Industrial time sequence anomaly detection method and device and computer equipment

Abstract

The invention provides an industrial time sequence anomaly detection method and device and computer equipment, and belongs to the technical field of industrial time sequence anomaly detection. The method comprises the following steps: acquiring industrial time series data; the time sequence data are converted into graph structure data and then serve as model input data to be input into a reconstruction model, reconstruction data are obtained, and the reconstruction model comprises a digital composite graph attention network; and if the degree of difference between the reconstruction variable data of a certain timestamp in the reconstruction data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormal threshold, determining that the state of the original variable data corresponding to the timestamp is abnormal. The above reconstruction model extracts the superior representation of the variable interaction network based on knowledge according to the knowledge graph related to the industrial system, and fuses the superior representation with the time sequence dependency based on the sequence, thereby reducing the risk that the model learns pseudo-correlation, and improving the anomaly detection performance and anomaly interpretability of the industrial time sequence.

Description

Technical Field

[0001] The present invention belongs to the technical field of anomaly detection of industrial equipment time series data, and specifically relates to an industrial time series anomaly detection method, an industrial time series anomaly detection device, a computer device and a machine-readable storage medium. Background Art

[0002] Process industry refers to the industry that provides raw materials and energy for manufacturing through continuous and complex physical changes and chemical reactions of resources (including recyclable resources). It usually includes chemical, paper, cement, non-ferrous metals, steel, pharmaceutical, food and beverage industries, and is an important part of modern industry. For most process industries, since the input raw materials come from nature or industrial waste, it is difficult to maintain uniformity and consistency in the physical properties of raw materials, such as pressure, flow, hardness, etc., so it is easy to have abnormal operating conditions during the production process, such as abnormal vibration and temperature. If the staff cannot detect these abnormalities in time, it is easy to cause the entire system or equipment to fail, shut down, or even cause serious accidents.

[0003] With the development of technologies such as the Internet of Things, big data, and artificial intelligence, the types and quantities of data generated by corporate production and business activities are growing exponentially. In recent years, more and more companies have begun to collect and analyze these data in real time for visual monitoring of production lines, automated analysis of manufacturing processes, and predictive control to ensure production safety and product delivery efficiency. Industrial time series anomaly detection has always been one of the focuses of data analysis applications, especially in process industries. Anomaly warning and anomaly interpretation are crucial to ensuring data quality, maintaining information security and stable operation of process industry manufacturing.

[0004] In the past few years, experienced engineers usually manually set thresholds for each monitored time series to identify anomalies. However, with the increase in the amount and variables of industrial monitoring system data in recent years, this manual method will no longer be applicable, and data-driven methods have gradually become a research hotspot. At present, the problems of industrial time series anomaly detection in process industry are mainly the following three aspects. First, most pure data-driven methods are easily affected by the quality of training data and require the help of prior knowledge to reduce false correlations. In process industry, due to the interference of uncertain factors such as raw material type, load and environmental changes, the training data may contain inherent data bias, which causes the data-driven model to learn features that have false correlations with the actual labels. The existence of these features may be due to the bias in the collection or generation of training data. They themselves are not the decisive factor in determining anomalies. However, when the test set lacks these feature data, it will significantly reduce the performance of the model. Secondly, how to reasonably explain the detected anomalies is also a challenge. The research on machine learning explanation has become an important part of current artificial intelligence. In industrial data anomaly detection, providing reasonable explanations for anomalies helps to determine the causes of anomalies and propose corresponding processing strategies. However, pure data-driven methods usually lack the help of expert knowledge. Their explanations come from the sensitivity of each module to data in the entire architecture. It is difficult for engineers to believe in the explanation results without natural mechanism constraints. Thirdly, there is a lack of labeled samples and the diversity of anomalies. Generally speaking, in actual industrial monitoring environments, the number of anomalies is relatively small, while the range of anomaly types is wide, which makes it difficult to collect enough correct anomaly labeled samples for training. Summary of the invention

[0005] The purpose of the embodiments of the present invention is to provide an industrial time series anomaly detection method, an industrial time series anomaly detection device, a computer device and a machine-readable storage medium, which are used to overcome the defects of traditional industrial time series anomaly detection methods in the prior art, such as being greatly affected by pseudo-correlation and having poor interpretability.

[0006] In order to achieve the above object, a first aspect of an embodiment of the present invention provides an industrial time series anomaly detection method, the method comprising: The sensors deployed in the industrial system to be detected are used to collect production process data composed of multiple variables generated during the operation of the industrial system to be detected, and time series data is obtained; The time series data is converted into a time series graph structure, and the time series graph structure is input into a pre-built reconstruction model as model input data to obtain reconstructed data; If the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormal threshold, it is determined that the state of the original variable data corresponding to the timestamp is abnormal; Among them, the reconstruction model is constructed with the autoencoder as the baseline, and a first graph attention network layer for extracting high-level knowledge representation information and a second graph attention network layer for extracting high-level temporal information of the model input data are added before the encoding network in the autoencoder. The outputs of the first graph attention network layer and the second graph attention network layer are fused and connected to the input of the encoding network in the autoencoder. The input data of the first graph attention network layer is constructed by utilizing the interactive relationship between variables obtained by utilizing the knowledge graph between equipment and sensors in the industrial system.

