A method and apparatus for abnormal event root cause localization of multivariate time series data

Abstract

The application discloses a kind of abnormal event root cause positioning method and device for multivariate time series data, method includes: using discrete wavelet transform to original time series is decomposed, respectively extract the spatial feature and time feature of frequency component under different scales obtained by decomposition, inverse wavelet transform is carried out to splicing result to synthesize time series;Using clustering algorithm and abnormal event attribution algorithm, according to the similarity of feature group features, and identify the feature dimension most relevant to anomaly;Determine the causal relationship and occurrence order of each feature in the cluster most relevant to anomaly, and construct to obtain root cause chain;Analysis feature order in root cause chain, locate to the root cause of triggering anomaly;Combine root cause fault tracing with knowledge and experience in diagnostic knowledge base, provide explanation and solution for the located root cause.The application realizes the tracking of root fault, deeply excavates abnormal phenomenon in time series data, and reveals the potential cause leading to these anomalies.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and computer technology, and specifically to a method and apparatus for locating the root cause of anomalies in multivariate time-series data. Background Technology

[0002] Time series root cause analysis is a key technique in data analytics, specifically designed to identify and interpret the causes behind anomalies or atypical events that occur within a series of data that change over time. In numerous industries, such as industrial manufacturing, energy management, and environmental monitoring, root cause analysis plays a crucial role in understanding system performance degradation, predicting potential failures, optimizing operational processes, and improving decision-making quality. By analyzing multi-dimensional time series data collected from multiple sensors, root cause analysis can help reveal the deep-seated factors affecting system performance, which may involve complex interactions of variables and dynamic relationships that change over time.

[0003] The challenges of root cause localization lie in the complex interdependencies and time-varying relationships among variables in industrial systems. Furthermore, the systems may contain various types of anomalies, each with potentially different underlying causes. Noise, missing values, and sensor errors during data acquisition also increase the difficulty of localization. To address these challenges, researchers are exploring root cause localization techniques that combine domain knowledge and data-driven approaches. For example, they utilize expert systems and rule engines to assist deep learning models in identifying anomaly patterns, or employ graph neural networks to simulate complex relationships between variables. The combined use of these methods aims to improve the accuracy and robustness of root cause localization, thereby providing deeper insights and scientific evidence for system optimization and maintenance.

[0004] The invention disclosed in patent publication number CN116432964A provides a fault tracing method for power dispatch automation systems based on convergent cross-mapping. The method includes: collecting operational data of the power dispatch automation system before and after a fault; calculating the permutation entropy of components before and after the fault; measuring the degree of abnormality of the components based on the change in permutation entropy; calculating the convergent cross-mapping coefficients between components before and after the fault; constructing a causal graph of the power dispatch automation system under normal conditions; and determining the degree of change in the global causal relationship of components based on changes in causal links; dividing the causal graph under normal conditions into communities; calculating the degree of change in the local causal relationship of components within tightly coupled communities; then fitting a fault severity metric index by combining the degree of abnormality of the components themselves with the degree of change in global and local causal relationships; and locating the root cause component of the fault based on the fault severity ranking result. The technical solution provided by this invention can improve the accuracy of fault tracing in power dispatch automation systems. However, this patent only focuses on fault tracing in power dispatch automation systems and lacks universality.

[0005] Patent publication number CN116401088A discloses a method for determining root cause indicators, comprising: acquiring multiple fault information of a monitored object, wherein the fault information is used to indicate the indicator status of multiple indicators when the monitored object malfunctions, and the indicator status is either normal or abnormal; determining the causal relationship between the multiple indicators as abnormal based on the multiple fault information; determining the importance of the multiple indicators based on the causal relationship, wherein the importance is used to indicate the degree of influence of the indicator status on the state of the monitored object; and determining the root cause indicator leading to the malfunction of the monitored object among the multiple indicators based on the importance of the multiple indicators, thereby improving the accuracy of determining the root cause indicator. However, although this invention provides a method for determining root cause indicators, it does not address the causal relationship between feature dimensions.

