Abnormal event root cause positioning method and device for multivariate time series data

Abstract

The invention discloses an abnormal event root cause positioning method and device for multivariate time series data, and the method comprises the steps: carrying out the decomposition of an original time series through employing discrete wavelet transform, and respectively extracting the spatial features and time features of frequency components under different scales, performing inverse wavelet transform on the splicing result to synthesize a time sequence; a clustering algorithm and a transaction attribution algorithm are adopted, the features are grouped according to the similarity of the features, and feature dimensions most related to anomalies are recognized; determining a causal relationship and an occurrence sequence of each feature in a cluster most related to the anomaly, and constructing a root cause chain; analyzing a feature sequence in a root cause chain, and positioning a root cause causing abnormity; knowledge and experience in the root cause fault traceability and diagnosis knowledge base are combined to provide explanations and solutions for the positioned root causes. According to the invention, tracking of a root fault is realized, abnormal phenomena in time sequence data are deeply mined, and potential reasons causing the abnormal phenomena are revealed.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence and computer technology, and in particular to a method and device for locating the root cause of an abnormal event for multivariate time series data. Background Art

[0002] Time series root cause location is a key technology in the field of data analysis. It is specifically used to identify and explain the causes behind abnormal or atypical events that appear in a series of time-varying data. In many industries, such as industrial manufacturing, energy management, and environmental monitoring, root cause location plays a vital role in understanding system performance degradation, predicting potential failures, optimizing operating processes, and improving decision-making quality. By analyzing multi-dimensional time series data collected by multiple sensors, root cause location can help reveal the deep-seated factors that affect the operating status of the system, which may involve complex variable interactions and dynamic relationships that change over time.

[0003] The challenge of root cause location is that there may be complex interdependencies and time-varying relationships between variables in industrial systems, and there may be multiple types of anomalies in the system, and the causes behind each anomaly may be different. In addition, noise, missing values, and sensor errors in the data collection process will also increase the difficulty of location. To meet these challenges, researchers are exploring root cause location technologies that combine domain knowledge and data-driven methods, such as using expert systems and rule engines to assist deep learning models in identifying abnormal patterns, or using graph neural networks to simulate complex relationships between variables. The combined use of these methods aims to improve the accuracy and robustness of root cause location, thereby providing deeper insights and scientific basis for system optimization and maintenance.

[0004] The invention with patent publication number CN116432964A discloses a method for tracing the fault of an electric power dispatching automation system based on convergent cross-mapping, including: collecting the operating data of the electric power dispatching automation system before and after the fault, calculating the permutation entropy of the component before and after the fault, and measuring the abnormality of the component itself according to the change in the permutation entropy; calculating the convergence cross-mapping coefficient between components before and after the fault, constructing a causal graph of the electric power dispatching automation system under normal conditions, and obtaining the degree of change of the global causal relationship of the component according to the change of the causal link; dividing the causal graph under normal conditions into communities, calculating the degree of change of the local causal relationship of the component within the tightly coupled community, and then fitting the fault degree measurement index in combination with the abnormality of the component itself, the degree of change of the global and local causal relationship, and locating the fault root cause component according to the fault degree sorting result. The technical solution provided by the embodiment of the invention can improve the accuracy of fault tracing of the electric power dispatching automation system. However, the patent only focuses on the fault tracing of the electric power dispatching automation system, and lacks universality.

[0005] The invention with patent publication number CN116401088A discloses a method for determining root cause indicators, including: obtaining multiple fault information of the monitored object, the fault information is used to indicate the indicator status of multiple indicators when the monitored object fails, and the indicator status is a normal state or an abnormal state; according to the multiple fault information, determining the causal relationship of the multiple indicators being in an abnormal state; according to the causal relationship, determining the importance of multiple indicators, the importance is used to indicate the degree of influence of the indicator status of the indicator on the state of the monitored object; according to the importance of multiple indicators, determining the root cause indicator that causes the failure of the monitored object from multiple indicators, thereby improving the accuracy of determining the root cause indicator. However, although the invention provides a method for determining the root cause indicator, it does not focus on the causal relationship between feature dimensions.

