time-frequency features or global time-frequency features; the dual-branch time-frequency feature extraction network includes a first branch, a second branch and a multi-layer perceptron; the first branch extracts time domain features from data input into the dual-branch time-frequency feature extraction network; the second branch performs dimensionality reduction on the data input into the dual-branch time-frequency feature extraction network to obtain dimensionality reduced data, and extracts frequency domain features and dimensionality reduced data features from the dimensionality reduced data respectively; the multi-layer perceptron performs feature extraction on the concatenated features of the time domain features and the frequency domain features to obtain time-frequency intermediate features; the dimensionality reduced data features are multiplied by the frequency domain features and then added to the time-frequency intermediate features to obtain the time-frequency features as the output of the dual-branch time-frequency feature extraction network.

[0019] Furthermore, the local time-frequency features and the global time-frequency features are spliced ​​to obtain the spliced ​​features. The process includes:

[0020] Generate query vector from local time-frequency features;

[0021] Generate key vectors and expression vectors from global time-frequency features;

[0022] According to the query vector and the key vector, obtain the cross attention weight matrix;

[0023] Use the cross attention weight matrix to perform weighted operations on the expression vector to obtain weighted features;

[0024] The weighted features and local time domain features are multiplied by the corresponding weights and then concatenated to obtain the concatenated features.

[0025] Furthermore, the process of obtaining the reconstructed data is:

[0026] Perform convolution operation on the concatenated features to obtain the convolution features;

[0027] Perform linear operation and residual processing on the convolution features to obtain residual features;

[0028] Perform convolution operation on the residual features to obtain residual convolution features;

[0029] The residual post-convolution features are dimensionally transformed and added to the preliminary embedding representation to obtain the reconstructed data.

[0030] Furthermore, an anomaly score is calculated based on the difference between the reconstructed data and the preliminary embedding representation;

[0031] According to the anomaly score, the device anomaly detection result is obtained.

[0032] Secondly, a device anomaly detection system based on time-frequency feature interaction is proposed, including:

[0033] A data acquisition unit, used to acquire time series data generated during the operation of the equipment;

[0034] An encoding unit, used for encoding the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation;

[0035] A feature extraction unit, used to extract time-frequency features of local embedded data and global embedded data respectively, to obtain local time-frequency features and global time-frequency features;

[0036] A feature concatenation unit, used to add local time-frequency features and global time-frequency features to obtain concatenated features;

[0037] A data reconstruction unit, used for extracting the concatenated features and adding them to the preliminary embedding representation to obtain reconstructed data;

[0038] The result acquisition unit is used to obtain the device abnormality detection result according to the reconstructed data.

[0039] In a third aspect, a computer device is provided, the device comprising:

[0040] a processor adapted to execute a computer program;

[0041] A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, a device anomaly detection method based on time-frequency feature interaction proposed in the first aspect is implemented.

[0042] In a fourth aspect, a computer-readable storage medium is proposed, wherein the computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing a device anomaly detection method based on time-frequency feature interaction proposed in the first aspect.

[0043] In a fifth aspect, a computer program product is proposed, which includes a computer program. When the computer program is executed by a processor, it implements a device anomaly detection method based on time-frequency feature interaction proposed in the first aspect.

[0044] Compared with the prior art, the present invention has the following beneficial effects:

[0045] The present invention proposes a device anomaly detection method and system based on time-frequency feature interaction. When performing device anomaly detection, the method makes full use of the time domain information and frequency domain information of the time series data generated by the device, and the device anomaly detection model makes full use of the relationship between variables when extracting and fusing features of the time domain information and the frequency domain information, thereby improving the accuracy of device anomaly detection.

[0046] Advantages of additional aspects of the present invention will be given in part in the following description, and in part will become obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The drawings in the specification, which constitute a part of the present application, are used to provide further understanding of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute improper limitations on the present application.

