Industrial data anomaly detection method and device, equipment and medium

Abstract

The embodiment of the invention discloses an industrial data anomaly detection method and device, equipment and a medium. Comprising the following steps: acquiring time sequence data acquired by a plurality of sensors in a target industrial system within a preset time period; inputting the time sequence data corresponding to the plurality of sensors into a preset coding model to obtain coded time sequence data corresponding to each sensor; inputting the encoded time sequence data into a preset decoding model to obtain decoded time sequence data; determining a detection result of the time sequence data based on the time sequence data and the decoded time sequence data; wherein the detection result comprises normal or abnormal. According to the technical scheme, the coded time sequence data and the decoded time sequence data can be rapidly obtained, the detection efficiency can be improved, and therefore the safety of an industrial system is guaranteed.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of anomaly detection technology, and in particular to an industrial data anomaly detection method, device, equipment, and medium. Background Art

[0002] Currently, industrial systems utilize a large number of sensor devices. These devices collect time-series data to monitor the system's operating status in real time, ensuring the safety of these systems. However, existing anomaly detection methods rely primarily on manual analysis of the time-series data collected by these sensors, resulting in low detection efficiency. Summary of the Invention

[0003] Embodiments of the present invention provide a method, apparatus, device, and medium for detecting anomalies in industrial data, which can improve detection efficiency.

[0004] In a first aspect, an embodiment of the present invention provides a method for detecting anomalies in industrial data, including:

[0005] Obtain time series data collected by multiple sensors in the target industrial system within a preset time period;

[0006] Inputting the time series data corresponding to the multiple sensors into a preset coding model to obtain encoded time series data corresponding to each sensor;

[0007] Inputting the encoded time series data into a preset decoding model to obtain decoded time series data;

[0008] A detection result of the time series data is determined based on the time series data and the decoded time series data; wherein the detection result includes normal or abnormal.

[0009] In a second aspect, an embodiment of the present invention further provides an industrial data anomaly detection device, the device comprising:

[0010] A data acquisition module is used to obtain time series data collected by multiple sensors in the target industrial system within a preset time period;

[0011] a data encoding module, configured to input the time series data corresponding to the plurality of sensors into a preset encoding model to obtain encoded time series data corresponding to each sensor;

[0012] A data decoding module, configured to input the encoded time series data into a preset decoding model to obtain decoded time series data;

[0013] A detection result determination module is used to determine the detection result of the time series data based on the time series data and the decoded time series data; wherein the detection result includes normal or abnormal.

[0014] In a third aspect, an embodiment of the present invention further provides an electronic device, comprising:

[0015] at least one processor; and

[0016] a memory communicatively connected to the at least one processor; wherein,

[0017] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor so that the at least one processor can execute the industrial data anomaly detection method described in the embodiment of the present invention.

[0018] In a fourth aspect, an embodiment of the present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the industrial data anomaly detection method described in the embodiment of the present invention when executed.

[0019] The embodiments of the present invention disclose a method, apparatus, device, and medium for detecting anomalies in industrial data, comprising: obtaining time series data collected by multiple sensors in a target industrial system within a preset time period; inputting the time series data corresponding to the multiple sensors into a preset encoding model to obtain encoded time series data corresponding to each sensor; inputting the encoded time series data into a preset decoding model to obtain decoded time series data; and determining a detection result of the time series data based on the time series data and the decoded time series data; wherein the detection result includes normal or abnormal. The above technical solution can realize anomaly detection of time series data in an industrial system, specifically considering the use of a preset encoding model to encode the acquired time series data, so that the encoded time series data can be quickly obtained; at the same time, considering the use of a preset decoding model to decode the encoded time series data, so that the decoded time series data can be quickly obtained; finally, determining the detection result of the time series data based on the time series data and the decoded time series data, which can improve detection efficiency. Compared with the prior art, the technical solution provided by this embodiment can quickly obtain encoded time series data and decoded time series data, which can improve detection efficiency, thereby ensuring the safety of the industrial system. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flow chart of a method for detecting anomalies in industrial data in Embodiment 1 of the present invention;

[0021] Figure 2 A schematic diagram of the structure of a preset coding model provided in an embodiment of the present invention;

[0022] Figure 3 A schematic diagram of the structure of the spatiotemporal feature fusion module provided in an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the structure of a spatial feature extraction network provided by an embodiment of the present invention;

[0024] Figure 5 A schematic diagram of the structure of a time feature extraction network provided by an embodiment of the present invention;

[0025] Figure 6 A schematic diagram of the structure of a preset decoding model provided in an embodiment of the present invention;

[0026] Figure 7 This is a structural diagram of an industrial data anomaly detection device in Embodiment 2 of the present invention;

[0027] Figure 8 It is a structural diagram of an electronic device in embodiment 3 of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It will be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present invention, not all structures.