[0006] The invention with patent publication number CN115514627A discloses a method for locating the root cause of a fault, including: obtaining the service layer performance indicators of the abnormal node; establishing a fault propagation graph based on the configuration information and abnormal alarm information of the abnormal node; the fault propagation graph includes the fault propagation relationship between components; performing root cause location based on the indicator cause-effect graph, the service layer performance indicators and the fault propagation graph to obtain the root cause information; the indicator cause-effect graph is established based on the service layer performance indicators of the nodes in the cluster, and the indicator cause-effect graph includes the cause-effect relationship between the indicators. The invention can combine the cause-effect relationship of the service layer performance indicators, which is conducive to accurately locating the root cause of abnormal events at the indicator level and improving the efficiency and accuracy of root cause location. However, the invention focuses on the cause-effect relationship of the service layer performance indicators. Summary of the invention

[0007] The purpose of the present invention is to provide a method and device for locating the root cause of abnormal events in multivariate time series data, forming a complete solution from the reconstruction of the time series to the analysis and interpretation of the root cause, realizing the tracking of the root cause of the fault, deeply mining the abnormal phenomena in the time series data, and revealing the potential causes of these anomalies.

[0008] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0009] In a first aspect, the present invention discloses a method for locating the root cause of an abnormal event for multivariate time series data, the method for locating the root cause of time series data comprising the following steps:

[0010] The original time series is decomposed into two frequency components with different frequencies using discrete wavelet transform. The spatial and temporal features of the frequency components at different scales are extracted based on the graph attention mechanism and temporal convolutional network. The concatenated spatial and temporal features are inversely transformed to synthesize the time series.

[0011] For the processed time series, clustering algorithm and anomaly attribution algorithm are used to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly;

[0012] Granger causality test method is used to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly, and the root cause chain is constructed;

[0013] Analyze the feature sequence in the root cause chain, perform quantitative analysis on the features at the front of the root cause chain, and locate the initial factors that cause the anomaly; perform stability test analysis on the located initial factors that cause the anomaly to verify their possibility as the root cause;

[0014] Combine the knowledge and experience in the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the located root causes.

[0015] Furthermore, discrete wavelet transform is used to decompose the original time series into two frequency components with different frequencies. The spatial features and temporal features of the frequency components at different scales are extracted based on the graph attention mechanism and the temporal convolutional network. The inverse wavelet transform is performed on the spliced ​​spatial features and temporal features to synthesize the time series. The process includes the following steps:

[0016] Denote the time series under a set of sliding windows as X t ={x t-n+1 , ..., x t-1 , x t}, X t ∈R n×d , where n represents time and d represents the number of features of multivariate time series data.

[0017] In the DWT stage, two sets of filters are used to transform X t Decompose into frequency components of different frequencies f h and f l , where f h The high-frequency component representing the short-term trend of the time series, f l The low-frequency component that represents the long-term trend of the time series;

[0018] A graph attention mechanism based on adjacent nodes is used to extract the spatial dependency of frequency components at different scales, and a temporal convolutional network is used to extract the temporal dependency of frequency components at different scales.

[0019] The spatial and temporal dependencies of the frequency components at different scales output by the graph attention module and the temporal convolutional network module are concatenated, and the concatenated results are sent to the IDWT stage of the discrete wavelet transform module for processing, and the processed results are inversely transformed to synthesize the time series:

[0020]

[0021] Among them, v and g correspond to high-pass filter and low-pass filter respectively, v′ and g′ are the synthetic versions of v and g. For Haar wavelet, v′=-v and g′=g; the high-frequency component of the p′ layer processed by the graph attention module and the temporal convolution module is embedded as The low-frequency component embedding representation of the p′ layer after being processed by the graph attention module and the temporal convolution module is recorded as By inverse transformation As the low-frequency component embedding representation of the p′-1th layer; send the synthesized time series to the reconstruction module to obtain the reconstructed representation

[0022] Furthermore, for the processed time series, clustering algorithms and anomaly attribution algorithms are used to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension. The process of obtaining the feature cluster most relevant to the anomaly includes the following steps:

[0023] Use clustering algorithm to select from d feature dimensions vector as the cluster centroid vector, and calculate each dimension d i The corresponding vector and cluster centroid vector d j Pearson similarity between i , d j ); if the vector d i The vector d is the most similar to the centroid vector of a cluster. i Divide into clusters and update the value of the centroid vector to the mean of each vector in the cluster;

[0024] The change attribution algorithm is used to identify key features, and the weighted sum of the EP value and the S value is used as the feature ranking index. The calculation formula is as follows:

[0025]

[0026]