[0006] Patent publication number CN115514627A discloses a method for fault root cause localization, including: obtaining service layer performance indicators of abnormal nodes; establishing a fault propagation graph based on the configuration information and alarm information of the abnormal nodes; the fault propagation graph includes the fault propagation relationship between components; and performing root cause localization based on the indicator causal graph, service layer performance indicators, and fault propagation graph to obtain root cause information; the indicator causal graph is established based on the service layer performance indicators of nodes within the cluster, and includes the causal relationship between indicators. This invention can combine the causal relationship of service layer performance indicators, which is beneficial for accurately locating the root cause of abnormal events at the indicator level, improving the efficiency and accuracy of root cause localization. However, this invention focuses on the causal relationship of service layer performance indicators. Summary of the Invention

[0007] The purpose of this invention is to provide a method and apparatus for locating the root cause of anomalies in multivariate time series data. It forms a complete solution from time series reconstruction to root cause analysis and interpretation, enabling the tracking of root cause faults, in-depth mining of anomalies in time series data, and revealing the potential causes of these anomalies.

[0008] To achieve the above-mentioned technical objectives, the technical solution adopted by the present invention is as follows:

[0009] In a first aspect, the present invention discloses a method for root cause localization of anomalies in multivariate time-series data, the time-series data root cause localization method comprising the following steps:

[0010] Discrete wavelet transform is used to decompose the original time series into two frequency components of different frequencies. Based on graph attention mechanism and temporal convolutional network, spatial and temporal features of frequency components at different scales are extracted respectively. Inverse wavelet transform is performed on the spliced ​​spatial and temporal features to synthesize the time series.

[0011] For the processed time series, clustering and anomaly attribution algorithms are used to group features based on feature similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly.

[0012] The Granger causality test method was used to determine the causal relationships and order of occurrence of each feature in the cluster most related to the anomaly, and the root cause chain was constructed.

[0013] The sequence of features in the root cause chain is analyzed, and the features at the beginning of the root cause chain are quantitatively analyzed to locate the initial factors that cause the abnormality. The stationarity test analysis is performed on the located initial factors that cause the abnormality to verify their possibility as root causes.

[0014] By combining the knowledge and experience in the root cause fault tracing and diagnosis knowledge base, explanations and solutions are provided for the identified root causes.

[0015] Furthermore, the original time series is decomposed using discrete wavelet transform into two frequency components of different frequencies. Based on graph attention mechanisms and temporal convolutional networks, spatial and temporal features of the frequency components at different scales are extracted. The process of synthesizing the time series by performing inverse wavelet transform on the concatenated spatial and temporal features includes the following steps:

[0016] Let X represent a time series under a sliding window. t ={x t-n+1 , ..., x t-1 x t}, X t ∈R n×d , where n represents time and d represents the number of features in the multivariate time series data.

[0017] In the DWT stage, two sets of filters are used to filter X. t Decomposed into frequency components f of different frequencies h and f l , where f h High-frequency components representing short-term trends in time series, f l Low-frequency components that represent the long-term trend of a time series;

[0018] A graph attention mechanism based on adjacency nodes is used to extract the spatial dependence of frequency components at different scales, and a temporal convolutional network is used to extract the temporal dependence of frequency components at different scales.

[0019] The spatial and temporal dependencies of frequency components at different scales output by the stitching graph attention module and the temporal convolutional network module are analyzed. The stitching result is then fed into the IDWT stage of the discrete wavelet transform module for processing, and the processed result is inversely transformed to synthesize a time series.

[0020]

[0021] Where v and g correspond to the high-pass filter and low-pass filter, respectively, and v′ and g′ are synthesized versions of v and g. For Haar wavelets, v′ = -v and g′ = g. The high-frequency components of layer p′ after processing by the graph attention module and the temporal convolution module are embedded and denoted as... The low-frequency component embedding representation of layer p′ after processing by the graph attention module and the temporal convolution module is denoted as . Obtained through inverse transform synthesis The low-frequency components of the p′-1 layer are embedded as representations; the synthesized time series is fed into the reconstruction module to obtain the reconstructed representation.

[0022] Furthermore, for the processed time series, clustering and anomaly attribution algorithms are used to group features based on feature similarity and identify the feature dimension most relevant to the anomaly. The process of clustering features most relevant to the anomaly and finding other indicators in the same cluster as that feature dimension includes the following steps:

[0023] Clustering algorithm is used to select from d feature dimensions Each vector is used as the cluster centroid vector, and each dimension d is calculated. i The corresponding vector and the cluster centroid vector d j Pearson similarity between pear(d) i d j If vector d i If vector d has the highest similarity to the centroid vector of a certain cluster, then vector d will be... i Assign the vectors to clusters and update the centroid vector to the mean of all vectors in the cluster.