[0007] Optionally, the reconstruction model includes a composite encoder, a hidden space for randomly sampling the encoding results of the composite encoder, and a decoder corresponding to the composite encoder constructed based on the variational autoencoding principle, the composite encoder includes a first image attention network layer, a second image attention network layer and an encoding network, and the outputs of the first image attention network layer and the second image attention network layer are fused and connected to the input of the encoding network.

[0008] Optionally, the encoding network adopts an LSTM network.

[0009] Optionally, the decoding network in the decoder adopts an LSTM network.

[0010] Optionally, the degree of difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data is characterized by an anomaly score, and the anomaly score is calculated by the following formula: ; in, Indicates timestamp i The corresponding anomaly score, Represents the timestamp in the model input data i The corresponding original variable data, Represents the timestamp in the reconstructed data i The corresponding reconstructed variable data.

[0011] Optionally, constructing input data of the first graph attention network layer using the interactive relationship between variables obtained from the knowledge graph between the equipment and sensors in the industrial system, including: Summarize the high-level relationships of the knowledge graph between devices and sensors in industrial systems to obtain direct and potential interactions between variables; Generate a variable interaction network and an adjacency matrix of each node in the variable interaction network according to the direct interaction relationship and potential interaction relationship between the variables; Among them, the attribute value of a node in the variable interaction network is the observed value of the variable corresponding to the node, and the number of attribute values ​​is determined according to the length of the acquisition time window.

[0012] Optionally, the high-order relationships of the knowledge graph include at least one of a direct correlation between a variable and other variables because they participate in the same process or data have correlation, a possible correlation between a variable and other variables because they participate in the same physical process, a possible indirect relationship between a variable and other variables because corresponding sensors are installed on the same device entity, and a possible correlation between a variable and other variables because the physical processes involved are mutually related.

[0013] Optionally, the first graph attention network layer adopts a multi-head random attention mechanism.

[0014] Optionally, the multi-head random attention mechanism is specifically: Pay attention to the head node alone i The output vector of is expressed as follows: ; ; ; ; The node is generated by summing up the output vectors of all individual attention heads i The final expression , and the node i The final expression It is expressed by the following formula: ; in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j Random attention scores between () represents the sampling function based on Bernoulli distribution, Representation Node i The neighbor set of Representation Node j The input vector is and Both represent weight matrices, represents the activation function, Represents the neighbor nodes before normalization jFor Node i The importance of express The normalized result is represents the activation function, represents the feedforward neural function used to connect nodes, represents the number of independent attention heads, Indicates h A single attention head node i and nodes k Random attention scores between Indicates h A single attention head node k The weight matrix corresponding to the input vector.

[0015] Optionally, the nodes of the time series graph structure are timestamps with attribute values ​​within a sliding time window, the observed values ​​of the variables on the timestamps are regarded as the attribute values ​​of the corresponding nodes, and the second graph attention network layer adopts a dynamic attention mechanism with a bias mechanism to calculate the feature attention scores between timestamps.

[0016] The optional dynamic attention mechanism with bias mechanism is as follows: The output vector of a single attention head node is expressed as follows: ; ; ; in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j The dynamic attention score between , and Both represent weight matrices, represents the deviation vector, Representation Node i The adjacent set of Representation Node j The input vector is represents the activation function, Used to calculate nodes before normalization i To neighbor node j The importance score of represents the activation function, Represents a feed-forward neural function for connecting nodes.

[0017] Optionally, converting the time series data into a time series graph structure includes: The time series data is converted into a sequence data vector through a sliding time window. The dimension of the data vector is the number of timestamps in the sliding time window, and the length of the data vector is the number of variables. The sequence data vector is input into the gated recurrent unit layer, the hidden state at each timestamp is captured in turn, and the adjacency matrix between the data vectors in the sliding time window is calculated through the two learnable weights of the linear layer. The adjacency matrix between the data vectors in the sliding time window is expressed by the following formula: ; ; ; in, Indicates the hidden state, and represents two learnable weights, represents the dimension of the data vector, Represents the adjacency matrix between data vectors within a sliding time window.

[0018] Optionally, the method further includes: The feature attention scores for the first graph attention network layer are calculated for the model input data with abnormal original variable data states and the model input data with normal original variable data states, and the calculated feature attention scores are compared to locate the anomaly. A second aspect of an embodiment of the present invention provides an industrial time series anomaly detection device, the device comprising: A time series data acquisition module is used to collect production process data composed of multiple variables generated during the operation of the industrial system to be detected by using sensors arranged in the industrial system to be detected, and obtain time series data; A data reconstruction module is used to convert time series data into a time series graph structure, and input the time series graph structure into a pre-built reconstruction model as model input data to obtain reconstructed data; The abnormality judgment module is used to judge whether the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormality threshold. If so, it is determined that the state of the original variable data corresponding to the timestamp is abnormal; Among them, the reconstruction model is constructed with the autoencoder as the baseline, and a first graph attention network layer for extracting high-level knowledge representation information and a second graph attention network layer for extracting high-level temporal information of the model input data are added before the encoding network in the autoencoder. The outputs of the first graph attention network layer and the second graph attention network layer are fused and connected to the input of the encoding network in the autoencoder. The input data of the first graph attention network layer is constructed by utilizing the interactive relationship between variables obtained by utilizing the knowledge graph between equipment and sensors in the industrial system.