[0027] RTscore it =EP it +S it

[0028] Among them, EPit represents the EP value of the element at the tth time in the i-th dimension, x it Represents the true value of the element at the tth time in the i-th dimension, represents the reconstructed value of the element at the tth time in the i-th dimension; P it represents the prior probability, Q it represents the posterior probability, S it represents the S value of the element at the tth time in the i-th dimension, x it Represents the true value of the element at the tth time in the i-th dimension, Represents the reconstructed value of the element at the tth time in the i-th dimension; RTscore it As the final anomaly score;

[0029] For the dimension d whose anomaly score is higher than the set score threshold i , find other indicators in the same cluster, and consider the indicators found to be consistent with d i Closely related.

[0030] Furthermore, the Granger causality test method is used to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly. The process of constructing the root cause chain includes the following steps:

[0031] Choose the lag length, for each pair of features in the cluster d i and d j , build the model: d jt =β0+β1d i(t-1) +β2d i(t-2) +...+β5d i(t-5) +∈ t , where d i is the dependent variable, d j is the independent variable, β is the model parameter, ∈ t is the error term; perform an F test on the β coefficient in the causal model to determine d i Is it right? j If the p-value of the F test is less than the pre-set significance level, it is considered that the effect is statistically significant. i Granger causes d j ;

[0032] Test i Is Granger's cause due to d i , to assess the possibility of reverse causality;

[0033] According to the results of the Granger causality test, all feature pairs in the clusters are analyzed to determine which features are the cause of changes in other features in order to construct a root cause chain.

[0034] Further, the feature sequence in the root cause chain is analyzed, and the features at the front of the root cause chain are quantitatively analyzed to locate the initial factors causing the anomaly; the stationarity test analysis is performed on the located initial factors causing the anomaly to verify the possibility of them being the root cause. The process includes the following steps:

[0035] Analyze the order of features in the root cause chain and conduct quantitative analysis on the features at the front of the root cause chain; quantify the degree of abnormal behavior of the features during the abnormal event by calculating the time series statistical summary data of their mean μ, standard deviation σ, deviation S and kurtosis K, and determine their contribution to the abnormal event;

[0036] Perform a stationarity test on the initial factors that cause the anomaly, and determine whether the time series corresponding to the feature dimension is non-stationary by judging whether the statistical characteristics of the feature change over time.

[0037] Furthermore, the ADF test is used to determine whether the statistical characteristics of the feature change over time; the assumption is: Where, Δd it Indicates d i The first-order difference at time t, α i and β i is the model parameter, γ ij is the lag term coefficient, p is the lag order, ∈ it is the error term; if the p-value of the test is less than the significance level, the null hypothesis is rejected and it is considered that the time series corresponding to the feature dimension is non-stationary.

[0038] Furthermore, combining the knowledge and experience in the root cause fault tracing and diagnosis knowledge base, the process of providing explanations and solutions for the located root causes includes the following steps:

[0039] The knowledge and experience in the root cause fault tracing and diagnosis knowledge base are stored in a structured format, including but not limited to historical cases of typical problems, as well as standardized treatment measures, plans and emergency response processes for different problems;

[0040] Identify the root cause from the root cause chain analysis i , search the root cause fault tracing and diagnosis knowledge base for the root cause d i Related traceability and diagnosis knowledge information, including historical cases, treatment measures and plans; combined with the retrieved traceability and diagnosis knowledge information and root cause i , generates a detailed explanation of the cause of the current exception.

[0041] In a second aspect, the present invention discloses a device for locating the root cause of an abnormal event for multivariate time series data, the device comprising a time series synthesis module, a correlation index analysis module, a root cause chain inference module, a root cause locating module and a root cause analysis module;

[0042] The time series synthesis module uses discrete wavelet transform to decompose the original time series into two frequency components with different frequencies, extracts the spatial features and temporal features of the frequency components at different scales based on the graph attention mechanism and the temporal convolutional network, and performs inverse wavelet transform on the spliced ​​spatial features and temporal features to synthesize the time series;

[0043] The correlation index analysis module uses a clustering algorithm and anomaly attribution algorithm for the processed time series to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly;

[0044] The root cause chain inference module uses the Granger causality test method to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly, and constructs a root cause chain;

[0045] The root cause location module analyzes the feature sequence in the root cause chain, performs quantitative analysis on the features at the front of the root cause chain, and locates the initial factor causing the anomaly; performs a stability test analysis on the located initial factor causing the anomaly to verify its possibility as the root cause;

[0046] The root cause analysis module combines the knowledge and experience in the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the located root causes.

