Causal-driven anti-fact data generation method and device and application method thereof in anomaly detection and storage medium

Abstract

The invention relates to the technical field of anomaly detection, in particular to a causal-driven anti-fact data generation method and device and an application method and device thereof in anomaly detection and a storage medium. The method comprises the steps that according to system monitoring variables, the causal relationship between the system monitoring variables is determined, and the system monitoring variables comprise a plurality of monitored monitoring variables related to the health state of a system; according to the system monitoring variables and the causal relationship, component-level degeneration state characterization is determined through a preset neural network model, and the component-level degeneration state characterization is used for indicating respective health states of multiple components of the system; and according to the component-level degradation state representation, anti-fact data conforming to a causal relationship is generated, the anti-fact data is used for data enhancement of an anomaly detection model, and the anomaly detection model is used for carrying out anomaly detection on the system. According to the embodiment of the invention, the data enhancement of the anomaly detection model is carried out through the causal-driven anti-fact data, and the generalization ability and stability of the anomaly detection model are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of anomaly detection technology, and in particular to a causal-driven counterfactual data generation and an application method, device and storage medium in anomaly detection. Background Art

[0002] With the rapid development of modern information technology, the process of industrial digitalization has accelerated, making it possible to effectively collect monitoring data that reflects the operating status of industrial systems or equipment, prompting the widespread application of data-driven methods in industrial system and equipment anomaly detection. Among them, supervised learning models with excellent fitting performance have attracted much attention and achieved many results.

[0003] However, the construction of high-performance anomaly detection models relies on a large amount of clean and complete historical monitoring data, which is difficult to meet in practical applications. For high-reliability industrial systems and equipment, the collected historical monitoring data is often incompletely distributed and the fault data is scarce. Directly using current data-driven methods usually cannot extract the true fault mechanism and characteristics from historical monitoring data, which causes the anomaly detection model to fail in new environments and working conditions. Summary of the invention

[0004] In view of this, the present disclosure proposes a causal-driven counterfactual data generation method, device and storage medium for its application in anomaly detection.

[0005] According to one aspect of the present disclosure, a causal-driven counterfactual data generation method and an application method thereof in anomaly detection are provided, the method comprising:

[0006] Determining a causal relationship between system monitoring variables according to the system monitoring variables, wherein the system monitoring variables include a plurality of monitoring variables monitored and related to a health status of the system;

[0007] Determining a component-level degradation state representation through a preset neural network model according to the system monitoring variables and the causal relationship, wherein the component-level degradation state representation is used to indicate the health state of each of the plurality of components of the system;

[0008] According to the component-level degradation state representation, counterfactual data that conforms to the causal relationship is generated, and the counterfactual data is used for data enhancement of anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the system.

[0009] In one possible implementation, the type of the system monitoring variable includes at least one of a system monitoring parameter, a system operating condition variable, and a system operating mode. The system monitoring parameter includes variables collected by a data collection device set at a specified position of the system. The system operating condition variable includes external condition variables and / or environmental variables of the system. The system operating mode is the operating mode adopted by the system when implementing its functions.

[0010] In another possible implementation, determining the causal relationship between the system monitoring variables according to the system monitoring variables includes:

[0011] According to the system monitoring variables, a fast causal inference (FCI) algorithm based on a priori constraints is used to determine the causal relationship between the system monitoring variables.

[0012] In another possible implementation, the prior constraints include:

[0013] There is no direct causal relationship between any one of the system operating condition variables and any one of the system operating modes, and / or there is no direct causal relationship between any two of the system operating condition variables.

[0014] In another possible implementation, the neural network model is a graph deconvolution network model, and the component-level degradation state representation is determined by a preset neural network model according to the system monitoring variables and the causal relationship, including:

[0015] Inputting the system monitoring variables and the causal relationship into the preset graph deconvolution network model, and outputting the component-level degradation state representation;

[0016] Wherein, the graph deconvolution network model is used to extract the component-level degradation state representation from the system monitoring variables and the causal relationship.