[0019] A third aspect of an embodiment of the present invention provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the industrial time series anomaly detection method described in the first aspect of the embodiment of the present invention is implemented.

[0020] A fourth aspect of an embodiment of the present invention provides a machine-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the industrial time series anomaly detection method described in the first aspect of the embodiment of the present invention is implemented.

[0021] In the above technical scheme, based on the existing knowledge graph between industrial system equipment and sensors, the first graph attention network layer is used to extract high-level knowledge representation information of the knowledge-based variable interaction network, and the extracted high-level knowledge representation information is fused with the time series-based high-level information (i.e., time series dependency information) extracted by the second graph attention network layer, thereby reducing the risk of the reconstructed model learning pseudo-correlations, thereby improving the anomaly detection performance for industrial time series and enhancing the interpretability of industrial time series anomalies.

[0022] Other features and advantages of the embodiments of the present invention will be described in detail in the subsequent detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings are used to provide a further understanding of the embodiments of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the embodiments of the present invention, but do not constitute a limitation on the embodiments of the present invention. In the accompanying drawings: Figure 1 A flowchart of an industrial time series anomaly detection method according to an embodiment of the present invention is schematically shown; Figure 2 The network architecture diagram of the reconstruction model in a specific application example is schematically shown; Figure 3A schematic diagram showing the comparison of the effects of anomaly detection on the same time series data based on the CKDGAT method, LSTM-AE method, LSTM-VAE method, DAGMM method, OmniAnomaly method, USAD method and MTAD-GAT method in a specific application example; Figure 4 The schematic diagram of abnormal fragments detected in a specific application example is schematically shown; Figure 5 The figure schematically shows the difference in attention scores of various features for abnormal fragments in a specific application example. DETAILED DESCRIPTION

[0024] The specific implementation of the embodiment of the present invention is described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation described here is only used to illustrate and explain the embodiment of the present invention, and is not used to limit the embodiment of the present invention.

[0025] Embodiment 1 See also Figure 1 The present invention provides an industrial time series anomaly detection method, which includes the following implementation steps: Step S100, using sensors deployed in the industrial system to be detected to collect production process data composed of multiple variables generated during the operation of the industrial system to be detected, to obtain time series data.

[0026] As we know, time series data refers to sequence data composed of variable observations at multiple timestamps. Usually, because the variable data collected by sensors in industrial systems are multimodal, for numerical data, the observation value can be used directly, and for non-numerical data, the variable data can be replaced with an equivalent integer value, that is, the equivalent integer value is used as the observation value corresponding to the variable data.

[0027] Step S200, converting the time series data into a time series graph structure, and inputting the time series graph structure as model input data into a pre-built reconstruction model to obtain reconstructed data. The reconstruction model is constructed with an autoencoder as a baseline, and a first graph attention network layer (knowledge high-level information extraction graph attention layer) for extracting high-level knowledge representation information and a second graph attention network layer (time series high-level information extraction graph attention layer) for extracting high-level information of the model input data are added before the encoding network in the autoencoder. The outputs of the first graph attention network layer and the second graph attention network layer are fused and connected to the input of the encoding network in the autoencoder. The input data of the first graph attention network layer is constructed by using the interactive relationship between variables obtained by using the knowledge graph between the equipment and sensors in the industrial system.

[0028] Exemplarily, the time series is converted into a time series graph structure, and the conversion method in the common embodiment can be used as the input of the second graph attention network layer.

[0029] In a specific embodiment, converting a time series into a time series graph structure includes: The time series data is converted into a sequence data vector through a sliding time window. The dimension of the data vector is the number of timestamps in the sliding time window, the length of the data vector is the number of variables, and the position of the variable indicates the position of its own observation value in the corresponding time dimension; The sequence data vector is input into the gated recurrent unit (GRU) layer, the hidden state at each timestamp is captured in turn, and the adjacency matrix between the data vectors in the sliding time window is calculated through the two learnable weights of the linear layer. The adjacency matrix between the data vectors in the sliding time window is expressed as follows:

[0030]

[0031] (Formula 1); in, Indicates the hidden state, and represents two learnable weights, represents the dimension of the data vector, Represents the adjacency matrix between data vectors within a sliding time window.

[0032] Based on the above content, it can be seen that the nodes of the time series graph structure are timestamps with attribute values ​​in the sliding time window, and the observed values ​​of the variables at the timestamps are regarded as the attribute values ​​of the corresponding nodes.

[0033] Exemplarily, the autoencoder may be a variational autoencoder.

[0034] In a specific embodiment, the autoencoder is a variational autoencoder, and accordingly, the reconstruction model includes a composite encoder, a hidden space for randomly sampling the encoding results of the composite encoder, and a decoder corresponding to the composite encoder constructed based on the variational autoencoder principle. The composite encoder includes a first image attention network layer, a second image attention network layer and an encoding network, and the outputs of the first image attention network layer and the second image attention network layer are fused and connected to the input of the encoding network.