[0047] Further, the time series synthesis module includes a decomposition unit and a synthesis unit;

[0048] The decomposition unit represents the time series data of multiple dimensions composed of multiple univariate time series in the same entity as X using a sliding window. t ={x t-n+1 , ..., x t-1 , x t}, X t ∈R n×d , where n represents time and d represents the number of features of multivariate time series data; in the DWT stage, two sets of filters are used to transform X t Decompose into frequency components of different frequencies f h and f l , where f h The high-frequency component representing the short-term trend of the time series, f lThe low-frequency component that represents the long-term trend of the time series;

[0049] The synthesis unit uses a graph attention mechanism based on adjacent nodes to extract the spatial dependency of frequency components at different scales, and uses a temporal convolutional network to extract the temporal dependency of frequency components at different scales; then the spatial dependency and temporal dependency of frequency components at different scales output by the graph attention module and the temporal convolutional network module are concatenated, the concatenated results are sent to the IDWT stage of the discrete wavelet transform module for processing, and the processed results are inversely transformed to synthesize the time series:

[0050]

[0051] Among them, v and g correspond to high-pass filter and low-pass filter respectively, v′ and g′ are the synthetic versions of v and g. For Haar wavelet, v′=-v and g′=g; the high-frequency component of the p′ layer processed by the graph attention module and the temporal convolution module is embedded as The low-frequency component embedding representation of the p′ layer after being processed by the graph attention module and the temporal convolution module is recorded as By inverse transformation As the low-frequency component embedding representation of the p′-1th layer; send the synthesized time series to the reconstruction module to obtain the reconstructed representation

[0052] In a third aspect, the present invention discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described above are implemented.

[0053] Compared with the prior art, the present invention has the following beneficial effects:

[0054] First, the method and device for locating the root cause of abnormal events in multivariate time series data of the present invention decomposes the time series into components of different frequencies through discrete wavelet transform, graph attention mechanism and temporal convolutional network, which enables the model to effectively capture the trends and different characteristics in the time series, increasing the depth and breadth of time series analysis.

[0055] Second, the method and device for locating the root cause of abnormal events in multivariate time series data of the present invention group and analyze the correlation of feature dimensions through clustering algorithm and anomaly attribution algorithm. This method can identify the feature dimensions most relevant to the abnormal events.

[0056] Third, the method and device for locating the root cause of abnormal events in multivariate time series data of the present invention, through the collaborative work of multiple modules, from the reconstruction of the time series to the analysis and interpretation of the root cause, forms a complete solution, realizes the tracking of the root cause of the fault, deeply explores the abnormal phenomena in the time series data, and reveals the potential causes of these anomalies. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 A flow chart of the method for locating the root cause of an abnormal event for multivariate time series data of the present invention;

[0058] Figure 2 It is a framework diagram of the time series reconstruction algorithm of the present invention;

[0059] Figure 3 It is a root cause score diagram of the abnormal attribution algorithm of the present invention;

[0060] Figure 4 It is the Granger causality test score graph of the present invention;

[0061] Figure 5 It is a partial schematic diagram of the root cause fault tracing and diagnosis knowledge base of the present invention. DETAILED DESCRIPTION

[0062] The embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0063] The present invention proposes a method for locating the root cause of an abnormal event for multivariate time series data, characterized in that the method for locating the root cause of an abnormal event for multivariate time series data comprises the following steps:

[0064] The original time series is decomposed into two frequency components with different frequencies using discrete wavelet transform. The spatial and temporal features of the frequency components at different scales are extracted based on the graph attention mechanism and temporal convolutional network. The concatenated spatial and temporal features are inversely transformed to synthesize the time series.

[0065] For the processed time series, clustering algorithm and anomaly attribution algorithm are used to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly;

[0066] Granger causality test method is used to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly, and the root cause chain is constructed;

[0067] Analyze the feature sequence in the root cause chain, perform quantitative analysis on the features at the front of the root cause chain, and locate the initial factors that cause the anomaly; perform stability test analysis on the located initial factors that cause the anomaly to verify their possibility as the root cause;

[0068] Combine the knowledge and experience in the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the located root causes.