[0024] An anomaly attribution algorithm is used to identify key features, and the weighted sum of EP and S values ​​is used as the feature ranking index. The calculation formula is as follows:

[0025]

[0026]

[0027] RTscore it =EP it +S it

[0028] Among them, EPit Let x represent the EP value of the element in the i-th dimension at the t-th time. it This represents the true value of the element in the i-th dimension at the t-th time. P represents the reconstructed value of the element in the i-th dimension at the t-th time; it Let Q represent the prior probability. it S represents the posterior probability. it Let x represent the S-value of the element in the i-th dimension at the t-th time. it This represents the true value of the element in the i-th dimension at the t-th time. RTscore represents the reconstructed value of the element in the i-th dimension at the t-th time. it As the final outlier score;

[0029] For dimension d, where the score is abnormally high, the score is higher than the set score threshold. i To find other indicators in the same cluster as d, it is considered that the found indicators are similar to d. i Closely related.

[0030] Furthermore, the Granger causality test is used to determine the causal relationships and order of occurrence of each feature in the cluster most relevant to the anomaly. The process of constructing the root cause chain includes the following steps:

[0031] Choose the lag length for each pair of features d in the cluster. i and d j Model establishment: d jt =β0+β1d i(t-1) +β2d i(t-2) +...+β5d i(t-5) +∈ t , where d i It is the dependent variable, d j β is the independent variable, and β is the model parameter. t This is the error term; an F-test is performed on the β coefficient in the causal model to determine d. i Is it for d? j It has statistical significance; if the p-value of the F-test is less than the pre-specified significance level, then d is considered statistically significant. i Granger's reason for d j ;

[0032] Test d i Is Granger the cause of d? i To assess the possibility of reverse causation;

[0033] Based on the results of the Granger causality test, feature pairs in all clusters are analyzed to determine which features are the cause of changes in other features, in order to construct root cause chains.

[0034] Furthermore, the process of analyzing the sequence of features in the root cause chain, quantifying the features at the beginning of the chain, and locating the initial factors that triggered the anomaly; and then performing a stationarity test on the located initial factors to verify their likelihood of being the root cause, includes the following steps:

[0035] The sequence of features in the root cause chain is analyzed, and the features at the beginning of the root cause chain are quantitatively analyzed. The degree of anomalous behavior of the features during the anomalous event is determined by calculating the time series statistical summary data of the features with mean μ, standard deviation σ, deviation S and kurtosis K, and the contribution of the features to the anomalous event is determined.

[0036] The initial factors that caused the anomaly were identified and their stationarity was tested. By judging whether the statistical properties of the features changed over time, it was determined whether the time series corresponding to the feature dimensions was non-stationary.

[0037] Furthermore, the ADF test is used to determine whether the statistical properties of the characteristic change over time; the hypothesis is as follows: Where, Δd it d i The first difference over time t, α i and β i These are model parameters, γ ij Here, p is the lag coefficient, and ∈ it This is the error term; if the p-value of the test is less than the significance level, the null hypothesis is rejected, and the time series corresponding to the feature dimension is considered non-stationary.

[0038] Furthermore, the process of providing explanations and solutions for identified root causes by combining knowledge and experience from the root cause analysis and diagnosis knowledge base includes the following steps:

[0039] The knowledge and experience in the root cause fault tracing and diagnosis knowledge base are stored in a structured format, including but not limited to historical cases of typical problems, as well as standardized handling measures, contingency plans and emergency response procedures for different problems;

[0040] Root cause d was identified from root cause chain analysis. i Searching for information related to root cause analysis in the Root Cause Analysis and Diagnosis Knowledge Base. i Relevant source tracing and diagnostic knowledge information, including historical cases, treatment measures, and contingency plans; combined with the retrieved source tracing and diagnostic knowledge information and root cause analysis. i This generates a detailed explanation of the cause of the current anomaly.

[0041] In a second aspect, the present invention discloses an anomaly root cause localization device for multivariate time series data, the anomaly root cause localization device comprising a time series synthesis module, an association index analysis module, a root cause chain inference module, a root cause localization module, and a root cause analysis module;

[0042] The time series synthesis module uses discrete wavelet transform to decompose the original time series into two frequency components of different frequencies. Based on graph attention mechanism and temporal convolutional network, spatial and temporal features of frequency components at different scales are extracted respectively. Inverse wavelet transform is performed on the spliced ​​spatial and temporal features to synthesize the time series.

[0043] The correlation index analysis module uses clustering and anomaly attribution algorithms for the processed time series. It groups features based on feature similarity, identifies the feature dimension most relevant to the anomaly, and finds other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly.

[0044] The root cause chain inference module uses the Granger causality test method to determine the causal relationship and order of occurrence of each feature in the cluster most related to the anomaly, and constructs the root cause chain.