[0017] In another possible implementation, generating counterfactual data that conforms to the causal relationship according to the component-level degradation state representation includes:

[0018] According to the component-level degradation state representation, the system operating condition variables and the system operating mode, counterfactual data that conforms to the causal relationship is generated through a preset Causal Generative Adversarial Network (CGAN) model;

[0019] The counterfactual data include simulated system monitoring parameters, actual system operating condition variables, actual system operating mode and simulated system fault label data.

[0020] In another possible implementation, the CGAN model includes a generator and a discriminator, and the counterfactual data that conforms to the causal relationship is generated through a preset causal adversarial generative network CGAN model according to the component-level degradation state representation, the system operating condition variable and the system operating mode, including:

[0021] generating candidate counterfactual data by the generator according to the component-level degradation state representation, the system operating condition variable and the system operating mode;

[0022] In a case where the discriminator determines that the candidate counterfactual data conforms to the causal relationship, the candidate counterfactual data is output as the counterfactual data.

[0023] In another possible implementation, the method further includes:

[0024] Adding the counterfactual data to a training data set of the anomaly detection model;

[0025] The anomaly detection model is trained according to the added training data set to obtain the data-enhanced anomaly detection model.

[0026] According to another aspect of the present disclosure, a causal-driven counterfactual data generation and an application device thereof in anomaly detection is provided, the device comprising:

[0027] A first determination module is used to determine the causal relationship between the system monitoring variables according to the system monitoring variables, wherein the system monitoring variables include a plurality of monitoring variables monitored and related to the health status of the system;

[0028] a second determination module, configured to determine a component-level degradation state representation through a preset neural network model according to the system monitoring variable and the causal relationship, wherein the component-level degradation state representation is used to indicate the health state of each of the plurality of components of the system;

[0029] A generation module is used to generate counterfactual data that conforms to the causal relationship based on the component-level degradation state representation, and the counterfactual data is used for data enhancement of anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the system.

[0030] In one possible implementation, the type of the system monitoring variable includes at least one of a system monitoring parameter, a system operating condition variable, and a system operating mode. The system monitoring parameter includes variables collected by a data collection device set at a specified position of the system. The system operating condition variable includes external condition variables and / or environmental variables of the system. The system operating mode is the operating mode adopted by the system when implementing its functions.

[0031] In another possible implementation manner, the first determining module is further configured to:

[0032] According to the system monitoring variables, a FCI algorithm based on a priori constraints is adopted to determine the causal relationship between the system monitoring variables.

[0033] In another possible implementation, the prior constraints include:

[0034] There is no direct causal relationship between any one of the system operating condition variables and any one of the system operating modes, and / or there is no direct causal relationship between any two of the system operating condition variables.

[0035] In another possible implementation, the neural network model is a graph deconvolution network model, and the second determination module is further used to:

[0036] Inputting the system monitoring variables and the causal relationship into the preset graph deconvolution network model, and outputting the component-level degradation state representation;

[0037] Wherein, the graph deconvolution network model is used to extract the component-level degradation state representation from the system monitoring variables and the causal relationship.

[0038] In another possible implementation, the generating module is further used to:

[0039] According to the component-level degradation state representation, the system operating condition variables and the system operating mode, counterfactual data that conforms to the causal relationship is generated through a preset CGAN model;

[0040] The counterfactual data include simulated system monitoring parameters, actual system operating condition variables, actual system operating mode and simulated system fault label data.

[0041] In another possible implementation, the CGAN model includes a generator and a discriminator, and the generation module is further used to:

[0042] generating candidate counterfactual data by the generator according to the component-level degradation state representation, the system operating condition variable and the system operating mode;

[0043] In a case where the discriminator determines that the candidate counterfactual data conforms to the causal relationship, the candidate counterfactual data is output as the counterfactual data.

[0044] In another possible implementation, the device further includes: a training module, configured to:

[0045] Adding the counterfactual data to a training data set of the anomaly detection model;

[0046] The anomaly detection model is trained according to the added training data set to obtain the data-enhanced anomaly detection model.

[0047] According to another aspect of the present disclosure, a causal-driven counterfactual data generation and an application device in anomaly detection are provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0048] According to another aspect of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0049] According to another aspect of the present disclosure, a computer program product is provided, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of a computing device, the processor in the computing device executes the above method.