[0069] See also Figure 1 The method for locating the root cause of abnormal events in multivariate time series data of the present invention specifically comprises the following steps:

[0070] S1, discrete wavelet transform is used to decompose the original time series, spatial features and temporal features are extracted respectively based on graph attention mechanism and temporal convolutional network, and inverse wavelet transform is used to synthesize the time series.

[0071] Step S11: Represent the multi-dimensional time series data consisting of multiple univariate time series in the same entity as X = {x1, x2, ..., x n}, where n represents the maximum length of the timestamp, x t ∈R d Represents a d-dimensional vector, representing the value at time t in the time series data, d represents the feature dimension size, t = 1, 2, ..., n; Use sliding windows to divide the time series, and divide the multidimensional time series X into multiple sliding windows;

[0072] Step S12: In the DWT stage, X t First, it is decomposed into components of different frequencies f by two sets of filters h and f l , where f h The high-frequency component representing the short-term trend of the time series, f l The low-frequency component that represents the long-term trend of the time series;

[0073] Step S13: using a graph attention mechanism based on adjacent nodes to extract spatial dependencies of frequency components at different scales, and using a temporal convolutional network to extract temporal dependencies of frequency components at different scales;

[0074] Step S14: concatenate the outputs of the graph attention module and the temporal convolutional network module, and send the concatenated output to the IDWT stage of the discrete wavelet transform module for processing. The above embedded representation is used as input to synthesize the time series through inverse transformation. The calculation formula is as follows:

[0075]

[0076] Among them, v' and g' are the composite versions of v and g. For Haar wavelet, v' = -v and g' = g. The obtained sequence is sent to the reconstruction module to obtain the reconstructed representation

[0077] S2, clustering algorithm and change attribution algorithm are used to identify key feature dimensions and cluster similar features.

[0078] Step S21: Use clustering algorithm to select from d feature dimensions vector as the cluster centroid vector, and calculate each dimension d i The Pearson similarity between the corresponding vector and the above cluster centroid vector is calculated using pear(d i , d j ) to represent; if the vector d i The vector d is the most similar to the centroid vector of a cluster. i Divide into clusters and update the centroid vector, whose value is the mean of each vector in the cluster;

[0079] Step S22: Use the change attribution algorithm to identify key features, and use the weighted sum of the EP value and the S value as the feature ranking index. The calculation formula is as follows:

[0080]

[0081] RTscore it =EP it +S it

[0082] Among them, EP it represents the EP value of the element at the tth time in the i-th dimension, x it Represents the true value of the element at the tth time in the i-th dimension, Represents the reconstructed value of the element at the tth time in the i-th dimension. it represents the prior probability, Q it represents the posterior probability, S it represents the S value of the element at the tth time in the i-th dimension, x it Represents the true value of the element at the tth time in the i-th dimension, Represents the reconstructed value of the element at the tth time in the i-th dimension. RTscore it as the final anomaly score.

[0083] Step S23: For the dimension d with a higher anomaly score i , find other indicators in the same cluster, and consider these indicators as i Closely related.

[0084] S3, Granger causality test method is used to construct the root cause chain.

[0085] Step S31: Select the lag length 5, for each pair of features d in the cluster i and d j , build the model: d jt =β0+β1d i(t-1) +β2d i(t-2) +...+β5d i(t-5) +∈ t , where d i is the dependent variable, d j is the independent variable, β is the model parameter, ∈ t is the error term; perform an F test on the β coefficient in the causal model to determine d i Is it right? i If the p value of the F test is less than the pre-set significance level of 0.05, then it is considered that d i Granger causes d j ;

[0086] Step S32: The same method is applied to check d i Is Granger's cause due to d i , to assess the possibility of reverse causality;

[0087] Step S33: Based on the results of the Granger causality test, analyze the feature pairs in all clusters to determine which features are the cause of changes in other features, so as to construct a root cause chain.

[0088] S4, locates the initial factors that cause the anomaly by analyzing the feature sequence in the causal chain.

[0089] Step S41: Analyze the order of features in the root cause chain, and perform quantitative analysis on the features that are at the front of the cause-effect chain; quantify the degree of abnormal behavior of the features during the abnormal event by calculating their mean μ, standard deviation σ, deviation S, kurtosis K and other time series statistical summary data, and determine their contribution to the abnormal event;

[0090] Step S42: Perform a stationarity test on the feature at the front of the causal chain to determine whether the feature changes its statistical characteristics over time; use the ADF test, and its hypothesis form is: Where, Δd it Indicates d i The first-order difference at time t, α i and β i is the model parameter, γ ii is the lag term coefficient, p is the lag order, ∈ itis the error term. If the p-value of the test is less than the significance level of 0.05, the null hypothesis is rejected and the time series corresponding to the feature dimension is considered to be non-stationary.