[0045] The root cause localization module analyzes the feature order in the root cause chain, performs quantitative analysis on the features that are at the beginning of the root cause chain, and locates the initial factor that caused the abnormality; it then performs a stationarity test analysis on the located initial factor that caused the abnormality to verify its possibility as a root cause.

[0046] The root cause analysis module combines knowledge and experience from the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the identified root causes.

[0047] Furthermore, the time series synthesis module includes a decomposition unit and a synthesis unit;

[0048] The decomposition unit represents multi-dimensional time series data, composed of multiple univariate time series within the same entity, as X using a sliding window. t ={x t-n+1 , ..., x t-1 x t}, X t ∈R n×d Where n represents time and d represents the number of features in the multivariate time series data; in the DWT stage, two sets of filters are used to filter X t Decomposed into frequency components f of different frequencies h and f l , where f h High-frequency components representing short-term trends in time series, f lLow-frequency components that represent the long-term trend of a time series;

[0049] The synthesis unit employs a graph attention mechanism based on adjacent nodes to extract the spatial dependencies of frequency components at different scales, and a temporal convolutional network to extract the temporal dependencies of frequency components at different scales. It then concatenates the spatial and temporal dependencies of the frequency components at different scales output by the graph attention module and the temporal convolutional network module, and sends the concatenated result to the IDWT stage of the discrete wavelet transform module for processing. Finally, it performs an inverse transform on the processed result to synthesize a time series.

[0050]

[0051] Where v and g correspond to the high-pass filter and low-pass filter, respectively, and v′ and g′ are synthesized versions of v and g. For Haar wavelets, v′ = -v and g′ = g. The high-frequency components of layer p′ after processing by the graph attention module and the temporal convolution module are embedded and denoted as... The low-frequency component embedding representation of layer p′ after processing by the graph attention module and the temporal convolution module is denoted as . Obtained through inverse transform synthesis The low-frequency components of the p′-1 layer are embedded as representations; the synthesized time series is fed into the reconstruction module to obtain the reconstructed representation.

[0052] Thirdly, the present invention discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the method described above.

[0053] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0054] First, the method and apparatus for locating the root cause of anomalies in multivariate time series data of the present invention decomposes the time series into components of different frequencies through discrete wavelet transform, graph attention mechanism and temporal convolutional network. This enables the model to effectively capture the trends and different features in the time series, increasing the depth and breadth of time series analysis.

[0055] Second, the method and apparatus for locating the root cause of anomalies in multivariate time-series data of the present invention group and analyze the feature dimensions through clustering algorithms and anomaly attribution algorithms. This method can identify the feature dimensions most relevant to the anomaly.

[0056] Third, the method and apparatus for locating the root cause of anomalies in multivariate time series data of the present invention, through the collaborative work of multiple modules, forms a complete solution from the reconstruction of time series to the analysis and interpretation of root causes, realizes the tracking of root cause faults, deeply explores the anomalies in time series data, and reveals the potential causes of these anomalies. Attached Figure Description

[0057] Figure 1 This is a flowchart of the method for locating the root cause of abnormal events in multivariate time-series data according to the present invention.

[0058] Figure 2 This is a framework diagram of the time series reconstruction algorithm of the present invention;

[0059] Figure 3 This is the root cause score graph of the anomaly attribution algorithm of the present invention;

[0060] Figure 4 This is a Granger causality test score graph of the present invention;

[0061] Figure 5 This is a partial schematic diagram of the root cause fault tracing and diagnosis knowledge base of the present invention. Detailed Implementation

[0062] The embodiments of the present invention will be described in further detail below with reference to the accompanying drawings.

[0063] This invention proposes a method for root cause localization of anomalies in multivariate time-series data, characterized in that the time-series data root cause localization method includes the following steps:

[0064] Discrete wavelet transform is used to decompose the original time series into two frequency components of different frequencies. Based on graph attention mechanism and temporal convolutional network, spatial and temporal features of frequency components at different scales are extracted respectively. Inverse wavelet transform is performed on the spliced ​​spatial and temporal features to synthesize the time series.

[0065] For the processed time series, clustering and anomaly attribution algorithms are used to group features based on feature similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly.

[0066] The Granger causality test method was used to determine the causal relationships and order of occurrence of each feature in the cluster most related to the anomaly, and the root cause chain was constructed.

[0067] The sequence of features in the root cause chain is analyzed, and the features at the beginning of the root cause chain are quantitatively analyzed to locate the initial factors that cause the abnormality. The stationarity test analysis is performed on the located initial factors that cause the abnormality to verify their possibility as root causes.