[0029] Example 1

[0030] Figure 1 This is a flowchart of a method for detecting anomalies in industrial data provided by Example 1 of the present invention. This embodiment is applicable to situations where anomalies in industrial data are detected. The method can be performed by an industrial data anomaly detection device, which can be implemented in the form of software and / or hardware. Optionally, it can be implemented by an electronic device, which can be a mobile terminal, PC, or server. Specifically, it includes the following steps:

[0031] S110: Acquire time series data collected by multiple sensors in a target industrial system within a preset time period.

[0032] In this embodiment, the target industrial system is the research object of the present invention, and data within the target industrial system is detected. For example, the target industrial system may be a water treatment system. In the water treatment system, various sensors are used to collect data such as water level, flow rate, and water pressure. By performing anomaly detection on the data collected by the sensors, anomalies can be quickly located and timely intervention measures can be taken.

[0033] In this embodiment, the preset time period is a pre-set time, such as T1 to Tn. The preset time period includes multiple sampling moments, such as T1, T2, ..., Tn, for a total of n sampling moments. The time series data can be understood as data with time series characteristics, and the time series data is data collected at multiple sampling moments.

[0034] For example, based on the above n sampling moments, assuming that the target industrial system contains m sensors, the time series data collected by the i-th (i=1, 2, ..., m) sensor within T1 to Tn can be recorded as: X i ={x i1 ,x i2 ,…,x in}. Among them, x i1 represents the data collected by the i-th sensor at time T1, ..., x in Represents the data collected by the i-th sensor at time Tn.

[0035] S120 , inputting the time series data corresponding to the multiple sensors into a preset coding model to obtain the encoded time series data corresponding to each sensor.

[0036] In this embodiment, the preset encoding model is a pre-trained encoding model, which is used to encode input data; the encoded time series data is the result of encoding the time series data.

[0037] For example, the time series data X corresponding to multiple sensors is converted into {X1, X2, ..., X m} is input into the preset coding model to obtain the coded time series data H={H1, H2, ..., H m}. Among them, H i Represents the encoded time series data corresponding to the i-th sensor.

[0038] Optional, Figure 2 A schematic diagram of the structure of the preset coding model provided in an embodiment of the present invention is shown in FIG. Figure 2 As shown, the preset coding model includes a multi-scale feature generation module, multiple parallel spatiotemporal feature fusion modules, and a multi-scale fusion module. The multi-scale feature generation module includes multiple scale transformation layers that correspond to the spatiotemporal feature fusion modules and are connected in series. The output of each scale transformation layer is connected to the input of its corresponding spatiotemporal feature fusion module. The multiple parallel spatiotemporal feature fusion modules are all connected to the multi-scale fusion module.

[0039] Specifically, the scale transformation layer is used to perform scale transformation on the input time series data to obtain the scale features corresponding to the time series data; the spatiotemporal feature fusion module is used to perform feature fusion on the input scale features to obtain fused spatiotemporal features; the multi-scale fusion module is used to fuse multiple fused spatiotemporal features of the input to obtain fused features; wherein the fused features are the encoded time series data.

[0040] For example, assuming that there are k scale transformation layers, the time series data corresponding to multiple sensors are input into a preset encoding model, and the encoded time series data corresponding to each sensor can be obtained by inputting the time series data X corresponding to multiple sensors into the first scale transformation layer, and obtaining the scale feature X output by the first scale transformation layer. 1 ; The scale feature X 1 Input to the second scale transformation layer to obtain the scale feature X output by the second scale transformation layer 2 ; ...; scale feature X k -1 Input to the kth scale transformation layer to obtain the scale feature X output by the kth scale transformation layer k ; The scale feature X 1 、X 2 、……、X k Input them into the corresponding spatiotemporal feature fusion module respectively, and output the fused spatiotemporal feature H 1 、H 2 ,……,H k ; Multiple fused spatiotemporal features H 1 、H 2 ,……,H k Input to the multi-scale fusion module and output the fusion feature H.