[0048] Figure 1 It is an overall flow chart of a device anomaly detection method based on time-frequency feature interaction disclosed in an embodiment;

[0049] Figure 2 A diagram showing the structure of a dual-branch time-frequency feature extraction network disclosed in an embodiment;

[0050] Figure 3 A diagram showing a dual-branch feature-guided aggregation network structure disclosed in an embodiment;

[0051] Figure 4 A structural diagram of a multivariate correlation extraction mechanism disclosed in an embodiment;

[0052] Figure 5 The overall architecture diagram of the device anomaly detection model disclosed in the embodiment. DETAILED DESCRIPTION

[0053] The present invention will be further described below in conjunction with the accompanying drawings and embodiments.

[0054] It should be noted that the following detailed descriptions are illustrative and are intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present application belongs.

[0055] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit the exemplary embodiments according to the present application. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprise" and / or "include" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof.

[0056] In the absence of conflict, the embodiments of the present invention and the features of the embodiments may be combined with each other.

[0057] Example 1

[0058] With the development of industrial intelligence, a large amount of time series data is generated in industrial production. The goal of time series anomaly detection is to identify abnormal patterns in these data, that is, situations that are inconsistent with normal operating behavior. Equipment will generate a variety of time series data during operation; for example, hydrogen production equipment will generate reactor temperature, cooling system temperature, reactor pressure, hydrogen flow, current and voltage changes, pH value in the reactor, reactant concentration, hydrogen purity and other data during operation. In order to ensure the safe operation of hydrogen production equipment, it is crucial to perform anomaly detection on the time series generated by these devices. By detecting anomalies in time series, hydrogen production equipment anomalies can be discovered in a timely manner to ensure production safety.

[0059] Methods based on deep learning have been widely proposed for application in time series anomaly detection, but there are still several difficulties in processing the time series data generated by hydrogen production equipment: First, the time series data generated by hydrogen production equipment during operation is complex and diverse, which requires the algorithm to have strong robustness; second, the frequency domain characteristics of the time series are crucial for time series anomaly detection, and some algorithms do not model the frequency domain characteristics; third, the relationship between multiple variables is crucial for time series anomaly detection, and some algorithms do not model the relationship between multiple variables. Therefore, the current time series anomaly detection method cannot accurately detect equipment anomalies.

[0060] In order to achieve accurate detection of device anomalies, in this embodiment, a device anomaly detection method based on time-frequency feature interaction is disclosed, such as Figure 1-Figure 5 As shown, including:

[0061] S1: Obtain the time series data generated during the operation of the equipment;

[0062] S2: Encode the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation;

[0063] S3: extracting the time-frequency features of the local embedded data and the global embedded data respectively to obtain the local time-frequency features and the global time-frequency features;

[0064] S4: Add the local time-frequency features and the global time-frequency features to obtain the concatenated features;

[0065] S5: extract the concatenated features and add them to the preliminary embedding representation to obtain reconstructed data;

[0066] S6: Obtain device anomaly detection results based on the reconstructed data.

[0067] This embodiment uses anomaly detection of hydrogen production equipment to explain in detail a method for detecting anomaly of equipment based on time-frequency feature interaction disclosed in this embodiment.

[0068] The time series data generated during the operation of the equipment acquired in this embodiment include: reactor temperature, cooling system temperature, reactor pressure, hydrogen flow rate, current and voltage changes, pH value in the reactor, reactant concentration and hydrogen purity, etc. Each data has corresponding timestamp information.

[0069] After obtaining the time series data, fill or remove missing values ​​in the data to ensure the integrity of the data. Then, convert the time series data into a csv file.

[0070] The initial time series data obtained in this embodiment is a long time series. The long time series is divided into short time series by a sliding window method. The short time series is the time series data X obtained by S1. L .

[0071] X L ={x i , x i+1 , …x i+L-1}

[0072] Among them, X L ∈R N×L Represents time series data, which is a window time series. R represents a real number set. N represents the data dimension, which is the same as the number of sensors in the device. L represents the sliding window length.

[0073] In this embodiment, the process of encoding time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation includes:

[0074] Position coding and time coding are performed on the time series data to obtain position coding data and time coding data;

[0075] Add the positional encoding data and the time encoding data to obtain a preliminary embedding representation;

[0076] The initial embedding representation is upgraded in two ways to obtain the upgraded local embedding data and global embedding data.