[0035] The reconstruction model using variational autoencoder as the baseline can be found in Figure 2 shown. Figure 2In the example, the encoding network uses an LSTM network, the decoding network in the decoder uses an LSTM network, and the latent space randomly samples the encoding results of the composite encoder with a Gaussian distribution with a mean value of μ and a standard deviation of σ. The composite encoder CE is composed of the first image attention network layer, the second image attention network layer and the LSTM network.

[0036] Assume that the input vector of the reconstruction model is represented as x , it should follow the conditional distribution Reconstruction, where z represents the potential representation extracted by the composite encoder CE. The purpose of reconstruction model optimization is to find the optimal model parameters so that the reconstructed data is consistent with the potential representation. z The true posterior distribution of is very close, namely: ; In the above formula, Represents the input vector x The reconstruction probability can be expressed as follows: ; Since it is difficult to calculate the above equation directly, by using the encoder right

[0037] Make an approximate estimate and get the decoder , its reconstruction loss function can be expressed as: ; In the above formula, Represents the input vector x The negative log-likelihood expectation of ; Represents the regularization operator, used to calculate and The Kullback-Leibler divergence between The log-likelihood is difficult to calculate Practical estimators of lower bounds.

[0038] In a specific embodiment, the interactive relationship between variables obtained by using the knowledge graph between the equipment and sensors in the industrial system is used to construct the input data of the first graph attention network layer, including: Summarize the high-level relationships of the knowledge graph between devices and sensors in industrial systems to obtain direct and potential interactions between variables; Generate a variable interaction network and an adjacency matrix of each node in the variable interaction network according to the direct interaction relationship and potential interaction relationship between the variables; Among them, the attribute value of a node in the variable interaction network is the observed value of the variable corresponding to the node, and the number of attribute values ​​is determined according to the length of the acquisition time window.

[0039] For example, the high-order relationship of the knowledge graph between the device and the sensor may be at least one of the following relationships: The direct correlation between a variable and other variables is established because they participate in the same process or the data are correlated; the possible correlation between a variable and other variables is established because they participate in the same physical process; the possible indirect relationship between a variable and other variables is established because the corresponding sensors are installed on the same equipment entity; the possible correlation between a variable and other variables is established because the physical processes involved are interrelated.

[0040] It is important to understand that the adjacency matrix can be obtained by calculating the edges of the variable interaction network. The calculation process can be expressed as: (Formula 2); in, represents the adjacency matrix, Represents the adjacency matrix i Line j The value of the column element, represents the edge set of a node, Representation Node i With Node j Is there an edge between ∈ ,but =1, otherwise =0.

[0041] In a specific embodiment, the first graph attention network layer adopts a multi-head random attention mechanism. The graph structure information of the first graph attention network layer comes from the adjacency matrix ,Since the uncertain potential correlation between variables may produce pseudo ,correlation, the impact of pseudo correlation is minimized by introducing ,multi-head random attention mechanism, thus improving the generalization ,ability of the reconstructed model.

[0042] For example, in the multi-head random attention mechanism adopted by the first graph attention network layer: 1) The output vector of the single attention head node is expressed as follows:

[0043]

[0044]

[0045] (Formula 3); in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j Random attention scores between () represents the sampling function based on Bernoulli distribution, Representation Node i The neighbor set of Representation Node j The input vector is and Both represent weight matrices, represents the activation function, Represents the neighbor nodes before normalization j For Node i The importance of express The normalized result is represents the activation function, represents a feed-forward neural function for connecting nodes. For example, is the sigmoid activation function.

[0046] 2) Generate node y by summing up the output vectors of all individual attention heads i The final expression , and the node i The final expression It is expressed by the following formula: (Formula 4); in, represents the number of separate attention heads, Indicates h A single attention head node i and nodes k Random attention scores between Indicates h A single attention head node k The weight matrix corresponding to the input vector.

[0047] In a specific embodiment, the second graph attention network layer uses a dynamic attention mechanism with a bias mechanism to calculate feature attention scores between timestamps. Through the dynamic attention mechanism with a bias mechanism, more accurate temporal high-level information is extracted.

[0048] For example, in the dynamic attention mechanism with bias mechanism adopted by the second graph attention network layer, the output vector of the single attention head node is expressed as follows:

[0049]

[0050] (Formula 5); in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j The dynamic attention score between , and Both represent weight matrices, represents the deviation vector, Representation Node i The adjacent set of Representation Node j The input vector is represents the activation function, Used to calculate nodes before normalization i To neighbor node j The importance score of represents the activation function, represents a feed-forward neural function for connecting nodes. For example, is the sigmoid activation function.

[0051] Step S300: If the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormal threshold, it is determined that the state of the original variable data corresponding to the timestamp is abnormal.

[0052] It can be seen that the abnormal threshold can be determined by using percentile-based algorithms and automatic peak over threshold (POT) algorithms.

[0053] Exemplarily, the degree of difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data is represented by an anomaly score, and the anomaly score is calculated by the following formula: (Formula 6); in, Indicates timestamp i The corresponding anomaly score, Represents the timestamp in the model input data i The corresponding original variable data, Represents the timestamp in the reconstructed data i The corresponding reconstructed variable data.