[0068] By combining the knowledge and experience in the root cause fault tracing and diagnosis knowledge base, explanations and solutions are provided for the identified root causes.

[0069] See Figure 1 The method for locating the root cause of anomalies in multivariate time-series data according to the present invention specifically includes the following steps:

[0070] S1 uses discrete wavelet transform to decompose the original time series, extracts spatial and temporal features based on graph attention mechanism and temporal convolutional network, and synthesizes the time series using inverse wavelet transform.

[0071] Step S11: Represent the multi-dimensional time series data, which consists of multiple univariate time series within the same entity, as X = {x1, x2, ..., x...} n}, where n represents the maximum length of the timestamp, x t ∈R d Let X be a d-dimensional vector representing the value at time t in the time series data, where d represents the feature dimension and t = 1, 2, ..., n; and let X be divided into multiple sliding windows using a sliding window method.

[0072] Step S12: In the DWT stage, X t First, it is decomposed into components of different frequencies by two sets of filters. h and f l , where f h High-frequency components representing short-term trends in time series, f l Low-frequency components that represent the long-term trend of a time series;

[0073] Step S13: Use a graph attention mechanism based on adjacency nodes to extract the spatial dependence of frequency components at different scales, and use a temporal convolutional network to extract the temporal dependence of frequency components at different scales.

[0074] Step S14: The outputs of the image attention module and the temporal convolutional network module are stitched together. The stitched output is then fed into the IDWT stage of the discrete wavelet transform module for processing. The above embedded representation is used as input, and the time series is synthesized through inverse transform. The calculation formula is as follows:

[0075]

[0076] Here, v′ and g′ are composite versions of v and g, and for Haar wavelets, v′ = -v and g′ = g. The resulting sequence is fed into the reconstruction module to obtain the reconstructed representation.

[0077] S2 uses clustering and anomaly attribution algorithms to identify key feature dimensions and cluster similar features.

[0078] Step S21: Select from d feature dimensions using a clustering algorithm. Each vector is used as the cluster centroid vector, and each dimension d is calculated. i The Pearson similarity between the corresponding vector and the above cluster centroid vector is calculated using pear(d) i d j Let d be used to represent this; if vector d i If vector d has the highest similarity to the centroid vector of a certain cluster, then vector d will be... i Assign them to clusters and update the centroid vector, which is the mean of all vectors in the cluster;

[0079] Step S22: The anomaly attribution algorithm is used to identify key features. The weighted sum of EP and S values ​​is used as the feature ranking index, and its calculation formula is as follows:

[0080]

[0081] RTscore it =EP it +S it

[0082] Among them, EP it Let x represent the EP value of the element in the i-th dimension at the t-th time. it This represents the true value of the element in the i-th dimension at the t-th time. P represents the reconstructed value of the element in the i-th dimension at the t-th time. it Let Q represent the prior probability. it S represents the posterior probability. it Let x represent the S-value of the element in the i-th dimension at the t-th time. it This represents the true value of the element in the i-th dimension at the t-th time. RTscore represents the reconstructed value of the element in the i-th dimension at time t. it This serves as the final anomaly score.

[0083] Step S23: For dimension d with high outlier scores i Find other metrics in the same cluster as it, and consider these metrics to be related to d. i Closely related.

[0084] S3 uses the Granger causality test method to construct the root cause chain.

[0085] Step S31: Select a lag length of 5 for each pair of features d in the cluster. i and d j Model establishment: d jt =β0+β1d i(t-1) +β2d i(t-2) +...+β5d i(t-5) +∈ t , where d i It is the dependent variable, d j β is the independent variable, and β is the model parameter. t This is the error term; an F-test is performed on the β coefficient in the causal model to determine d. i Is it for d? i It has statistical significance. If the p-value of the F-test is less than the pre-specified significance level of 0.05, then d is considered statistically significant. i Granger's reason for d j ;

[0086] Step S32: The same method is applied to test d. i Is Granger the cause of d? i This is used to assess the possibility of reverse causation;

[0087] Step S33: Based on the results of the Granger causality test, analyze the feature pairs in all clusters to determine which features are the cause of changes in other features, thereby constructing the root cause chain.

[0088] S4, by analyzing the characteristic sequence in the causal chain, locates the initial factor that caused the anomaly.

[0089] Step S41: Analyze the characteristic order in the root cause chain, and perform quantitative analysis on the characteristic that ranks first in the causal chain; quantify the degree of abnormal behavior of the characteristic during the abnormal event by calculating its mean μ, standard deviation σ, deviation S and kurtosis K and other time series statistical summary data, and determine its contribution to the abnormal event.