[0041] Optionally, multiple fused spatiotemporal features H 1 、H 2 ,……,H k The input is fed into the multi-scale fusion module, and the implementation of outputting the fusion feature H can be described as the following steps:

[0042] 1) Combine multiple fused spatiotemporal features H 1 、H 2 ,……,H k Perform splicing to obtain the spliced ​​feature H cat =Concate(H 1 、H 2 ,…,H k ), for the concatenated feature H cat Perform average pooling to obtain pooled features

[0043] 2) Based on the pooled features, two fully connected layers are used to determine the weight factor α corresponding to each fused spatiotemporal feature. The calculation formula is as follows:

[0044] f1=ReLU(W1h pool +b1), α=Sigmoid(W2f1+b2)

[0045] Among them, W1 and W2 are the weight matrices in the two fully connected layers, and b1 and b2 are the corresponding bias vectors.

[0046] 3) According to the weight factor, multiple fused spatiotemporal features H 1 、H 2 ,……,H k Perform weighted summation to obtain the fusion feature H. The weighted summation formula is shown below.

[0047]

[0048] Further, Figure 3 This is a schematic diagram of the structure of the spatiotemporal feature fusion module provided by an embodiment of the present invention, as shown in FIG. Figure 3 As shown, the spatiotemporal feature fusion module includes a spatial feature extraction network, a temporal feature extraction network, and a spatiotemporal feature fusion network. Specifically, the spatial feature extraction network is used to extract spatial features from the input scale features; the temporal feature extraction network is used to extract temporal features from the input scale features; and the spatiotemporal feature fusion network is used to fuse the spatial and temporal features to obtain fused spatiotemporal features.

[0049] For example, the scale feature X 1 For example, the scale feature X 1 Input to the corresponding spatiotemporal feature fusion module and output the fused spatiotemporal feature H 1 The implementation method can be: scale feature X 1 Input into the spatial feature extraction network to obtain the spatial feature Z 1 ; The scale feature X 1 Input into the time feature extraction network to obtain the time feature S 1 ; The spatial feature Z 1 and time characteristics S 1 Input into the spatiotemporal feature fusion network to obtain the fused spatiotemporal feature H 1 .

[0050] The spatiotemporal feature fusion network is a graph convolutional neural network that transforms the spatial feature Z 1 and time characteristics S 1 Input into the spatiotemporal feature fusion network to obtain the fused spatiotemporal feature H 1 The method can be: the spatial feature Z1 and time characteristics S 1 Perform splicing and make the spliced ​​result Q 1 =Concate(Z 1 , S 1 ) is input into the spatiotemporal feature fusion network to obtain the fused spatiotemporal feature H 1 .

[0051] Optional, Figure 4 A schematic diagram of the structure of the spatial feature extraction network provided by an embodiment of the present invention is shown in FIG. Figure 4 As shown, the spatial feature extraction network includes a cosine similarity calculation unit, a similarity feature determination unit, and a feature fusion unit. The cosine similarity calculation unit is used to calculate the cosine similarity between scale features; the similarity feature determination unit is used to determine similarity features of scale features based on cosine similarity; and the feature fusion unit is used to fuse scale features with their corresponding similar features to obtain fused scale features, which are then used as spatial features.

[0052] For example, the scale feature X 1 For example, Represents the scale feature corresponding to the mth sensor. 1 Input into the spatial feature extraction network to obtain the spatial feature Z 1 The implementation can be described as the following steps:

[0053] 1) For the current scale characteristics The scale feature is calculated using the following formula Divide the scale feature Other scale features besides The cosine similarity e between ij ;

[0054]

[0055] 2) Scale features With other scale features The cosine similarity e between ij Sort from large to small, and select other scale features corresponding to the set number of cosine similarities ranked at the top as scale features similar features of

[0056] 3) Scale features Similar features Perform fusion to obtain the fused scale features

[0057] Among them, α i,jis the set attention coefficient, W is the set weight, and N(i) represents the scale feature A set of similar features.