[0054] Embodiment 2 The difference between this embodiment and the first embodiment is that after step S300, the following steps are further included: Step S400, respectively, calculate the feature attention score for the first graph attention network layer for the model input data with abnormal original variable data state and the model input data with normal original variable data state, and locate the abnormality after comparing the calculated feature attention scores. It should be understood that the feature attention score calculation for the first graph attention network layer refers to calculating the feature attention score for the model input data with abnormal original variable data state or the model input data with normal original variable data state according to the multi-head random attention mechanism of the first graph attention network layer.

[0055] It can be seen that the feature attention score represents the strength of the correlation between variables. If the feature attention score of a variable in an abnormal time series is significantly different from that in a normal time series, it can be inferred that the variable is abnormal. If the feature attention scores corresponding to multiple variables are significantly different, the specific abnormal phenomenon can be inferred and located based on these abnormal variables, thereby achieving abnormal interpretation and location. Operation and maintenance personnel can execute corresponding response strategies based on these abnormal interpretation and location results, so as to eliminate the abnormality in time and ensure the safe and stable operation of the industrial system.

[0056] Embodiment 3 This embodiment is a specific application example of the second embodiment, and takes the monitoring data anomaly detection of the vertical mill (vertical roller mill, VRM), the core equipment of slag grinding production, as an example to verify the effectiveness of the above embodiment in anomaly detection. Among them, the monitoring data of the vertical mill is mainly the monitoring data of the process variables of its operation process.

[0057] In order to overcome the many problems faced by traditional data-driven methods when dealing with industrial time series anomaly detection, such as the influence of pseudo-correlation, poor interpretability, and difficulty in fusing complex system knowledge and data, Examples 1 and 2 propose a reconstruction model. The reconstruction model constructs a reconstruction model based on a data-knowledge composite attention network architecture. The so-called data-knowledge composite refers to the composite of the knowledge graph between the device and the sensor with the time series, that is, the high-level knowledge representation information is extracted through the first graph attention network layer, and the high-level temporal information of the model input data is extracted through the second graph attention network layer. The two types of information extracted are then fused, and the encoding network encodes the fused features. In this application example, the reconstruction model uses the following: Figure 2 The architecture shown in the figure, the method for detecting anomalies in the monitoring data of the vertical mill using the reconstruction model mainly includes the following implementation steps: Step A1, divide the monitoring data of the vertical mill into multiple fixed-length time periods through a sliding time window, convert the monitoring data of each sliding time window into a sequence data vector, the timestamp in the time window determines the dimension of the data vector, the number of process variables determines the length of the data vector, and the position of the process variable indicates the position where its own observation value appears in the corresponding time dimension. Since the monitoring data of the vertical mill collected by the sensor is multimodal, for numerical monitoring data, the observation value of the process variable is directly used, and for non-numerical monitoring data, the corresponding observation value is obtained by replacing the process variable record with an equivalent integer value.

[0058] Step A2: Input the constructed sequence vector data into the gated recurrent unit layer to capture the hidden state at each timestamp in turn. S , the hidden state contains information about the data that the network has processed. By using the hidden state S and two learnable weights and Calculate the adjacency matrix of the time series in the sliding time window Through steps A1 and A2, the time series in the sliding time window is converted into a time series graph structure. The nodes in the time series graph structure are timestamps with attribute values, and the observed values ​​of the process variables on the timestamps are regarded as the attribute values ​​of the corresponding nodes.

[0059] Step A3, by summarizing the high-order relationship of the knowledge graph between each equipment component body on the vertical mill and each sensor installed thereon, the direct interaction relationship and potential interaction relationship between the process variables are obtained, thereby constructing a variable interaction network, and determining the adjacency matrix between the nodes in the variable interaction network, the attribute value of the node is derived from the observation value of the process variable collected by the sensor, and the number of node attribute values ​​is determined by the length of the collection time window. Using Formula 2, the adjacency matrix is ​​obtained by calculating the edges in the variable interaction network Through step A3, the complex interaction relationship between various process variables in the vertical mill is converted into a graph structure.

[0060] In this step, the high-order relationships of the knowledge graph include: 1) a variable is directly related to other variables because they are involved in the same process or their data are related; 2) a variable may have a relationship with other variables because they are both involved in a physical process; 3) a variable may have an indirect relationship with other variables because their sensors are installed on an equipment component entity; 4) a variable may have a relationship with another variable because the physical processes they involve are interrelated.

[0061] Step A4: The adjacency matrix obtained in step A3 As the input data of the first graph attention network layer. The first graph attention network layer uses a multi-head random attention mechanism to calculate the feature attention scores between variables. The principle of the multi-head random attention mechanism is shown in Equations 3 and 4.

[0062] Step A5: convert the time series in the sliding time window into the adjacency matrix As the input data of the second graph attention network model layer. The second graph attention network layer uses a dynamic attention mechanism with a bias mechanism to calculate the feature attention score between timestamps. The principle of the dynamic attention mechanism with a bias mechanism is shown in Formula 5.

[0063] Step A6: After fusing the outputs of the first and second image attention network layers, the outputs are connected to the input of the LSTM network. For easy distinction, the LSTM network connected to the fused outputs of the first and second image attention network layers is defined as the first LSTM network. The first LSTM network performs encoding, that is, the potential representation is obtained. z .

[0064] Step A7: The hidden space randomly samples the actual code output by the first LSTM network using a Gaussian distribution, where the mean value of the Gaussian distribution is μ and the standard deviation is σ. Figure 2 In the example, Sampling means sampling.