[0091] S5, combines the knowledge and experience in root cause fault tracing and diagnosis knowledge base to provide detailed explanations and solutions for the located root causes.

[0092] Step S51: storing the knowledge and experience in the root cause fault tracing and diagnosis knowledge base in a structured format, including but not limited to case studies of typical problems, standardized treatment measures for different problems, contingency plans and emergency response processes;

[0093] Step S52: Determine the root cause from the cause-effect chain analysis i , retrieve relevant information from the root cause fault tracing and diagnosis knowledge base, including historical cases, treatment measures and plans; combine the retrieved tracing and diagnosis knowledge with d i Generates a detailed explanation of the current exception cause based on the specific situation.

[0094] Examples

[0095] This example is tested on the HAI dataset, and all experiments are performed on a server running Windows 10 (64-bit) equipped with an NVIDIA GeForce GTX 1060 graphics processing unit (GPU) and 16 GB of memory.

[0096] from Figure 2 As can be seen from the above, the time series reconstruction algorithm architecture of the present invention is divided into three stages: discrete wavelet transform stage, graph attention and time convolutional network module stage and discrete wavelet inverse transform truncation. The discrete wavelet transform stage is used to capture the long-term and short-term trend of time series, the graph attention mechanism and the time convolutional network module capture spatial dependency and temporal dependency respectively, and the discrete wavelet inverse transform is used to reconstruct the obtained feature data to obtain the reconstructed representation.

[0097] from Figure 3 It can be seen from the above that the present invention uses a clustering algorithm for the HAI dataset, and then adopts an anomaly attribution algorithm. The figure selects the top ten dimensions with the highest root cause scores for sorting. We select the cluster where the dimension most associated with the abnormal event is located, which is [P1_B3005, P1_B400B, P1_FT01, P1_FT01Z, P1_FT02, P1_FT02Z, P1_FT03, P1_FT03Z].

[0098] from Figure 4It can be seen from the above that the present invention uses the Granger causality test method for each pair of features of the cluster most associated with the abnormal event. It can be seen that the p-values ​​of P1_FT01 tested on other dimensional features are all less than 0.05, so it can be considered that the sequential source of the root cause chain is P1_FT01. At the same time, it can be seen from the time series characteristics of this dimension that the time series statistics under the abnormal event corresponding to this dimension are significantly different from the normal time series statistics. The p-value of the ADF test is 0.02, which is a non-stationary state.

[0099] from Figure 5 As can be seen above, for the problems caused by this dimension, based on the content in the root cause fault tracing and diagnosis knowledge base, we have the following past cases: P1-PC here refers to a pressure control loop in the boiler distributed control system. PV2 represents a set point in the control loop, and P1_FT01 is a specific parameter or variable associated with the set point. The attack scenario is described as follows: Try to maintain the previous sensor value. Therefore, we can propose appropriate solutions in a targeted manner, such as trying to cancel the hidden state of the set point.

[0100] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0101] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0102] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0103] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0104] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0105] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for locating the root cause of abnormal events in multivariate time series data, characterized in that: The time series data root cause location method comprises the following steps: The original time series is decomposed into two frequency components with different frequencies using discrete wavelet transform. The spatial and temporal features of the frequency components at different scales are extracted based on the graph attention mechanism and temporal convolutional network. The concatenated spatial and temporal features are inversely transformed to synthesize the time series. For the processed time series, clustering algorithm and anomaly attribution algorithm are used to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly; Granger causality test method is used to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly, and the root cause chain is constructed; Analyze the feature sequence in the root cause chain, perform quantitative analysis on the features at the front of the root cause chain, and locate the initial factors that cause the anomaly; perform stability test analysis on the located initial factors that cause the anomaly to verify their possibility as the root cause; Combine the knowledge and experience in the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the located root causes.

