Avionics system anomaly detection method based on dynamic mask diffusion model

Abstract

The invention discloses an avionics system anomaly detection method based on a dynamic mask diffusion model, which comprises the following steps of: 1, realizing initial reconstruction of a time sequence by adopting a self-adaptive dynamic mask strategy and utilizing information of adjacent nodes in a multivariable time sequence of an avionics system and information of abnormal nodes and adjacent nodes of the abnormal nodes; and 2, combining Transform with a denoising diffusion model, inferring an abnormal label by using a prediction error generated by the masking data in the reconstructed time sequence, and determining an abnormal detection result of the avionics system based on the abnormal label. The method is obviously superior to the most advanced method in the aspects of detection accuracy and timeliness.

Description

Technical Field

[0001] The present invention belongs to the technical field of civil aircraft avionics systems, and in particular relates to an avionics system anomaly detection method based on a dynamic mask diffusion model. Background Art

[0002] Avionics systems play a vital role in modern aircraft, so anomaly detection in avionics systems has become a hot research field. Traditional fault detection methods are generally based on fault trees, models, and data-driven methods. However, these methods require accurate process mathematical models and are only applicable to small systems with fewer inputs and clear mathematical models. In addition, these methods have many interferences and uncertainties in the modeling process, which greatly affects the modeling results.

[0003] With the advancement of sensing and monitoring technologies, the operating status of modern equipment can be recorded in real time, resulting in the generation and accumulation of a large amount of multivariate time series data. The effective operation of large-scale systems depends heavily on the generation and analysis of large amounts of high-dimensional time series data, which are an important source of information for continuous monitoring of the operating status of the systems. However, in these systems, various abnormal events such as production failures and system defects may occur, resulting in deviations from the expected performance of many applications. When different time series dimensions are combined to form a multivariate time series, detecting anomalies in multivariate time data has become a critical task.

[0004] The importance of anomaly detection in maintaining operational efficiency and minimizing disruptions has been recognized in industries such as manufacturing, finance, and healthcare monitoring. Time series analysis involves modeling this data for classification, prediction, and anomaly detection. Time series anomaly detection for avionics systems refers to the analysis and modeling of time series data for avionics systems to discover outliers or abnormal patterns. Effective anomaly detection can provide timely warning information, allowing avionics systems to gain valuable time and prevent disasters.

[0005] Anomaly detection in avionics systems is an important issue that has received widespread attention from both the industry and the research community. Based on the anomaly detection methods for time series, the methods in this field can be divided into five categories. These categories include: prediction methods that predict future values ​​to identify anomalies; reconstruction methods that reconstruct time series and identify anomalies based on reconstruction errors; encoding methods that encode time series into different representations and use the encoding to detect anomalies; distance methods that measure the differences between time series and identify anomalies based on distance; distribution methods that model the distribution of time series data and detect anomalies based on deviations from the expected distribution, etc. Among the methods in various studies, the effectiveness of prediction and reconstruction methods has been greatly welcomed. For example, a combination of GRU and VAE is used to learn a robust representation of time series; the loss of the discriminator in GAN is used as an additional indicator for detecting anomalies; an attention mechanism is introduced in the transformer model and combined with adversarial training to jointly improve the accuracy of anomaly detection.

[0006] Anomaly diagnosis of avionics systems is one of the important means to ensure the normal operation of modern aircraft. However, accurately detecting anomalies in avionics systems is a huge challenge due to the need to accurately model the complex multivariate time series data of avionics systems. Anomaly detection in multivariate time series data is crucial to ensure the effective operation of large systems across different domains. Existing methods, including those based on prediction and reconstruction, have difficulty in effectively addressing these challenges. Summary of the invention

[0007] The technical problem to be solved by the present invention is to address the deficiencies of the above-mentioned prior art and provide an avionics system anomaly detection method based on a dynamic mask diffusion model, which mainly includes adaptive dynamic masking, diffusion model processing and anomaly reasoning detection, and adopts a simple dynamic masking strategy, which enables the present invention to better eliminate information related to abnormal data patterns. In the process of time series reconstruction, data nodes near the abnormal point may not show the characteristics of normal data, so when the model extracts local features and long-term dependencies in the time series, it may learn abnormal pattern features; in addition, the Transformer is combined with a denoising diffusion model to replace the internal neural network architecture in the diffusion model, so that the model of the present invention can better handle global correlations, complex patterns and long-term relationships in time series data, thereby improving the time series reconstruction performance of the model.