[0065] Step A8, the decoder includes an LSTM network and a linear layer connected in sequence. For easy distinction, the LSTM network in the decoder is defined as the second LSTM network. The decoder decodes the sampled code to obtain reconstructed data.

[0066] Step A9, calculate the anomaly score by formula 6, and use the preset anomaly threshold to make an anomaly judgment. The judgment rule is: if the anomaly score corresponding to a timestamp reaches the anomaly threshold, the original variable data of the timestamp is classified as "abnormal", otherwise the original variable data of the timestamp is classified as "normal".

[0067] Step A10, respectively calculate the feature attention scores for the first graph attention network layer for the model input data with abnormal original variable data states and the model input data with normal original variable data states, and compare the calculated feature attention scores to locate the anomaly.

[0068] In this application example, the industrial time series anomaly detection method implemented in Example 1 and Example 2 is defined as the CKDGAT method. The anomaly detection effect of this method and other methods is compared in Table 1 and Figure 3As shown. Other methods listed in Table 1 include: LSTM-AE method, LSTM-VAE method, DAGMM method, OmniAnomaly method, USAD method, MTAD-GAT method. Table 1 compares the evaluation index results obtained by two different anomaly threshold algorithms. The evaluation indicators include precision, recall rate, F1-score and Auc. Among them, Prec, Rec, F1 and Auc in Table 1 correspond to the evaluation index results corresponding to the percentile threshold algorithm. , , , The corresponding ones are the evaluation index results corresponding to the automatic peak over threshold (POT) algorithm. As can be seen from Table 1, the anomaly detection effect based on the CKDGAT method is significantly better than other methods.

[0069] Table 1

[0070] like Figures 4 to 5 As shown in Figure 1, a time series of abnormal detection is selected for abnormal interpretation and location. Figure 4 The yellow area marked in . Figure 5 For Figure 4 Schematic diagram of the feature attention score difference calculated for abnormal fragments in Figure 5 It can be seen that the attention score differences of features such as L0014, L0050, L0034, L0016, and M0001 are ranked in the top five, among which L0014 and L0016 represent the main motor winding temperature, L0050 represents the vibration measure of VRM, L0034 represents the hot air valve opening feedback for manual control, and M0001 represents the total feed rate of the material. Combined with process knowledge, we can infer that the increase in motor load may be the cause of the subsequent temperature increase, which leads to changes in vibration patterns and ultimately causes abnormalities. Therefore, the operation and maintenance engineer can achieve control purposes by adjusting the opening of the hot air valve.

[0071] Embodiment 4 The embodiment of the present invention provides an industrial time series anomaly detection device, comprising a time series data acquisition module, a data reconstruction module and an anomaly judgment module, wherein: A time series data acquisition module is used to collect production process data composed of multiple variables generated during the operation of the industrial system to be detected by using sensors arranged in the industrial system to be detected, and obtain time series data; A data reconstruction module is used to convert time series data into a time series graph structure, and input the time series graph structure into a pre-built reconstruction model as model input data to obtain reconstructed data; The abnormality judgment module is used to judge whether the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormality threshold. If so, it is determined that the state of the original variable data corresponding to the timestamp is abnormal; Among them, the reconstruction model is constructed with the autoencoder as the baseline, and a first graph attention network layer for extracting high-level knowledge representation information and a second graph attention network layer for extracting high-level temporal information of the model input data are added before the encoding network in the autoencoder. The outputs of the first graph attention network layer and the second graph attention network layer are fused and connected to the input of the encoding network in the autoencoder. The input data of the first graph attention network layer is constructed by utilizing the interactive relationship between variables obtained by utilizing the knowledge graph between equipment and sensors in the industrial system.

[0072] In a specific embodiment, the reconstruction model includes a composite encoder, a hidden space for randomly sampling the encoding results of the composite encoder, and a decoder corresponding to the composite encoder constructed based on the variational autoencoding principle. The composite encoder includes a first image attention network layer, a second image attention network layer and an encoding network. The outputs of the first image attention network layer and the second image attention network layer are fused and connected to the input of the encoding network.

[0073] In a specific embodiment, the encoding network adopts an LSTM network.

[0074] In a specific embodiment, the decoding network in the decoder adopts an LSTM network.

[0075] In a specific embodiment, the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data is characterized by an anomaly score, and the anomaly score is calculated by the following formula: ; in, Indicates timestamp i The corresponding anomaly score, Represents the timestamp in the model input data i The corresponding original variable data, Represents the timestamp in the reconstructed data i The corresponding reconstructed variable data.

[0076] In a specific embodiment, the interactive relationship between variables obtained by using the knowledge graph between devices and sensors in the industrial system is used to construct the input data of the first graph attention network layer, including: Summarize the high-level relationships of the knowledge graph between devices and sensors in industrial systems to obtain direct and potential interactions between variables; Generate a variable interaction network and an adjacency matrix of each node in the variable interaction network according to the direct interaction relationship and potential interaction relationship between the variables; Among them, the attribute value of a node in the variable interaction network is the observed value of the variable corresponding to the node, and the number of attribute values ​​is determined according to the length of the acquisition time window.