[0058] Optional, Figure 5 A schematic diagram of the structure of the time feature extraction network provided by an embodiment of the present invention is shown in FIG. Figure 5 As shown, the temporal feature extraction network includes multiple groups of serially connected dilated causal convolutional units, with the input and output of each group of dilated causal convolutional units being jump-connected. Each group of dilated causal convolutional units includes at least one dilated causal convolutional unit, which is used to perform a convolution operation on the input features.

[0059] Continuing from the above description, the skip connection can be understood as a residual connection. Adding a residual connection after each group of dilated causal convolution units can accelerate the training process of the temporal feature extraction network and improve the convergence speed.

[0060] S130 , inputting the encoded time series data into a preset decoding model to obtain decoded time series data.

[0061] In this embodiment, the preset decoding model is a pre-trained decoding model. Figure 6 A schematic diagram of the structure of the preset decoding model provided in an embodiment of the present invention is shown in FIG. Figure 6 As shown, the preset decoding model includes multiple fully connected layers in series.

[0062] For example, assuming there are three fully connected layers, the encoded time series data H is sequentially input into the three fully connected layers to obtain the decoded time series data The calculation formula is as follows:

[0063] L1=ReLU(W1H+b1)

[0064] L2=ReLU(W2L1+b2)

[0065]

[0066] Where W1, W2, and W3 are the weight matrices in the three fully connected layers, b1, b2, and b3 are the corresponding bias vectors. L1 and L2 are the outputs of the first and second fully connected layers, respectively.

[0067] In this embodiment, the training method of the preset encoding model and the preset decoding model can be: obtain normal time series data samples collected by multiple sensors in the target industrial system; input the normal time series data samples into the preset encoding model and the preset decoding model in sequence to obtain decoded normal time series data samples; determine the loss function based on the normal time series data samples and the decoded normal time series data samples; train the preset encoding model and the preset decoding model according to the loss function.

[0068] Continuing with the above description, the loss function is used to characterize the deviation between the normal time series data sample and the decoded normal time series data sample. Exemplarily, the loss function can be a mean square error loss function. Optionally, the method of training the preset encoding model and the preset decoding model according to the loss function can be: reversely adjust the parameters in the preset encoding model and the preset decoding model according to the loss function.

[0069] S140. Determine a detection result of the time series data based on the time series data and the decoded time series data.

[0070] The test results include normal or abnormal.

[0071] In this embodiment, the method for determining the detection result of the timing data based on the timing data and the decoded timing data can be: if the difference between the timing data and the decoded timing data is greater than the set threshold, the detection result of the timing data is abnormal; if the difference between the timing data and the decoded timing data is less than or equal to the set threshold, the detection result of the timing data is normal.

[0072] The threshold value is set to a value set in advance.

[0073] Furthermore, if the difference between the timing data and the decoded timing data is greater than the set threshold, it means that the deviation between the timing data and the decoded timing data is large, that is, the encoded timing data is not successfully decoded; if the difference between the timing data and the decoded timing data is less than or equal to the set threshold, it means that the deviation between the timing data and the decoded timing data is small, that is, the encoded timing data is successfully decoded.

[0074] For example, the time series data corresponding to the first sensor X1={x 11 ,x 12 ,…,x 1n} as an example, and the decoded time series data corresponding to the first sensor is Assume that the threshold is set to e, for the data corresponding to the first sampling moment: x 11 and If the time series data x 11 With the decoded timing data If the difference between them is greater than e, then the time series data x 11 The detection result is abnormal; if the time series data x 11 With the decoded timing data If the difference between them is less than or equal to e, then the time series data x 11 Similarly, the data corresponding to other sampling moments are tested using the same method as above.

[0075] The technical solution of this embodiment obtains the time series data collected by multiple sensors in the target industrial system within a preset time period; inputs the time series data corresponding to the multiple sensors into a preset coding model to obtain the encoded time series data corresponding to each sensor; inputs the encoded time series data into a preset decoding model to obtain the decoded time series data; and determines the detection result of the time series data based on the time series data and the decoded time series data. The above technical solution can realize anomaly detection of time series data in the industrial system, and specifically considers the use of a preset coding model to encode the acquired time series data, which can quickly obtain the encoded time series data; at the same time, it also considers the use of a preset decoding model to decode the encoded time series data, which can quickly obtain the decoded time series data; finally, the detection result of the time series data is determined based on the time series data and the decoded time series data, which can improve the detection efficiency. The technical solution provided by this embodiment can quickly obtain the encoded time series data and the decoded time series data, which can improve the detection efficiency, thereby ensuring the safety of the industrial system.