[0077] This embodiment uses a dimensionality-raising coding module to encode the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data X of the preliminary embedding representation. global .

[0078] The dimension-upgrading coding module includes a dynamic position coding block, a temporal coding block and a dual-branch dimension-upgrading block.

[0079] Dynamic position encoding block for time series data X L Perform position encoding to obtain position encoding data; by L By performing position encoding, the position uniqueness of each timestamp in the data is obtained, and dynamic adjustment and adaptive mechanisms are designed to improve the position encoding capability of time series data, making it more suitable for processing tasks with complex time characteristics.

[0080] The time series encoding block is used to encode the time series data X L Perform time coding to obtain time coded data; by L Perform time coding to initially obtain data X L The timing of each timestamp in .

[0081] Then add the position code data and time code data to get the time series data X L The initial embedding representation of After that, the preliminary embedding representation is sent to the dual-branch dimension-raising block, which obtains two two-dimensional embedding data with different properties through two sampling strategies, namely, the local embedding data X iocal and global embedding data X global , which is convenient for subsequent feature extraction.

[0082] The overall formula of the dimension-up coding module is as follows:

[0083]

[0084] Among them, e represents the Euler number, i represents the actual timestamp position of the window time series, and L represents the window length. represents the window time series data after position encoding; X L Represents window time series data of length L, Represents the window time series data after time encoding, Represents the preliminary embedding representation of windowed time series data, l represents a position in the sequence, l′ represents the timestamp index, γ represents the variance, calculates the weight between l and l′, ⊙ represents element-by-element multiplication, δ represents the learnable frequency parameter, Conv1d 3×1 represents a 1D convolution module with a convolution kernel size of 3×1. It means bitwise addition. represents the local embedded data after dimensionality increase, Represents the global embedded data after dimensionality increase.

[0085] This embodiment uses a dual-branch time-frequency feature extraction network to extract time-frequency features of local embedded data and global embedded data respectively; the dual-branch time-frequency feature extraction network takes local embedded data or global embedded data as input and outputs local time-frequency features or global time-frequency features.

[0086] like Figure 2 As shown, the dual-branch time-frequency feature extraction network includes a first branch, a second branch and a multi-layer perceptron; the first branch extracts time domain features from the data input into the dual-branch time-frequency feature extraction network; the second branch reduces the dimension of the data input into the dual-branch time-frequency feature extraction network to obtain the reduced-dimensional data, and extracts frequency domain features and reduced-dimensional data features from the reduced-dimensional data respectively; the multi-layer perceptron extracts features from the concatenation of the time domain features and the frequency domain features to obtain the intermediate time-frequency features; the reduced-dimensional data features are multiplied by the frequency domain features and then added to the intermediate time-frequency features to obtain the time-frequency features as the output of the dual-branch time-frequency feature extraction network.

[0087] The first branch includes a linear layer module that reduces the number of channels, a linear layer module that restores the number of channels, a channel-by-channel 2D convolution module with a convolution kernel size of 3×3, a 2D point-by-point convolution module with a convolution kernel size of 1×1, a matrix normalization function, a ReLU activation function, a multi-scale 1D convolution module, a linear layer module that does not change the number of channels, and a residual edge. The second branch includes a time-frequency conversion module, a phase correction module, a frequency domain filter module, a complex excitation function module, and an inverse time-frequency conversion module. and In the same way, it is sent to the network to extract local time-frequency features and global time-frequency features. The following is to extract the local embedded data X local The local time-frequency features of the dual-branch time-frequency feature extraction network are described in detail.

[0088] Locally embedded data Input to the first branch to extract local time domain features. local The matrix normalization function is used to normalize the data channel by channel to obtain Secondly, the weights are generated by reducing the number of channels through the linear layer module and the ReLU activation function and restoring the number of channels through the linear layer module. X local and Multiply bit by bit to get Will It is obtained through 2D channel-by-channel convolution module, 2D point-by-point convolution module and ReLU activation function. Will The first dimension is adjusted to the last dimension and then fed into the multi-scale 1D convolution module to obtain Will After the second dimension is adjusted to the last dimension, it is sent to a linear layer module without changing the number of channels for information extraction and residual connection to obtain The formula is as follows:

[0089]

[0090] in, is the local time domain feature, α, β represent the matrix element position, σ represents the ReLU activation function, ψ 1 ,ψ 2 represents the weight matrix, DW represents the 2D channel-by-channel convolution module, PW represents the 2D point-by-point convolution module, and P represents the padding operation. Represents bitwise addition.