[0077] In a specific embodiment, the high-order relationships of the knowledge graph include at least one of a direct correlation relationship between a variable and other variables because they participate in the same process or data have correlation, a possible correlation relationship between a variable and other variables because they participate in the same physical process, a possible indirect relationship between a variable and other variables because the corresponding sensors are installed on the same device entity, and a possible correlation relationship between a variable and other variables because the physical processes involved are mutually related.

[0078] In a specific embodiment, the first graph attention network layer adopts a multi-head random attention mechanism.

[0079] In a specific embodiment, the multi-head random attention mechanism is specifically: Pay attention to the head node alone i The output vector of is expressed as follows: ; ; ; ; The node is generated by summing up the output vectors of all individual attention heads i The final expression , and the node i The final expression It is expressed by the following formula: ; in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j Random attention scores between () represents the sampling function based on Bernoulli distribution, Representation Node i The neighbor set of Representation Node j The input vector is and Both represent weight matrices, represents the activation function, Represents the neighbor nodes before normalization j For Node i The importance of express The normalized result is represents the activation function, represents the feedforward neural function used to connect nodes, represents the number of independent attention heads, Indicates h A single attention head node i and nodes k Random attention scores between Indicates h A single attention head node k The weight matrix corresponding to the input vector.

[0080] In a specific embodiment, the nodes of the time series graph structure are timestamps with attribute values ​​within a sliding time window, the observed values ​​of the variables on the timestamps are regarded as the attribute values ​​of the corresponding nodes, and the second graph attention network layer uses a dynamic attention mechanism with a bias mechanism to calculate the feature attention scores between timestamps.

[0081] In a specific embodiment, the dynamic attention mechanism with bias mechanism is specifically: The output vector of a single attention head node is expressed as follows: ; ; ; in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j The dynamic attention score between , and Both represent weight matrices, represents the deviation vector, Representation Node i The adjacent set of Representation Node j The input vector is represents the activation function, Used to calculate nodes before normalization i To neighbor node j The importance score of represents the activation function, Represents a feed-forward neural function for connecting nodes.

[0082] In a specific embodiment, converting the time series data into a time series graph structure includes: The time series data is converted into a sequence data vector through a sliding time window. The dimension of the data vector is the number of timestamps in the sliding time window, and the length of the data vector is the number of variables. The sequence data vector is input into the gated recurrent unit layer, the hidden state at each timestamp is captured in turn, and the adjacency matrix between the data vectors in the sliding time window is calculated through the two learnable weights of the linear layer. The adjacency matrix between the data vectors in the sliding time window is expressed by the following formula: ; ; ; in, Indicates the hidden state, and represents two learnable weights, represents the dimension of the data vector, Represents the adjacency matrix between data vectors within a sliding time window.

[0083] The device also includes an abnormality explanation and positioning module, which is used to calculate the feature attention scores of the first graph attention network layer for the model input data with abnormal original variable data status and the model input data with normal original variable data status, and locate the abnormality after comparing the calculated feature attention scores. On the other hand, an embodiment of the present invention further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned industrial time series anomaly detection method when executing the program.

[0084] On the other hand, an embodiment of the present invention further provides a machine-readable storage medium having a computer program stored thereon, wherein the computer program implements the above-mentioned industrial time series anomaly detection method when executed by a processor.

[0085] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0086] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0087] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0088] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An industrial time series anomaly detection method, characterized in that: The method comprises: The sensors deployed in the industrial system to be detected are used to collect production process data composed of multiple variables generated during the operation of the industrial system to be detected, and time series data is obtained; The time series data is converted into a time series graph structure, and the time series graph structure is input into a pre-built reconstruction model as model input data to obtain reconstructed data; If the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormal threshold, it is determined that the state of the original variable data corresponding to the timestamp is abnormal; Among them, the reconstruction model is constructed with the autoencoder as the baseline, and a first graph attention network layer for extracting high-level knowledge representation information and a second graph attention network layer for extracting high-level temporal information of the model input data are added before the encoding network in the autoencoder. The outputs of the first graph attention network layer and the second graph attention network layer are fused and connected to the input of the encoding network in the autoencoder. The input data of the first graph attention network layer is constructed by utilizing the interactive relationship between variables obtained by utilizing the knowledge graph between equipment and sensors in the industrial system.

2. The industrial time series anomaly detection method according to claim 1, characterized in that: The reconstruction model includes a composite encoder, a hidden space for randomly sampling the encoding results of the composite encoder, and a decoder corresponding to the composite encoder constructed based on the variational autoencoding principle. The composite encoder includes a first image attention network layer, a second image attention network layer and an encoding network. The outputs of the first image attention network layer and the second image attention network layer are fused and connected to the input of the encoding network.

3. The industrial time series anomaly detection method according to claim 1 or 2, characterized in that: The encoding network adopts LSTM network.

4. The industrial time series anomaly detection method according to claim 2, characterized in that: The decoding network in the decoder adopts an LSTM network.

5. The industrial time series anomaly detection method according to claim 1, characterized in that: The degree of difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data is characterized by an anomaly score, which is calculated by the following formula: ； in, Indicates timestamp i The corresponding anomaly score, Represents the timestamp in the model input data i The corresponding original variable data, Represents the timestamp in the reconstructed data i The corresponding reconstructed variable data.