2. The method for locating the root cause of abnormal events in multivariate time series data according to claim 1, characterized in that: The original time series is decomposed into two frequency components with different frequencies by using discrete wavelet transform. The spatial and temporal features of the frequency components at different scales are extracted based on the graph attention mechanism and temporal convolutional network. The inverse wavelet transform is performed on the spliced ​​spatial and temporal features to synthesize the time series. The process includes the following steps: Denote the time series under a set of sliding windows as X t ={x t-n+1 , ..., x t-1 , x t }, X t ∈R n×d , where n represents time and d represents the number of features of multivariate time series data. In the DWT stage, two sets of filters are used to transform X t Decompose into frequency components of different frequencies f h and f l , where f h The high-frequency component representing the short-term trend of the time series, f l The low-frequency component that represents the long-term trend of the time series; A graph attention mechanism based on adjacent nodes is used to extract the spatial dependency of frequency components at different scales, and a temporal convolutional network is used to extract the temporal dependency of frequency components at different scales. The spatial and temporal dependencies of the frequency components at different scales output by the graph attention module and the temporal convolutional network module are concatenated, and the concatenated results are sent to the IDWT stage of the discrete wavelet transform module for processing, and the processed results are inversely transformed to synthesize the time series: Among them, v and g correspond to high-pass filter and low-pass filter respectively, v′ and g′ are the synthetic versions of v and g. For Haar wavelet, v′=-v and g′=g; the high-frequency component of the p′ layer processed by the graph attention module and the temporal convolution module is embedded as The low-frequency component embedding representation of the p′ layer after being processed by the graph attention module and the temporal convolution module is recorded as By inverse transformation As the low-frequency component embedding representation of the p′-1th layer; send the synthesized time series to the reconstruction module to obtain the reconstructed representation 3. The method for locating the root cause of abnormal events in multivariate time series data according to claim 1, characterized in that: For the processed time series, clustering algorithm and anomaly attribution algorithm are used to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension. The process of obtaining the feature cluster most relevant to the anomaly includes the following steps: Use clustering algorithm to select from d feature dimensions vector as the cluster centroid vector, and calculate each dimension d i The corresponding vector and cluster centroid vector d j Pearson similarity between i , d j ); if the vector d i The vector d is the most similar to the centroid vector of a cluster. i Divide into clusters and update the value of the centroid vector to the mean of each vector in the cluster; The change attribution algorithm is used to identify key features, and the weighted sum of the EP value and the S value is used as the feature ranking index. The calculation formula is as follows: RTscore it =EP it +S it Among them, EP it represents the EP value of the element at the tth time in the i-th dimension, x it Represents the true value of the element at the tth time in the i-th dimension, represents the reconstructed value of the element at the tth time in the i-th dimension; P it represents the prior probability, Q it represents the posterior probability, S it represents the S value of the element at the tth time in the i-th dimension, x it Represents the true value of the element at the tth time in the i-th dimension, Represents the reconstructed value of the element at the tth time in the i-th dimension; RTscore it As the final anomaly score; For the dimension d whose anomaly score is higher than the set score threshold i , find other indicators in the same cluster, and consider the indicators found to be consistent with d i Closely related.

4. The method for locating the root cause of an abnormal event in multivariate time series data according to claim 1 is characterized in that: The Granger causality test method is used to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly. The process of constructing the root cause chain includes the following steps: Choose the lag length, for each pair of features in the cluster d i and d j , build the model: d jt =β0+β1d i(t-1) +β2d i(t-2) +...+β5d i(t-5) +∈ t , where d i is the dependent variable, d j is the independent variable, β is the model parameter, ∈ t is the error term; perform an F test on the β coefficient in the causal model to determine d i Is it right? j There is a statistically significant effect: If the p-value of the F test is less than the pre-set significance level, it is considered that d i Granger causes d j ; Test i Is Granger's cause due to d i , to assess the possibility of reverse causality; According to the results of the Granger causality test, all feature pairs in the clusters are analyzed to determine which features are the cause of changes in other features in order to construct a root cause chain.

5. The method for locating the root cause of abnormal events in multivariate time series data according to claim 1 is characterized in that: Analyze the feature sequence in the root cause chain, perform quantitative analysis on the features at the front of the root cause chain, locate the initial factor that causes the anomaly; perform a stationarity test analysis on the located initial factor that causes the anomaly to verify its possibility as the root cause. The process includes the following steps: Analyze the order of features in the root cause chain and conduct quantitative analysis on the features at the front of the root cause chain; quantify the degree of abnormal behavior of the features during the abnormal event by calculating the time series statistical summary data of their mean μ, standard deviation σ, deviation S and kurtosis K, and determine their contribution to the abnormal event; Perform a stationarity test on the initial factors that cause the anomaly, and determine whether the time series corresponding to the feature dimension is non-stationary by judging whether the statistical characteristics of the feature change over time.