[0091] Embedding data locally Input to the second branch to extract local frequency domain features. First, reduce X local ∈R d×L The dimension is reduced to obtain the data after dimension reduction, and the data after dimension reduction is sent to the time-frequency conversion module and the multi-layer perceptron respectively. The multi-layer perceptron extracts the features of the data after dimension reduction from the data after dimension reduction. The time-frequency conversion module converts the reduced-dimensional data into a frequency domain signal X(ω,l). Then, the phase correction module performs phase correction on the frequency domain signal X(ω,l) to improve the distortion that may occur in the time-frequency conversion and obtain the frequency domain feature X correct (ω,l), which is conducive to feature extraction of non-stationary sequences. Then, the frequency domain feature X is filtered using a frequency domain filter. correct (ω,l) is filtered to obtain the filtered features Frequency domain filters can enhance features and suppress noise. Then enter the complex excitation function to obtain the local frequency domain characteristics of the excitation Finally, the local frequency domain characteristics of the excitation are converted into Convert to the time domain to get the final local frequency domain feature X F The formula is as follows:

[0092]

[0093] φ(ω,l)=∠X(ω,l)

[0094] X correct (ω,l)=|F(ω,l)|e j(φ(ω,l)+Median{v(ω′)|ω′∈Neighbor(ω)})

[0095]

[0096] Among them, X(ω,l) is the frequency domain representation, ω represents the frequency variable, l represents the timestamp, j is the imaginary unit, φ(ω,l) represents the phase, Median represents the median function, Neighbor represents the neighborhood, and X correct (ω,l) represents the corrected frequency domain feature, represents the filtered feature, ⊙ represents the point-by-point product in the frequency domain, H(ω) represents the filter, represents the local frequency domain feature of the excitation, a represents the real part of the feature after filtering, b represents the imaginary part of the feature after filtering, X F Represents the final local frequency domain features.

[0097] The local time domain features And the final local frequency domain feature X F Splicing to get the post-splicing features After splicing, the features Send it to the multi-layer perceptron to get the intermediate time-frequency features The features of the data after dimensionality reduction And the final local frequency domain feature X F Multiply bit by bit to get The time-frequency intermediate features and Add bit by bit to get local time-frequency features It is the final local time-frequency feature, and the formula is as follows:

[0098]

[0099] in, It means bitwise addition. represents bitwise multiplication, and cat represents concatenation operation.

[0100] In this embodiment, local time-frequency features are obtained. and global time-frequency characteristics Finally, the local time-frequency features and the global time-frequency features are spliced ​​to obtain the spliced ​​features. The process includes:

[0101] The local time-frequency features Generate a query vector Q;

[0102] Generate key vector K and expression vector V from global time-frequency features;

[0103] According to the query vector Q and the key vector K, obtain the cross attention weight matrix;

[0104] Use the cross attention weight matrix to perform weighted operations on the expression vector to obtain weighted features;

[0105] The weighted features and local time domain features are multiplied by the corresponding weights and then concatenated to obtain the concatenated features F.

[0106] This embodiment is implemented by Figure 3 The dual-branch features shown guide the aggregation network to local time-frequency features and global time-frequency characteristics To enrich the local time domain features and improve the anomaly detection capability, the dual-branch features guide the aggregation network to pass the linear layer Generate the query vector Q, and pass it through two linear layers respectively Generate the key vector K and expression vector V respectively; then calculate the scaled dot product of the query vector Q and the key vector K and normalize the result to generate the corresponding cross-attention weight matrix, and finally perform a weighted operation on the expression vector V by the cross-attention weight matrix, so that Further enrich the information to obtain weighted features Afterwards, the weighted features are aggregated using an adaptive feature aggregation mechanism. and global time-frequency characteristics Multiply them with the corresponding weights and concatenate them to obtain the concatenated feature F; among them, and global time-frequency characteristics The multiplied weights are used to adopt the adaptive feature aggregation mechanism, and the weighted features are respectively and global time-frequency characteristics The learned weights.