[0076] Example 2

[0077] Figure 7 This is a structural diagram of an industrial data anomaly detection device provided by the second embodiment of the present invention, such as Figure 7 As shown, the device includes:

[0078] The data acquisition module 210 is used to acquire time series data collected by multiple sensors in the target industrial system within a preset time period;

[0079] A data encoding module 220 is configured to input the time series data corresponding to the multiple sensors into a preset encoding model to obtain encoded time series data corresponding to each sensor;

[0080] A data decoding module 230 is configured to input the encoded time series data into a preset decoding model to obtain decoded time series data;

[0081] The detection result determination module 240 is used to determine the detection result of the time series data based on the time series data and the decoded time series data; wherein the detection result includes normal or abnormal.

[0082] Optionally, the preset coding model includes a multi-scale feature generation module, multiple parallel spatiotemporal feature fusion modules, and a multi-scale fusion module; the multi-scale feature generation module includes multiple scale transformation layers corresponding to the spatiotemporal feature fusion modules and connected in series; wherein the output of each scale transformation layer is respectively connected to the input of its corresponding spatiotemporal feature fusion module; and the multiple parallel spatiotemporal feature fusion modules are all connected to the multi-scale fusion module;

[0083] The scale transformation layer is used to perform scale transformation on the input time series data to obtain scale features corresponding to the time series data;

[0084] The spatiotemporal feature fusion module is used to fuse the input scale features to obtain fused spatiotemporal features;

[0085] The multi-scale fusion module is used to fuse multiple fused spatiotemporal features input to obtain fused features; wherein the fused features are encoded time series data.

[0086] Optionally, the spatiotemporal feature fusion module includes a spatial feature extraction network, a temporal feature extraction network and a spatiotemporal feature fusion network;

[0087] The spatial feature extraction network is used to extract spatial features from input scale features;

[0088] The temporal feature extraction network is used to extract temporal features from input scale features;

[0089] The spatiotemporal feature fusion network is used to fuse the spatial features and the temporal features to obtain fused spatiotemporal features.

[0090] Optionally, the spatial feature extraction network includes a cosine similarity calculation unit, a similar feature determination unit and a feature fusion unit;

[0091] The cosine similarity calculation unit is used to calculate the cosine similarity between scale features;

[0092] The similarity feature determination unit is configured to determine similarity features of the scale features based on the cosine similarity;

[0093] The feature fusion unit is used to fuse the scale feature with its corresponding similar feature to obtain a fused scale feature, and use the fused scale feature as a spatial feature.

[0094] Optionally, the temporal feature extraction network includes multiple groups of serially connected dilated causal convolution units, and the input and output of each group of dilated causal convolution units are jump-connected; wherein, each group of dilated causal convolution units includes at least one dilated causal convolution unit, and the dilated causal convolution unit is used to perform convolution operations on the input features.

[0095] Optionally, the preset decoding model includes multiple fully connected layers connected in series.

[0096] Optionally, the detection result determination module 240 may be specifically configured to:

[0097] If the difference between the time series data and the decoded time series data is greater than a set threshold, the detection result of the time series data is abnormal;

[0098] If the difference between the time series data and the decoded time series data is less than or equal to the set threshold, the detection result of the time series data is normal.

[0099] The above device can execute the methods provided by all the above embodiments of the present invention, and has the corresponding functional modules and beneficial effects of executing the above methods. For technical details not fully described in this embodiment, please refer to the methods provided by all the above embodiments of the present invention.

[0100] Example 3

[0101] Figure 8 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0102] like Figure 8As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 into the random access memory (RAM) 13. Various programs and data required for the operation of the electronic device 10 can also be stored in the RAM 13. The processor 11, ROM 12, and RAM 13 are connected to each other via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0103] Multiple components in the electronic device 10 are connected to the I / O interface 15, including an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0104] The processor 11 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors that run machine learning model algorithms, a digital signal processor (DSP), and any other suitable processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the industrial data anomaly detection method.

[0105] In some embodiments, the industrial data anomaly detection method can be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the industrial data anomaly detection method described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the industrial data anomaly detection method in any other suitable manner (e.g., via firmware).