[0008] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0009] An avionics system anomaly detection method based on a dynamic mask diffusion model includes:

[0010] Step 1: Adopting an adaptive dynamic masking strategy, using the information of adjacent nodes in the multivariate time series of the avionics system, masking the abnormal nodes and their adjacent node information to achieve the initial reconstruction of the time series;

[0011] Step 2: Combine the Transformer with the denoising diffusion model, use the prediction error generated by the masked data in the reconstructed time series to infer the anomaly label, and determine the avionics system anomaly detection result based on the anomaly label.

[0012] To optimize the above technical solutions, the specific measures taken also include:

[0013] The adaptive dynamic mask strategy described in step 1 above is specifically as follows:

[0014] For each node n in the multivariate time series of the avionics system, define S n represents the total number of adjacent nodes of node n, M n is the number of adjacent nodes that need to be masked. Each node has an associated reconstruction error with the reconstructed node. Based on the reconstruction error and the number of masked adjacent nodes required, M n Dynamically generate a mask matrix:

[0015] According to the reconstruction error and the actual anomaly rate, the number of nodes that need to be masked around the anomaly point is determined; the size of the mask window is determined using the Pearson correlation coefficient between the node that needs to be masked and its adjacent nodes.

[0016] The above mask window is in [0,S n ] range.

[0017] If the correlation coefficient is greater than the set threshold, the mask window expands in both the forward and backward directions; otherwise, the mask window stops expanding.

[0018] The above step 2 includes:

[0019] The reconstructed multivariate time series input is a denoising diffusion model with Transformer as the neural network architecture. The denoising diffusion model gradually denoises the masked data in T steps, generating the output result L = (L 1 ,L 2 ,…,L t …,L T ), L t represents the prediction error of the output corresponding to the input at the denoising step t, and has the same dimension as the original time series;

[0020] Using L=(L 1 ,L 2 ,…,L t …,LT ) to determine the anomaly prediction value, and use a voting mechanism to determine the final anomaly voting result.

[0021] The above-mentioned use of L = (L 1 ,L 2 ,…,L t …,L T ) to determine the abnormal prediction value, as follows:

[0022] At each denoising step t, the anomaly label y is determined using the following formula t,L :

[0023]

[0024] where τ t , τ T represents the percentile of the prediction error at denoising step t, T;

[0025] Using formula (6), the set of abnormal prediction values ​​is gradually derived as Y L ={y t,1 ,…,y t,L};

[0026] where y t,L =1 means that at diffusion step t, the data at time step L is predicted to be abnormal.

[0027] Use voting mechanism to determine final abnormal voting results represents the total number of abnormal votes received at time step L. If the total number of abnormal votes received at a time point in all denoising steps exceeds the threshold ξ, the time point is marked as an abnormal point.

[0028] The present invention has the following beneficial effects:

[0029] The present invention adopts VAE to implement an adaptive dynamic masking strategy, ignoring information related to abnormal data patterns. By selectively shielding adjacent nodes, the focus of the model is shifted to non-adjacent nodes that provide information. At the same time, the influence of its own node information on the reconstruction of the data sequence is reduced, which is conducive to improved feature learning and enhances the generalization ability of the model.

[0030] The present invention combines the denoising diffusion model with the Transformer architecture and applies it for the first time to the anomaly detection task of multidimensional time series of avionics systems to build a generative model suitable for time series data. This integration significantly improves the inference efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 Dynamically mask time series;

[0032] Figure 2The overall framework designed for the model. DETAILED DESCRIPTION

[0033] The embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0034] The present invention provides an avionics system anomaly detection method based on a dynamic mask diffusion model, and proposes a new anomaly detection framework, namely, an anomaly detection framework based on a dynamic mask diffusion model. The framework combines time series masking and diffusion models to achieve accurate and robust anomaly detection. The mask-based method adopted by the present invention utilizes the information of adjacent values ​​in the time series to achieve accurate modeling of the correlation relationship between time and adjacent node information, thereby reducing the uncertainty in the data and enhancing the robustness of the anomaly detection process. The present invention uses a diffusion model to calculate time series data to accurately capture the dependency of sequence data. The experimental results of the present invention on open source aviation sensor data sets and other public data sets show that the framework proposed by the present invention is significantly superior to the most advanced methods in terms of detection accuracy and timeliness. The method specifically includes:

[0035] Step 1: Adopting an adaptive dynamic masking strategy, using the information of adjacent nodes in the multivariate time series of the avionics system, masking the abnormal nodes and their adjacent node information to achieve the initial reconstruction of the time series;

[0036] The adaptive dynamic mask strategy is as follows:

[0037] For each node n in the multivariate time series of the avionics system, define S n represents the total number of adjacent nodes of node n,

[0038] M n is the number of adjacent nodes that need to be masked;

[0039] There is an associated reconstruction error between each node and the reconstruction node. According to the reconstruction error and the actual anomaly rate, the nodes around the anomaly point that need to be masked are determined;

[0040] The size of the mask window is determined by using the Pearson correlation coefficient between the node to be masked and its adjacent nodes.

[0041] The mask window is in [0,S n ] range.

[0042] If the correlation coefficient is greater than the set threshold, the mask window expands in both the forward and backward directions; otherwise, the mask window stops expanding.

[0043] Step 2: Combine the Transformer with the denoising diffusion model, use the prediction error generated by the masked data in the reconstructed time series to infer the anomaly label, and determine the avionics system anomaly detection results based on the anomaly label, including:

[0044] The reconstructed multivariate time series is input into the denoising diffusion model, which gradually denoises the masked data in T steps, generating the output result L = (L 1 ,L 2 ,…,L t …,L T ), L t represents the prediction error of the output corresponding to the input at the denoising step t, and has the same dimension as the original time series;

[0045] Using L=(L 1 ,L 2 ,…,L t …,L T ) to determine the abnormal label Y t ={y t,1 ,…,y t,L}, and use the voting mechanism to determine the final abnormal voting result R, R = E (L 1 ,…,L T ).

[0046] The utilization of L=(L 1 ,L 2 ,…,L t …,L T ) to determine the abnormal label Y t ={y t,1 ,…,y t,L}, as follows:

[0047] At each denoising step t, the anomaly label Y is determined using the following formula t :

[0048]

[0049] where τ T represents the percentile of the prediction error at the denoising step T; Measure the compensation at each step t;

[0050] Using formula (6), derive the step-by-step anomaly prediction Y t ={y t,1 ,…,y t,L};

[0051] where y t,L =1 means that at diffusion step t, the data at time step L is predicted to be abnormal.

[0052] The voting mechanism is used to determine the final abnormal voting result R, R = E (L 1 ,…,L T ), as follows:

[0053] Voting Results represents the total number of anomaly votes received at time step L. If the number of anomaly votes received at a time point in all denoising steps exceeds the threshold ξ, it is marked as a final anomaly.

[0054] The diffusion algorithm introduced in this paper is different from previous methods. It uses time series dynamic masking to improve time series and improve anomaly detection performance. Diffusion models have attracted increasing attention in the field of artificial intelligence generated content. Although they have not been popular in the fields of time series modeling and anomaly detection for a long time, many researchers have begun to explore their applications and practices in these fields.

[0055] The details are as follows:

[0056] Problem description:

[0057] First, the problem of multivariate time series anomaly detection in the avionics field is briefly introduced, and then the specific framework of the dynamic mask diffusion model designed by the present invention and the design of the anomaly detection task are introduced.

[0058] The present invention considers a multivariate time series T = {x 1 ,…,x T}, where each element x i There are t (t∈[1,T]) timestamps and it is D-dimensional. Therefore, the multivariate time series T can be represented as a matrix: T = {x 1 ,…,x T}.

[0059] The goal of multivariate time series anomaly detection is to determine if an observation x p Is it abnormal?

[0060] By using y p ∈(0,1) shows whether there is an abnormality in the detection result (0 means no abnormality, 1 means abnormality), and converts the detection target into a sequence of abnormal labels for predicting each time point, that is, Y = {y 1 ,y 2 ,…,y T}.