[0107] The formula for obtaining the feature F after splicing is as follows:

[0108]

[0109] in, represents the Q vector, represents the K vector, represents the V vector, W 1 , W 2 , W 3 represents the learnable parameter matrix, () T Indicates transposing the matrix in brackets, smx indicates the normalization function, ε 1 ,ε 2represents the different weights learned during the training process, ∈ is used to prevent the denominator from being 0, and the value is 0.0001. cat represents the concatenation of local time-frequency features and global time-frequency features along the time dimension, and F represents the concatenated features.

[0110] After obtaining the spliced ​​features, this embodiment extracts the spliced ​​features and adds them to the preliminary embedding representation to obtain reconstructed data. The process of obtaining the reconstructed data is as follows:

[0111] Perform convolution operation on the concatenated features to obtain the convolution features;

[0112] Perform linear operation and residual processing on the convolution features to obtain residual features;

[0113] Perform convolution operation on the residual features to obtain residual convolution features;

[0114] The residual post-convolution features are dimensionally transformed and added to the preliminary embedding representation to obtain the reconstructed data.

[0115] Specifically, this embodiment adopts Figure 4 The multivariate correlation extraction mechanism shown in FIG. 1 extracts features from the concatenated features and adds them to the preliminary embedding representation to obtain reconstructed data.

[0116] The multivariate correlation extraction mechanism includes a 2D convolution module with a convolution kernel size of 3×3, The convolutional modules are H×1 convolutional kernels, linear layer modules that do not change the channel dimension, and L convolutional kernels of size The concatenated features are further aggregated through a 2D convolution module with a convolution kernel size of 3×3 to obtain F 2 . F 2 Then go through After the convolution modules, we get the post-convolution feature F 3 ; The convolution feature F 3 After the corresponding matrices are added bit by bit through the linear layer module without changing the channel dimension and through the residual connection, the residual feature F is obtained. 4 Then, after L convolution modules, the residual feature F 4 Perform multiple layers of convolution to obtain the residual post-convolution feature F 5 , the residual post-convolution feature F 5 Perform dimension transformation to obtain feature F 6 ; Finally, the preliminary embedding representation With feature F 6 The final reconstructed data F is obtained by bitwise addition of the residual edges 7 The formula is as follows:

[0117] F 2=σ(Conv2d(σ(Conv2d(F))))

[0118]

[0119] Among them, σ represents the ReLU activation function, Conv2d represents the 2D convolution operation, express A 1D convolution operation with a kernel size of H×1, Indicates that the size of L convolution kernels is The 1D convolution operation, ψ 3 ,ψ 4 ,ψ 5 represents the relevant weight, b 3 ,b 4 ,b 5 represents the bias term, represents bitwise addition, reshape represents dimension transformation operation, and F 7 Represents the final reconstructed data.

[0120] This embodiment calculates an anomaly score based on the difference between the reconstructed data and the preliminary embedding representation;

[0121] According to the anomaly score, the device anomaly detection result is obtained.

[0122] This embodiment uses an abnormality discrimination network to process the reconstructed data and the preliminary embedded representation to obtain the device abnormality detection result. The abnormality discrimination network calculates the difference between the reconstructed data and the preliminary embedded representation, and averages the difference to obtain an abnormality score; when the abnormality score is greater than the abnormality score threshold, it is determined that the device is abnormal; when the abnormality score is less than or equal to the abnormality score threshold, it is determined that the device is not abnormal.

[0123] The process of determining the abnormal score threshold is as follows:

[0124] The anomaly discrimination network first calculates the difference between the initial embedding representation of the input and the reconstructed data through the loss function on the training set and averages the results to obtain the anomaly score of the data in the training set. After that, the anomaly score of the data in the test set is obtained by the same operation, and the anomaly score of the data in the test set is combined with the anomaly score of the data in the training set to obtain an anomaly score array, and then the anomaly score array is calculated according to the set anomaly ratio to obtain the anomaly score threshold.