6. The industrial time series anomaly detection method according to claim 1, characterized in that: The interactive relationship between variables obtained by using the knowledge graph between devices and sensors in the industrial system is used to construct the input data of the first graph attention network layer, including: Summarize the high-level relationships of the knowledge graph between devices and sensors in industrial systems to obtain direct and potential interactions between variables; Generate a variable interaction network and an adjacency matrix of each node in the variable interaction network according to the direct interaction relationship and potential interaction relationship between the variables; Among them, the attribute value of a node in the variable interaction network is the observed value of the variable corresponding to the node, and the number of attribute values ​​is determined according to the length of the acquisition time window.

7. The industrial time series anomaly detection method according to claim 6, characterized in that: The high-order relationships of the knowledge graph include at least one of the direct correlation relationship between a variable and other variables because they participate in the same process or the data are correlated, the possible correlation relationship between a variable and other variables because they participate in the same physical process, the possible indirect relationship between a variable and other variables because the corresponding sensors are installed on the same equipment entity, and the possible correlation relationship between a variable and other variables because the physical processes involved are mutually related.

8. The industrial time series anomaly detection method according to claim 6, characterized in that: The first graph attention network layer adopts a multi-head random attention mechanism.

9. The industrial time series anomaly detection method according to claim 8, characterized in that: The multi-head random attention mechanism is specifically: Pay attention to the head node alone i The output vector of is expressed as follows: ; ； ； ； The node is generated by summing up the output vectors of all individual attention heads i The final expression , and the node i The final expression It is expressed by the following formula: ； in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j Random attention scores between () represents the sampling function based on Bernoulli distribution, Representation Node i The neighbor set of Representation Node j The input vector is and Both represent weight matrices, represents the activation function, Represents the neighbor nodes before normalization j For Node i The importance of express The normalized result is represents the activation function, represents the feedforward neural function used to connect nodes, represents the number of independent attention heads, Indicates h A single attention head node i and nodes k Random attention scores between Indicates h A single attention head node k The weight matrix corresponding to the input vector.

10. The industrial time series anomaly detection method according to claim 1, characterized in that: The nodes of the time series graph structure are timestamps with attribute values ​​within a sliding time window, and the observed values ​​of the variables on the timestamps are regarded as the attribute values ​​of the corresponding nodes. The second graph attention network layer adopts a dynamic attention mechanism with a bias mechanism to calculate the feature attention scores between timestamps.

11. The industrial time series anomaly detection method according to claim 10, characterized in that: The dynamic attention mechanism with bias mechanism is as follows: The output vector of a single attention head node is expressed as follows: ； ； ； in, Representation Node i The input vector is Representation Node i The output vector of Representation Node i and nodes j The dynamic attention score between , and Both represent weight matrices, represents the deviation vector, Representation Node i The adjacent set of Representation Node j The input vector is represents the activation function, Used to calculate nodes before normalization i To neighbor node j The importance score of represents the activation function, Represents a feed-forward neural function for connecting nodes.

12. The industrial time series anomaly detection method according to claim 1, characterized in that: The step of converting the time series data into a time series graph structure includes: The time series data is converted into a sequence data vector through a sliding time window. The dimension of the data vector is the number of timestamps in the sliding time window, and the length of the data vector is the number of variables. The sequence data vector is input into the gated recurrent unit layer, the hidden state at each timestamp is captured in turn, and the adjacency matrix between the data vectors in the sliding time window is calculated through the two learnable weights of the linear layer. The adjacency matrix between the data vectors in the sliding time window is expressed by the following formula: ； ； ； in, Indicates the hidden state, and represents two learnable weights, represents the dimension of the data vector, Represents the adjacency matrix between data vectors within a sliding time window.

13. The industrial time series anomaly detection method according to claim 1, characterized in that: The method further comprises: The feature attention scores for the first graph attention network layer are calculated for the model input data with abnormal original variable data states and the model input data with normal original variable data states, and the calculated feature attention scores are compared to locate the anomaly.

14. An industrial time series anomaly detection device, characterized in that: The device comprises: A time series data acquisition module is used to collect production process data composed of multiple variables generated during the operation of the industrial system to be detected by using sensors arranged in the industrial system to be detected, and obtain time series data; A data reconstruction module is used to convert time series data into a time series graph structure, and input the time series graph structure into a pre-built reconstruction model as model input data to obtain reconstructed data; The abnormality judgment module is used to judge whether the difference between the reconstructed variable data of a certain timestamp in the reconstructed data and the original variable data corresponding to the timestamp in the model input data reaches a preset abnormality threshold. If so, it is determined that the state of the original variable data corresponding to the timestamp is abnormal; Among them, the reconstruction model is constructed with the autoencoder as the baseline, and a first graph attention network layer for extracting high-level knowledge representation information and a second graph attention network layer for extracting high-level temporal information of the model input data are added before the encoding network in the autoencoder. The outputs of the first graph attention network layer and the second graph attention network layer are fused and connected to the input of the encoding network in the autoencoder. The input data of the first graph attention network layer is constructed by utilizing the interactive relationship between variables obtained by utilizing the knowledge graph between equipment and sensors in the industrial system.

15. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the industrial time series anomaly detection method described in any one of claims 1 to 13 is implemented.

16. A machine-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the industrial time series anomaly detection method according to any one of claims 1 to 13 is implemented.

Images