[0061] Time series dynamic masking:

[0062] The traditional self-attention mechanism calculates the correlation between each node position in the sequence by paying attention to the node itself and other node positions, thereby capturing global context information. If each node is allowed to pay attention to its own information, it can reconstruct its own node in sequence reconstruction. However, this method is difficult to discover complex features in time series data.

[0063] In order to solve this problem, a unique method is designed in the model structure of the present invention. Unlike the direct use of the self-attention mechanism, the model uses the Variational Auto Encoder (VAE) to achieve the initial reconstruction of the time series before the diffusion model is denoised. The purpose of this is to shield the abnormal nodes and their adjacent node information, effectively blocking the abnormal node's own information and the related information of the adjacent nodes. Therefore, the model itself can pay more attention to non-adjacent areas, which will increase the difficulty of abnormal recovery during the model reconstruction process. Using the mask of the time series data to create unobserved points, the diffusion model learns the mapping from the latent space to the signal space by removing the noise sequentially added in a Markov manner in the forward process.

[0064] The diffusion model then uses the prediction errors generated by the masking values ​​set within the time series to infer the anomaly labels. Considering this, it can be concluded that the choice of masking strategy plays a crucial role in the performance of anomaly detection.

[0065] In this invention, an adaptive dynamic masking strategy is designed. For each node n in the time series data, define S n represents the total number of adjacent nodes of node n, M n is the number of neighboring nodes that need to be masked. Based on the reconstruction error of the time series and the number of masked neighboring nodes M required n Dynamically generate a mask matrix:

[0066] There is an associated error between each node and the reconstructed node. Based on this reconstruction error and the actual anomaly rate, it is possible to determine which nodes around the anomaly point need to be masked. The Pearson correlation coefficient between the masked node and its adjacent nodes is then used to determine the size of the mask window. If the correlation coefficient is greater than a certain threshold, the mask window can be expanded in both the forward and backward directions; otherwise, it will stop expanding. The mask window is allowed to be in [0,S n ] range, so the mask matrix is ​​dynamically generated based on the reconstruction error of the time series and the number of masked adjacent nodes required. The use of adaptive dynamic masking can minimize the impact of abnormal nodes. Figure 1 shown.

[0067] The present invention adopts a variational autoencoder structure, the main purpose of which is to ignore information related to abnormal data patterns. By selectively shielding adjacent nodes, the model's focus will shift to non-adjacent nodes that provide information, while reducing the impact of its own node information on data sequence reconstruction. This design is conducive to improved feature learning and enhances the generalization ability of the model.

[0068] The model designed by the present invention uses the diffusion model, which is a well-known generative model. Diffusion models represent a class of probabilistic generative models that are optimized through a two-step process involving the injection of noise into a set of training samples and its subsequent removal. By training the model to remove the noise added during the diffusion process, the model learns to generate valid data samples that are closely aligned with the training data distribution during inference.

[0069] The diffusion model follows a two-step process for data generation. First, noise is introduced to the input samples in a chain in the forward process, and second, it learns to generate new samples by gradually removing noise from the sample noise, which is similar to the reverse process of the forward process.

[0070] In the forward pass, Gaussian noise is incrementally added to the initial input sample x by T steps. 0 .

[0071] The whole forward process gradually adds learnable Gaussian noise β 1 ,…,β T , the entire Markov chain can be expressed as:

[0072]

[0073] x t The value of depends only on x t-1 , the last step, x t Completely corrupted into random noise.

[0074] Joint distribution p θ (x 0:T ) is the reverse process.

[0075] In the reverse process, a machine learning model with learnable parameters θ is used to denoise x t and refactor x 0 .

[0076] This is achieved by Gaussian transformation

[0077]

[0078] The inverse process can be solved by training the model to optimize the following objective function:

[0079]

[0080] x 0 is a complete data sample not affected by noise, q(x 0 ) is its distribution.

[0081] Denoising function ∈ Θ Responsible for predicting the addition to the input step x t noise.

[0082] Although diffusion models are gradually being used in time series research, multidimensional time series may involve multiple dimensions such as time, space, and attributes. In addition, time series data often exhibit long-term correlations.

[0083] To address these challenges, while also taking into account the complexity of multivariate time series and their long-term correlations, the present invention combines the denoising diffusion model with the Transformer architecture and applies it for the first time to the anomaly detection task of multidimensional time series of avionics systems to build a generative model suitable for time series data. This integration significantly improves the inference efficiency.