[0090] Step S42: Perform a stationarity test on the feature at the beginning of the causal chain to determine whether its statistical properties change over time; use the ADF test, with the following hypothesis: Where, Δd it d i The first difference over time t, α i and β i These are model parameters, γ ii Here, p is the lag coefficient, and ∈ itThis is the error term. If the p-value of the test is less than the significance level of 0.05, the null hypothesis is rejected, and the time series corresponding to this feature dimension is considered non-stationary.

[0091] S5 combines knowledge and experience from the root cause analysis and diagnosis knowledge base to provide detailed explanations and solutions for identified root causes.

[0092] Step S51: Store the knowledge and experience in the root cause fault tracing and diagnosis knowledge base in a structured format, including but not limited to case studies of typical problems, standardized handling measures for different problems, contingency plans and emergency response procedures;

[0093] Step S52: Identify the root cause d from the causal chain analysis. i Retrieve relevant information from the root cause analysis and diagnosis knowledge base, including historical cases, handling measures, and contingency plans; combine the retrieved root cause analysis and diagnosis knowledge with d i Based on the specific circumstances, a detailed explanation of the cause of the current anomaly is generated.

[0094] Example

[0095] This example was tested on the HAI dataset, and all experiments were conducted on a server running Windows 10 (64-bit), equipped with an NVIDIA GeForce GTX 1060 graphics processing unit (GPU) and 16GB of memory.

[0096] from Figure 2 As can be seen above, the time series reconstruction algorithm architecture of this invention consists of three stages: the discrete wavelet transform stage, the graph attention and temporal convolutional network module stage, and the discrete wavelet inverse transform truncation stage. The discrete wavelet transform stage is used to capture the long-term and short-term trends of the time series, the graph attention mechanism and the temporal convolutional network module capture spatial dependence and temporal dependence, respectively, and the discrete wavelet inverse transform is used to reconstruct the obtained feature data to obtain the reconstructed representation.

[0097] from Figure 3 As can be seen above, this invention uses a clustering algorithm for the HAI dataset, and then adopts an anomaly attribution algorithm. The figure selects the top ten dimensions with the highest root cause scores for sorting. We select the cluster containing the dimension most associated with the abnormal event, which is [P1_B3005, P1_B400B, P1_FT01, P1_FT01Z, P1_FT02, P1_FT02Z, P1_FT03, P1_FT03Z].

[0098] from Figure 4As can be seen above, this invention uses the Granger causality test method for each pair of features of the cluster most associated with the anomalous event. It can be seen that the p-values ​​of P1_FT01 for other dimensional features are all less than 0.05. Therefore, it can be considered that the root cause chain origin is P1_FT01. At the same time, it can be seen from the time series features of this dimension that the time series statistics of the anomalous event corresponding to this dimension are significantly different from the normal time series statistics. The p-value of the ADF test is 0.02, indicating a non-stationary state.

[0099] from Figure 5 As can be seen above, regarding the problems caused by this dimension, based on the knowledge base for root cause fault tracing and diagnosis, we have the following past cases: Here, P1-PC refers to a pressure control loop in a boiler distributed control system. PV2 represents a setpoint in this control loop, and P1_FT01 is a specific parameter or variable associated with this setpoint. The attack scenario is described as follows: attempting to maintain the previous sensor value. Therefore, we can propose appropriate solutions, such as trying to unhide the setpoint.

[0100] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The solutions in the embodiments of this application can be implemented in various computer languages, such as the object-oriented programming language Java and the interpreted scripting language JavaScript.

[0101] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, produce instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0102] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0103] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment, causing a series of operational steps to be executed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that run on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0104] Although preferred embodiments of this application have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of this application.