[0125] The process of determining the anomaly score threshold is as follows:

[0126]

[0127] where s tra Represents the abnormal score of the data in the training set, s tesrepresents the anomaly score of the data in the test set, cat represents the concatenation operation, percent represents the corresponding percentile in the anomaly score array, and θ is the anomaly score threshold.

[0128] The dimension-upgrading coding module, the dual-branch time-frequency feature extraction network, the dual-branch feature-guided aggregation network, the multivariate correlation mechanism, and the abnormality discrimination network of this embodiment constitute the device abnormality detection model. The structure of the device abnormality detection model is as follows: Figure 5 shown.

[0129] After building the device anomaly detection model, this embodiment obtains the existing time series data of the corresponding device and divides it into a training set and a test set. The time series that does not contain anomalies is divided into a training set, and the time series that contains anomalies is divided into a test set, and the test set is also used as a validation set. Then the mean and variance of the training data are calculated, and the training data is standardized to obtain the preprocessed training data.

[0130] The preprocessed training set data is input into the constructed equipment anomaly detection model. The initial learning rate is set to 0.001. The Adam optimizer is used to accelerate the training of the model. The input batch size of the data is 128. The network model is trained for 10 rounds. After each round of training, the trained network model is verified with the test set to obtain the accuracy of the network model. In the training process, the L2 loss function is used to optimize and update the model. The L2 loss function is:

[0131]

[0132] Among them, X represents the original time series data, F 7 Represents the reconstructed data.

[0133] After the training is completed, a trained device anomaly detection model is obtained, and the trained device anomaly detection model is used to monitor device anomalies in real time.

[0134] The present embodiment discloses a device anomaly detection method based on time-frequency feature interaction. When performing anomaly detection on a device, the time domain information and frequency domain information of the time series data generated by the device are fully utilized. Moreover, when performing feature extraction and fusion on the time domain information and the frequency domain information, the device anomaly detection model fully utilizes the relationship between variables, thereby improving the accuracy of device anomaly detection.

[0135] Example 2

[0136] In this embodiment, a device anomaly detection system based on time-frequency feature interaction is disclosed, including:

[0137] A data acquisition unit, used to acquire time series data generated during the operation of the equipment;

[0138] An encoding unit, used for encoding the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation;

[0139] A feature extraction unit, used to extract time-frequency features of local embedded data and global embedded data respectively, to obtain local time-frequency features and global time-frequency features;

[0140] A feature concatenation unit, used to add local time-frequency features and global time-frequency features to obtain concatenated features;

[0141] A data reconstruction unit, used for extracting the concatenated features and adding them to the preliminary embedding representation to obtain reconstructed data;

[0142] The result acquisition unit is used to obtain the device abnormality detection result according to the reconstructed data.

[0143] The present invention also discloses a computer device, which includes:

[0144] a processor adapted to execute a computer program;

[0145] A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium. When the computer program is executed by the processor, a device anomaly detection method based on time-frequency feature interaction disclosed in Example 1 is implemented.

[0146] The present invention also discloses a computer-readable storage medium, which stores a computer program. The computer program is suitable for being loaded by a processor and executing a device anomaly detection method based on time-frequency feature interaction disclosed in Example 1.

[0147] The present invention also discloses a computer program product, which includes a computer program. When the computer program is executed by a processor, it implements a device anomaly detection method based on time-frequency feature interaction disclosed in Example 1.

[0148] The method disclosed in Example 1 can be directly embodied as a hardware processor, or can be executed by a combination of hardware and software modules in the processor. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware. To avoid repetition, it will not be described in detail here.

[0149] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0150] Although the above describes the specific implementation mode of the present invention in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art on the basis of the technical solution of the present invention without creative work are still within the scope of protection of the present invention.