[0084] The structure of the model design:

[0085] The design of the diffusion model based on dynamic mask relies on the mask of the time series, and uses the error after the mask as the signal for anomaly detection. The training process is carried out in an unsupervised learning manner. The present invention introduces a mask into the original data to create missing values; then, a diffusion model is trained, which is specially designed for the subsequent anomaly detection task. In the inference stage, the intermediate output of the denoising diffusion model at different denoising steps t is used as additional information to jointly determine the anomaly label. This ensemble voting method enhances the accuracy and robustness of the anomaly detection task and further improves its performance.

[0086] The model of the present invention uses VAE to achieve the initial reconstruction of the time series before the diffusion model is denoised. The purpose of this is to shield the abnormal node and its adjacent node information, effectively blocking the abnormal node's own information and the related information of the adjacent nodes.

[0087] The diffusion model then uses the prediction errors resulting from the masked values ​​set within the time series to infer the anomaly labels.

[0088] In addition, the present invention introduces Transformer on the basis of the diffusion model. The Transformer model has made significant progress in various fields, including natural language processing, computer vision, time series analysis, etc. It is stacked by multiple identical layers (usually called "multi-head self-attention layers" and "feedforward neural network layers"). Each encoder layer contains two sublayers: a multi-head self-attention mechanism and a feedforward neural network. The decoder, similar to the encoder, is also composed of multiple identical layers, but each decoder layer contains three sublayers: a masked multi-head self-attention mechanism, an encoder-decoder attention mechanism, and a feedforward neural network. The self-attention mechanism allows the model to pay attention to all positions in the sequence at the same time when encoding or decoding, instead of processing the sequence step by step like a recurrent neural network (RNN). Multi-Head Attention divides the self-attention mechanism into multiple heads, each head learns different representations of the input, and then merges these representations to capture information in different subspaces. Layer Normalization can capture the dependencies between data elements and has powerful feature extraction capabilities. Therefore, the Transformer is combined with the denoising diffusion model to replace the internal neural network architecture in the diffusion model. The purpose of doing this is to enable the model to better handle global correlations, complex patterns, and long-term dependencies in time series data, thereby improving the model's time series reconstruction performance.

[0089] Transformer plays a crucial role in capturing temporal correlations within a time series, which is a structure designed for multivariate time series data computation. It allows for dynamic weighting of feature values ​​at different time steps while taking into account the masking status of features. The presence of abnormal data in the training set further raises concerns about robustness requirements. To address this limitation, the present invention exploits the unique advantages of diffusion models. Unlike traditional models that provide a single prediction, when the original data is input into the diffusion model, the masked data is gradually denoised in T steps, during which at least T intermediate steps of output results are generated, each of which has the same dimension as the original time series. Although the outputs of these intermediate steps are not completely denoised, they converge to the same result target and provide considerations of different time steps for time series modeling. By properly utilizing these outputs, the present invention introduces step-by-step reasoning into the designed model and uses them as additional signals to enhance the robustness and accuracy of anomaly detection.

[0090] The model uses the prediction error L = (L 1 ,L 2 ,…,L T) as input and integrate them using function computation to determine the final anomaly label. t represents the prediction error of the output corresponding to the input at the denoising step t, and it is consistent with the original time series x 0 Have the same dimensions. Figure 2 Its detailed structure is given in , and an explanation of the anomaly calculation is provided.

[0091] Algorithm 1 shown in Table 1 illustrates the specific algorithm flow of the model designed by the present invention and explains the set anomaly inference algorithm. In each denoising step of the model, the denoising model is used to generate a prediction of the noise ∈ Θ , and calculate the prediction error L of the original true time series x t The set L collects the prediction errors of each denoising step and uses the errors of all steps to determine the final voting results of the abnormal labels.

[0092] The anomaly detection step utilizes a voting mechanism to strengthen the overall anomaly detection process by aggregating the anomaly predictions from each denoising step.

[0093] At each denoising step t, the anomaly prediction label y is determined using the following formula t,L :

[0094]

[0095] τ T represents the percentile of the prediction error at the denoising step T, The estimation quality of each step t is measured. If this ratio is small, it indicates that the estimation quality is poor, and the percentage of estimation error of the abnormal label of this step can be reduced. In this case, only the labels of the time nodes with the highest confidence are retained. Conversely, a large ratio indicates that the filling quality is good and the error threshold of anomaly detection is relaxed.