[0105] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A method for locating the root cause of anomalies in multivariate time-series data, characterized in that, The method includes the following steps: Discrete wavelet transform is used to decompose the original time series into two frequency components of different frequencies. Based on graph attention mechanism and temporal convolutional network, spatial and temporal features of frequency components at different scales are extracted respectively. Inverse wavelet transform is performed on the spliced ​​spatial and temporal features to synthesize the time series. For the processed time series, clustering and anomaly attribution algorithms are used to group features based on feature similarity, identify the feature dimension most relevant to the anomaly, and find other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly. The Granger causality test method was used to determine the causal relationships and order of occurrence of each feature in the cluster most related to the anomaly, and the root cause chain was constructed. The sequence of features in the root cause chain is analyzed, and the features at the beginning of the root cause chain are quantitatively analyzed to locate the initial factors that cause the abnormality. The stationarity test analysis is performed on the located initial factors that cause the abnormality to verify their possibility as root causes. By combining the knowledge and experience in the root cause fault tracing and diagnosis knowledge base, we can provide explanations and solutions for the identified root causes. The process of decomposing the original time series using discrete wavelet transform into two frequency components of different frequencies, extracting spatial and temporal features of the frequency components at different scales based on graph attention mechanism and temporal convolutional network, and then performing inverse wavelet transform on the concatenated spatial and temporal features to synthesize the time series includes the following steps: Representing a time series under a sliding window as follows: , ,in, Indicates time, Indicates the number of features in multivariate time series data; In the DWT stage, two sets of filters are used to... Decomposed into frequency components of different frequencies and ,in High-frequency components representing short-term trends in time series data. Low-frequency components that represent the long-term trend of a time series; A graph attention mechanism based on adjacency nodes is used to extract the spatial dependence of frequency components at different scales, and a temporal convolutional network is used to extract the temporal dependence of frequency components at different scales. The spatial and temporal dependencies of frequency components at different scales output by the stitching graph attention module and the temporal convolutional network module are analyzed. The stitching result is then fed into the IDWT stage of the discrete wavelet transform module for processing, and the processed result is inversely transformed to synthesize a time series. in, and These correspond to high-pass and low-pass filters, respectively. and yes and The synthesized version, for Haar wavelets, and After processing by the graph attention module and the temporal convolution module Layer high-frequency component embedding representation is denoted as The graph attention module and the temporal convolution module will process the graph attention module and the temporal convolution module. Layer low-frequency component embedding representation is denoted as ; obtained through inverse transformation synthesis As the first The low-frequency components of the layer are embedded and represented; the synthesized time series is fed into the reconstruction module to obtain the reconstructed representation. ; The process of providing explanations and solutions for identified root causes by combining knowledge and experience from the root cause analysis and diagnosis knowledge base includes the following steps: The knowledge and experience in the root cause fault tracing and diagnosis knowledge base are stored in a structured format, including but not limited to historical cases of typical problems, as well as standardized handling measures, contingency plans and emergency response procedures for different problems; Identifying root causes through root cause chain analysis Searching for root cause analysis results in the Root Cause Analysis and Diagnosis Knowledge Base. Relevant source tracing and diagnostic knowledge information, including historical cases, treatment measures, and contingency plans; combined with retrieved source tracing and diagnostic knowledge information and root causes. This generates a detailed explanation of the cause of the current anomaly.

2. The method for root cause localization of multivariate time-series data anomaly events according to claim 1, characterized in that, For the processed time series, clustering and anomaly attribution algorithms are used to group features based on feature similarity and identify the feature dimension most relevant to the anomaly. The process of clustering features most relevant to the anomaly and finding other indicators in the same cluster as that feature dimension includes the following steps: Using clustering algorithms from Select from the feature dimensions Each vector is used as the cluster centroid vector, and each dimension is calculated. The corresponding vector and the cluster centroid vector Between Similarity If vector If a vector has the highest similarity to the centroid vector of a certain cluster, then the vector is... Assign the vectors to clusters and update the centroid vector to the mean of all vectors in the cluster. An anomaly attribution algorithm is used to identify key features, and the weighted sum of EP and S values ​​is used as the feature ranking index. The calculation formula is as follows: in, Indicates the first The first dimension The EP value of an element at a given time. Indicates the first The first dimension The true value of an element at a given time. Indicates the first The first dimension The reconstructed value of an element at a given time; Represents the prior probability. Represents the posterior probability. Indicates the first The first dimension The S value of an element at a given time. Indicates the first The first dimension The true value of an element at a given time. Indicates the first The first dimension The reconstructed value of an element at a given time; As the final outlier score; For dimensions with abnormal scores exceeding a set score threshold To find other indicators in the same cluster, consider the found indicators as... Closely related.

3. The method for root cause localization of anomaly events in multivariate time-series data according to claim 1, characterized in that, The process of using the Granger causality test to determine the causal relationships and order of occurrence of features in the cluster most relevant to the anomaly, and constructing the root cause chain, includes the following steps: Choosing a lag length of 5, for each pair of features in the cluster... and Establish a model: ,in It is the dependent variable. It is the independent variable. These are model parameters. It is the error term; in the causal model The coefficients are subjected to an F-test to determine Is it correct? It has statistical significance; if the p-value of the F-test is less than the pre-specified significance level, then it is considered statistically significant. Granger's reason is ; test Is Granger the cause? To assess the possibility of reverse causation; Based on the results of the Granger causality test, feature pairs in all clusters are analyzed to determine which features are the cause of changes in other features, in order to construct root cause chains.