[0106] Various embodiments of the systems and techniques described herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0107] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0108] In the context of the present invention, computer-readable storage media can be tangible media that can contain or store a computer program for use with an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. Computer-readable storage media can include but are not limited to electronic, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, computer-readable storage media can be machine-readable signal media. More specific examples of machine-readable storage media can include electrical connections based on one or more lines, portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM or flash memory), optical fibers, portable compact disk read-only memories (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0109] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0110] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0111] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0112] An embodiment of the present invention further provides a computer program product, including a computer program, which, when executed by a processor, implements the industrial data anomaly detection method provided in any embodiment of the present application.

[0113] The computer program product may be implemented by writing computer program code for performing the operations of the present invention in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0114] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0115] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A method for detecting anomalies in industrial data, characterized in that: include: Obtain time series data collected by multiple sensors in the target industrial system within a preset time period; Inputting the time series data corresponding to the multiple sensors into a preset coding model to obtain the encoded time series data corresponding to each sensor; Inputting the encoded time series data into a preset decoding model to obtain decoded time series data; A detection result of the timing series data is determined based on the timing series data and the decoded timing series data; wherein the detection result includes normal or abnormal.

2. The method according to claim 1, characterized in that The preset coding model includes a multi-scale feature generation module, a plurality of parallel spatiotemporal feature fusion modules and a multi-scale fusion module; the multi-scale feature generation module includes a plurality of scale transformation layers corresponding to the spatiotemporal feature fusion modules and connected in series; wherein the output of each scale transformation layer is respectively connected to the input of the corresponding spatiotemporal feature fusion module; and the plurality of parallel spatiotemporal feature fusion modules are all connected to the multi-scale fusion module; The scale transformation layer is used to perform scale transformation on the input time series data to obtain scale features corresponding to the time series data; The spatiotemporal feature fusion module is used to perform feature fusion on the input scale features to obtain fused spatiotemporal features; The multi-scale fusion module is used to fuse multiple fused spatiotemporal features input to obtain fused features; wherein the fused features are encoded time series data.

3. The method according to claim 2, characterized in that The spatiotemporal feature fusion module includes a spatial feature extraction network, a temporal feature extraction network and a spatiotemporal feature fusion network; The spatial feature extraction network is used to extract spatial features from input scale features; The temporal feature extraction network is used to extract temporal features from input scale features; The spatiotemporal feature fusion network is used to fuse the spatial features and the temporal features to obtain fused spatiotemporal features.

4. The method according to claim 3, characterized in that The spatial feature extraction network includes a cosine similarity calculation unit, a similar feature determination unit and a feature fusion unit; The cosine similarity calculation unit is used to calculate the cosine similarity between scale features; The similarity feature determination unit is used to determine the similarity feature of the scale feature based on the cosine similarity; The feature fusion unit is used to fuse the scale feature with its corresponding similar feature to obtain a fused scale feature, and use the fused scale feature as a spatial feature.

5. The method according to claim 3, characterized in that: The temporal feature extraction network includes multiple groups of serially connected dilated causal convolution units, and the input and output of each group of dilated causal convolution units are jump-connected; wherein each group of dilated causal convolution units includes at least one dilated causal convolution unit, and the dilated causal convolution unit is used to perform convolution operations on input features.

6. The method according to claim 1, characterized in that The preset decoding model includes a plurality of fully connected layers connected in series.

7. The method according to claim 1, characterized in that Determining a detection result of the time series data based on the time series data and the decoded time series data includes: If the difference between the time series data and the decoded time series data is greater than a set threshold, the detection result of the time series data is abnormal; If the difference between the timing data and the decoded timing data is less than or equal to the set threshold, the detection result of the timing data is normal.

8. An industrial data anomaly detection device, characterized in that: include: A data acquisition module, used to acquire time series data collected by multiple sensors in a target industrial system within a preset time period; A data encoding module, used to input the time series data corresponding to the multiple sensors into a preset encoding model to obtain encoded time series data corresponding to each sensor; A data decoding module, used for inputting the encoded time series data into a preset decoding model to obtain decoded time series data; A detection result determination module is used to determine the detection result of the timing data based on the timing data and the decoded timing data; wherein the detection result includes normal or abnormal.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the industrial data anomaly detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the industrial data anomaly detection method according to any one of claims 1 to 7 when executed.

Images