Claims

1. A device anomaly detection method based on time-frequency feature interaction, characterized in that: include: Obtain the time series data generated during the operation of the equipment; Encode the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation; Extracting the time-frequency features of local embedded data and global embedded data respectively to obtain local time-frequency features and global time-frequency features; Add the local time-frequency features and the global time-frequency features to obtain the concatenated features; After feature extraction, the concatenated features are added to the preliminary embedding representation to obtain the reconstructed data; According to the reconstructed data, the device anomaly detection result is obtained.

2. The device anomaly detection method based on time-frequency feature interaction according to claim 1, characterized in that: Position coding and time coding are performed on the time series data to obtain position coding data and time coding data; Add the positional encoding data and the time encoding data to obtain a preliminary embedding representation; The initial embedding representation is upgraded in two ways to obtain the upgraded local embedding data and global embedding data.

3. The device anomaly detection method based on time-frequency feature interaction according to claim 1, characterized in that: A dual-branch time-frequency feature extraction network is used to extract time-frequency features of local embedded data and global embedded data respectively; the dual-branch time-frequency feature extraction network takes local embedded data or global embedded data as input and outputs local time-frequency features or global time-frequency features; the dual-branch time-frequency feature extraction network includes a first branch, a second branch and a multi-layer perceptron; the first branch extracts time domain features from data input into the dual-branch time-frequency feature extraction network; the second branch performs dimensionality reduction on the data input into the dual-branch time-frequency feature extraction network to obtain dimensionality reduced data, and extracts frequency domain features and dimensionality reduced data features from the dimensionality reduced data respectively; the multi-layer perceptron performs feature extraction on the features after splicing the time domain features and the frequency domain features to obtain time-frequency intermediate features; the dimensionality reduced data features are multiplied by the frequency domain features and then added to the time-frequency intermediate features to obtain the time-frequency features as the output of the dual-branch time-frequency feature extraction network.

4. The device anomaly detection method based on time-frequency feature interaction according to claim 1, characterized in that: The local time-frequency features and the global time-frequency features are concatenated to obtain the concatenated features. The process includes: Generate query vector from local time-frequency features; Generate key vectors and expression vectors from global time-frequency features; According to the query vector and the key vector, obtain the cross attention weight matrix; Use the cross attention weight matrix to perform weighted operations on the expression vector to obtain weighted features; The weighted features and local time domain features are multiplied by the corresponding weights and then concatenated to obtain the concatenated features.

5. The device anomaly detection method based on time-frequency feature interaction according to claim 1, characterized in that: The process of obtaining reconstructed data is: Perform convolution operation on the concatenated features to obtain the convolution features; Perform linear operation and residual processing on the convolution features to obtain residual features; Perform convolution operation on the residual features to obtain residual convolution features; The residual post-convolution features are dimensionally transformed and added to the preliminary embedding representation to obtain the reconstructed data.

6. The device anomaly detection method based on time-frequency feature interaction according to claim 1, characterized in that: Calculate anomaly scores based on the difference between the reconstructed data and the preliminary embedding representation; According to the anomaly score, the device anomaly detection result is obtained.

7. A device anomaly detection system based on time-frequency feature interaction, characterized in that: include: A data acquisition unit, used to acquire time series data generated during the operation of the equipment; An encoding unit, used for encoding the time series data to obtain a preliminary embedding representation and local embedding data and global embedding data of the preliminary embedding representation; A feature extraction unit, used to extract time-frequency features of local embedded data and global embedded data respectively, to obtain local time-frequency features and global time-frequency features; A feature concatenation unit, used to add local time-frequency features and global time-frequency features to obtain concatenated features; A data reconstruction unit, used for extracting the concatenated features and adding them to the preliminary embedding representation to obtain reconstructed data; The result acquisition unit is used to obtain the device abnormality detection result according to the reconstructed data.

8. An electronic device, characterized in that: The device comprises: a processor adapted to execute a computer program; A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and when the computer program is executed by the processor, the device anomaly detection method based on time-frequency feature interaction as described in any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is suitable for being loaded by a processor and executing the device anomaly detection method based on time-frequency feature interaction described in any one of claims 1-6.

10. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, it implements the device anomaly detection method based on time-frequency feature interaction as described in any one of claims 1 to 6.

Images