4. The method for root cause localization of multivariate time-series data anomaly events according to claim 1, characterized in that, The process of analyzing the sequence of features in the root cause chain, quantifying the features at the beginning of the chain to pinpoint the initial factors causing the abnormality, and then performing a stationarity test on the identified initial factors to verify their likelihood of being the root cause includes the following steps: Analyze the feature order in the root cause chain, and perform quantitative analysis on the feature that appears first in the chain; calculate its mean. Standard deviation ,deviation and kurtosis The time series statistical summary data quantifies the degree of anomalous behavior of its characteristics during anomalous events, and determines its contribution to the anomalous events. The initial factors that caused the anomaly were identified and their stationarity was tested. By judging whether the statistical properties of the features changed over time, it was determined whether the time series corresponding to the feature dimensions was non-stationary.

5. The method for root cause localization of anomaly events in multivariate time-series data according to claim 1, characterized in that, use The test method is used to determine whether the statistical properties of a feature change over time; the hypothesis is in the form of: ,in, express In time First-order difference on, and These are model parameters. It is the coefficient of the lagged term. It is the lag order. It is the error term; if the test is... If the value is less than the significance level, the null hypothesis is rejected, and the time series corresponding to the feature dimension is considered to be non-stationary.

6. A device for locating the root cause of anomalies in multivariate time-series data based on the method of any one of claims 1-5, characterized in that, The abnormal event root cause localization device includes a time series synthesis module, an association index analysis module, a root cause chain inference module, a root cause localization module, and a root cause analysis module. The time series synthesis module uses discrete wavelet transform to decompose the original time series into two frequency components of different frequencies. Based on graph attention mechanism and temporal convolutional network, spatial and temporal features of frequency components at different scales are extracted respectively. Inverse wavelet transform is performed on the spliced ​​spatial and temporal features to synthesize the time series. The correlation index analysis module uses clustering and anomaly attribution algorithms for the processed time series. It groups features based on feature similarity, identifies the feature dimension most relevant to the anomaly, and finds other indicators in the same cluster as the feature dimension to obtain the feature cluster most relevant to the anomaly. The root cause chain inference module uses the Granger causality test method to determine the causal relationship and order of occurrence of each feature in the cluster most related to the anomaly, and constructs the root cause chain. The root cause localization module analyzes the feature order in the root cause chain, performs quantitative analysis on the features that are at the beginning of the root cause chain, and locates the initial factor that caused the abnormality; it then performs a stationarity test analysis on the located initial factor that caused the abnormality to verify its possibility as a root cause. The root cause analysis module combines knowledge and experience from the root cause fault tracing and diagnosis knowledge base to provide explanations and solutions for the identified root causes.

7. The device for locating the root cause of anomalies in multivariate time-series data according to claim 6, characterized in that, The time series synthesis module includes a decomposition unit and a synthesis unit; The decomposition unit represents multi-dimensional time series data, composed of multiple univariate time series within the same entity, using a sliding window. , ,in Indicates time, Indicates the number of features in multivariate time series data; In the DWT stage, two sets of filters are used to... Decomposed into frequency components of different frequencies and ,in High-frequency components representing short-term trends in time series data. Low-frequency components that represent the long-term trend of a time series; The synthesis unit uses a graph attention mechanism based on adjacent nodes to extract the spatial dependence of frequency components at different scales, and uses a temporal convolutional network to extract the temporal dependence of frequency components at different scales. The spatial and temporal dependencies of frequency components at different scales output by the graph attention module and the temporal convolutional network module are then concatenated. The concatenated result is then fed into the IDWT stage of the discrete wavelet transform module for processing, and the processed result is inversely transformed to synthesize a time series. in, and These correspond to high-pass and low-pass filters, respectively. and yes and The synthesized version, for Haar wavelets, and After processing by the graph attention module and the temporal convolution module Layer high-frequency component embedding representation is denoted as The graph attention module and the temporal convolution module will process the graph attention module and the temporal convolution module. Layer low-frequency component embedding representation is denoted as ; obtained through inverse transformation synthesis As the first The low-frequency components of the layer are embedded and represented; the synthesized time series is fed into the reconstruction module to obtain the reconstructed representation. .

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the method described in any one of claims 1-5.

Images