[0096] Using formula (6), the set of abnormal prediction values ​​is gradually derived as Y L ={y t,1 ,…,y t,L}, where y t,L =1 means that at diffusion step t, the data at time step L is predicted to be abnormal.

[0097] In order to determine the final anomaly prediction result at each time step L, a voting mechanism is used. Final anomaly voting result represents the total number of outlier votes received at time step L. If the number of outlier votes received at a time point in all denoising steps exceeds the threshold ξ, the time point is marked as the final outlier point.

[0098] Table 1 Algorithm 1: Anomaly detection process of dynamic mask diffusion model

[0099]

[0100]

[0101] Implementation analysis:

[0102] The present invention is mainly aimed at anomaly detection of time series data of avionics systems. The specific implementation steps rely on the mask of the time series, and the error after masking is used as the signal for anomaly detection. The training process is carried out in an unsupervised learning manner. The present invention introduces masks into the original data to create missing values. Then, a diffusion model is trained, which is specially designed for subsequent anomaly detection tasks. In the inference stage of anomaly detection, the intermediate outputs of the denoising diffusion model at different denoising steps t are used as additional information to jointly determine the anomaly label. At present, no company has published relevant data sets for avionics systems. The present invention uses public data sets to implement the experimental process and test the performance of the anomaly detection model of the present invention. The following is a description of five experimental data sets:

[0103] MSL: MSL is a public dataset provided by NASA. The dataset contains data of 27 and 55 entities, and each entity consists of 55 dimensions.

[0104] SMAP: SMAP is a public dataset provided by NASA. The SMAP dataset consists of 25 dimensions. The dataset includes telemetry anomaly data reported by spacecraft detection systems, called Incident Surprise Anomalies (ISAs).

[0105] C-MAPSS dataset: A turbofan engine degradation monitoring dataset proposed by NASA. The main components include the fan, low-pressure compressor (LPC), high-pressure compressor (HPC), combustion chamber, high-pressure turbine (HPT), low-pressure turbine (LPT) and its nozzle. There are four sub-datasets, each with a different number of operating conditions and fault states. This paper selects the multi-operating condition subset of this dataset.

[0106] SMD: The SMD dataset is collected from a large Internet company over a five-week period. It consists of multivariate time series data with 38 dimensions.

[0107] Model evaluation indicators and baseline selection:

[0108] In order to compare and evaluate the proposed algorithms, a large number of baseline experiments are designed for each dataset, by comparing their state-of-the-art time series anomaly detection models in terms of algorithm performance.

[0109] LSTM-AD uses LSTM to predict future values ​​and uses the prediction error as an indicator of anomaly.

[0110] DeepFD builds a regression model to capture the interaction between temporal information and features to effectively identify anomalies between metrics.

[0111] DAGMM combined with Gaussian noise uses AutoEncoder to identify anomalies by reconstructing samples from the latent space.

[0112] MSCRED uses ConvLSTM as anomaly detector to capture the correlation between time series.

[0113] TadAD leverages the GAN model to perform anomaly inference by using broader temporal trends in the data.

[0114] The present invention uses these models as benchmarks to evaluate their performance in anomaly detection in multi-dimensional time series.

[0115] Six independent runs were performed for the present invention, and the average performance was statistically analyzed to evaluate the stability and robustness of all models in this experiment. Ablation analysis experiments were also performed to evaluate the effectiveness of each design choice in the present invention and reveal how these design choices help improve anomaly detection performance.

[0116] Performance of anomaly detection algorithms:

[0117] The precision, recall, F1 value of six public datasets are taken into account, and the baseline methods are considered. Please note that all the results listed in the table are averages obtained from 6 separate runs, which enables the present invention to evaluate the robustness of each detector. Tables 2 and 3 show the average performance of all models on the six datasets. It is worth noting that the present invention performs well in all evaluation indicators as a whole. It obtains the highest average score on the six datasets, exceeding the performance of other baseline methods. These results demonstrate the superiority of.