6. The method for locating the root cause of an abnormal event in multivariate time series data according to claim 5, characterized in that: Use the ADF test to determine whether the statistical characteristics of the feature change over time; the assumption is: Where, Δd it Indicates d i The first-order difference at time t, α i and β i is the model parameter, γ ij is the lag term coefficient, p is the lag order, ∈ it is the error term; if the p-value of the test is less than the significance level, the null hypothesis is rejected and it is considered that the time series corresponding to the feature dimension is non-stationary.

7. The method for locating the root cause of an abnormal event in multivariate time series data according to claim 1 is characterized in that: The process of providing explanations and solutions for the located root causes by combining the knowledge and experience in the root cause tracing and diagnosis knowledge base includes the following steps: The knowledge and experience in the root cause fault tracing and diagnosis knowledge base are stored in a structured format, including but not limited to historical cases of typical problems, as well as standardized treatment measures, plans and emergency response processes for different problems; Determine the root cause di from the root cause chain analysis, and search for the root cause d in the root cause fault tracing and diagnosis knowledge base. i Relevant traceability and diagnosis knowledge information, including historical cases, treatment measures and plans; combined with the retrieved traceability and diagnosis knowledge information and root cause di, a detailed explanation of the current abnormal cause is generated.

8. A device for locating the root cause of abnormal events for multivariate time series data, characterized in that: The abnormal event root cause location device includes a time series synthesis module, a correlation index analysis module, a root cause chain inference module, a root cause location module and a root cause analysis module; The time series synthesis module uses discrete wavelet transform to decompose the original time series into two frequency components with different frequencies, extracts the spatial features and temporal features of the frequency components at different scales based on the graph attention mechanism and the temporal convolutional network, and performs inverse wavelet transform on the spliced ​​spatial features and temporal features to synthesize the time series; The correlation index analysis module uses a clustering algorithm and anomaly attribution algorithm for the processed time series to group features according to their similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly; The root cause chain inference module uses the Granger causality test method to determine the causal relationship and occurrence order of each feature in the cluster most related to the anomaly, and constructs a root cause chain; The root cause location module analyzes the feature sequence in the root cause chain, performs quantitative analysis on the features at the front of the root cause chain, and locates the initial factor causing the anomaly; performs a stability test analysis on the located initial factor causing the anomaly to verify its possibility as the root cause; The root cause analysis module combines the knowledge and experience in the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the located root causes.

9. The abnormal event root cause location device for multivariate time series data according to claim 8, characterized in that: The time series synthesis module includes a decomposition unit and a synthesis unit; The decomposition unit represents the time series data of multiple dimensions composed of multiple univariate time series in the same entity as X using a sliding window. t ={x t-n+1 , ..., x t-1 , x t }, X t ∈R n×d , where n represents time and d represents the number of features of multivariate time series data; In the DWT stage, two sets of filters are used to transform X t Decompose into frequency components of different frequencies f h and f l , where f h The high-frequency component representing the short-term trend of the time series, f l The low-frequency component that represents the long-term trend of the time series; The synthesis unit uses a graph attention mechanism based on adjacent nodes to extract the spatial dependency of frequency components at different scales, and uses a temporal convolutional network to extract the temporal dependency of frequency components at different scales; Then, the spatial and temporal dependencies of the frequency components at different scales output by the graph attention module and the temporal convolutional network module are concatenated, and the concatenated results are sent to the IDWT stage of the discrete wavelet transform module for processing, and the processed results are inversely transformed to synthesize the time series: Among them, v and g correspond to high-pass filter and low-pass filter respectively, v′ and g′ are the synthetic versions of v and g. For Haar wavelet, v′=-v and g′=g; the high-frequency component of the p′ layer processed by the graph attention module and the temporal convolution module is embedded as The low-frequency component embedding representation of the p′ layer after being processed by the graph attention module and the temporal convolution module is recorded as By inverse transformation As the low-frequency component embedding representation of the p′-1th layer; send the synthesized time series to the reconstruction module to obtain the reconstructed representation 10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method steps described in any one of claims 1 to 7 are implemented.

Images