[0118] Table 2 Precision, recall, and F1 value of the selected datasets on different models

[0119]

[0120] Table 3 Precision, recall, and F1 value of the selected datasets on different models

[0121]

[0122] Ablation experiment:

[0123] The present invention conducts some ablation analysis experiments to evaluate the effectiveness of the design choices of each module in the present invention and reveal how these design choices improve the anomaly detection performance. The present invention considers removing the dynamic mask module and will explore the impact of the dynamic mask module on the overall model capabilities. Table 4 shows the average results obtained by the present invention on all selected data sets. The result is the average of the results obtained by independent operation of 6 independent models. In the table, the present invention mainly considers the impact of the dynamic mask and the set voting mechanism detection method on the present invention. The present invention replaces the dynamic mask module with an attention mechanism to determine whether the module can improve the anomaly detection performance of the model. It can be clearly seen from the table that the dynamic mask module significantly improves the performance of anomaly detection.

[0124] Table 4 Ablation experiment results

[0125] Model P R F1 Results for the full model 0.912 0.941 0.943 Remove the mask module 0.897 0.901 0.87 Remove the collective voting module 0.787 0.890 0.851

[0126] The above are only preferred embodiments of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should be regarded as the protection scope of the present invention.

Claims

1. A method for detecting anomalies in avionics systems based on a dynamic mask diffusion model, characterized in that: include: Step 1: Adopting an adaptive dynamic masking strategy, using the information of adjacent nodes in the multivariate time series of the avionics system, masking the abnormal nodes and their adjacent node information to achieve the initial reconstruction of the time series; Step 2: Combine the Transformer with the denoising diffusion model, use the prediction error generated by the masked data in the reconstructed time series to infer the anomaly label, and determine the avionics system anomaly detection result based on the anomaly label.

2. According to claim 1, the method for detecting anomalies in an avionics system based on a dynamic mask diffusion model is characterized in that: The adaptive dynamic mask strategy described in step 1 is as follows: For each node n in the multivariate time series of the avionics system, define S n represents the total number of adjacent nodes of node n, M n is the number of adjacent nodes that need to be masked. Each node has an associated reconstruction error with the reconstructed node. Based on the reconstruction error and the number of masked adjacent nodes required, M n Dynamically generate a mask matrix: According to the reconstruction error and the actual anomaly rate, the number of nodes that need to be masked around the anomaly point is determined; the size of the mask window is determined using the Pearson correlation coefficient between the node that needs to be masked and its adjacent nodes.

3. The method for detecting anomalies of an avionics system based on a dynamic mask diffusion model according to claim 2 is characterized in that: The mask window is in [0,S n ] range.

4. The method for detecting anomalies in an avionics system based on a dynamic mask diffusion model according to claim 3 is characterized in that: If the correlation coefficient is greater than the set threshold, the mask window expands in both the forward and backward directions; otherwise, the mask window stops expanding.

5. The method for detecting anomalies in an avionics system based on a dynamic mask diffusion model according to claim 1, characterized in that: The step 2 comprises: The reconstructed multivariate time series input is a denoising diffusion model with Transformer as the neural network architecture. The denoising diffusion model gradually denoises the masked data in T steps, generating the output results of T denoising steps L = (L1, L2, ..., L t …,L T ), L t represents the prediction error of the output corresponding to the input at the denoising step t, and has the same dimension as the original time series; Using L=(L1,L2,…,L t …,L T ) to determine the anomaly prediction value, and use a voting mechanism to determine the final anomaly voting result.

6. The method for detecting anomalies in an avionics system based on a dynamic mask diffusion model according to claim 5 is characterized in that: The use of L=(L1, L2, ..., L t …,L T ) to determine the abnormal prediction value, as follows: At each denoising step t, the anomaly label y is determined using the following formula t,L : where τ t , τ T represents the percentile of the prediction error at denoising step t, T; Using formula (6), the set of abnormal prediction values ​​is gradually derived as Y L ={y t,1 ,…,y t,L }; where y t,L =1 means that at diffusion step t, the data at time step L is predicted to be abnormal.

7. The method for detecting anomalies in an avionics system based on a dynamic mask diffusion model according to claim 5, characterized in that: Use voting mechanism to determine final abnormal voting results represents the total number of abnormal votes received at time step L. If the total number of abnormal votes received at a time point in all denoising steps exceeds the threshold ξ, the time point is marked as an abnormal point.

Images