[0050] The disclosed embodiment provides a causal-driven counterfactual data generation method and its application in anomaly detection, by determining the causal relationship between system monitoring variables according to system monitoring variables, the system monitoring variables include multiple monitoring variables monitored and related to the health status of the system; according to the system monitoring variables and the causal relationship, a component-level degradation state representation is determined through a preset neural network model, and the component-level degradation state representation is used to indicate the health status of multiple components of the system; according to the component-level degradation state representation, counterfactual data that conforms to the causal relationship is generated, and the counterfactual data is used for data enhancement of anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the system; that is, by determining the causal relationship, extracting the component-level degradation state representation based on the causal relationship, generating counterfactual data that conforms to the causal relationship and other technical means, the technical problem that causal-driven counterfactual data cannot be generated when causal information is inaccurate is solved, and the data enhancement of the anomaly detection model based on the causal-driven counterfactual data is performed, so that the model can adapt to the influence of environmental changes, system upgrades, etc., and identify abnormal states not covered in historical monitoring data, thereby improving the generalization ability and stability of the anomaly detection model.

[0051] Further features and aspects of the present disclosure will become apparent from the following detailed description of exemplary embodiments with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate exemplary embodiments, features, and aspects of the disclosure and, together with the description, serve to explain the principles of the disclosure.

[0053] Figure 1 A flowchart of a method for generating causal-driven counterfactual data and applying the same in anomaly detection is shown according to an exemplary embodiment of the present disclosure.

[0054] Figure 2 A schematic diagram of a PAG involved in a method for causally driven counterfactual data generation and its application in anomaly detection provided by an exemplary embodiment of the present disclosure is shown.

[0055] Figure 3 A schematic diagram showing a causal relationship between any two nodes in a PAG provided by an exemplary embodiment of the present disclosure is shown.

[0056] Figure 4 A schematic diagram of a pseudo code for determining a skeleton based on path constraints provided by an exemplary embodiment of the present disclosure is shown.

[0057] Figure 5 A schematic diagram of a pseudo code for determining a PAG based on a direction constraint provided by an exemplary embodiment of the present disclosure is shown.

[0058] Figure 6 A schematic diagram showing the cause-effect relationship between different types of system monitoring variables of a system provided by an exemplary embodiment of the present disclosure is shown.

[0059] Figure 7 A schematic diagram of the structure of a graph deconvolution network model provided by an exemplary embodiment of the present disclosure is shown.

[0060] Figure 8 A flowchart of a process of generating counterfactual data through CGAN provided by an exemplary embodiment of the present disclosure is shown.

[0061] Fig. 9 A flowchart of a comparative experiment of different data enhancement methods provided by an exemplary embodiment of the present disclosure is shown.

[0062] Fig.10 A schematic diagram of the structure of a device for generating causal-driven counterfactual data and applying it in anomaly detection provided by an exemplary embodiment of the present disclosure is shown.

[0063] Fig.11 is a block diagram of a device provided according to an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0064] Various exemplary embodiments, features and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. The same reference numerals in the accompanying drawings represent elements with the same or similar functions. Although various aspects of the embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless otherwise specified.

[0065] The word “exemplary” is used exclusively herein to mean “serving as an example, example, or illustration.” Any embodiment described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other embodiments.

[0066] In addition, in order to better illustrate the present disclosure, numerous specific details are given in the following specific embodiments. It should be understood by those skilled in the art that the present disclosure can also be implemented without certain specific details. In some examples, methods, means, components and circuits well known to those skilled in the art are not described in detail in order to highlight the subject matter of the present disclosure.

[0067] In related technologies, it is often challenging to evaluate the effectiveness of improvement strategies at the model level (such as adjusting model parameters or using more powerful algorithms). However, at the data level, when the distribution of historical monitoring data is improved by generating simulated data (i.e., counterfactual data), the counterfactual data follows the meaning of the real monitoring data, so it can be verified based on the variable range, experience, etc. At present, some data generation methods for improving model training data have been proposed and applied to multiple fields including anomaly detection. For example, based on the Euclidean space distribution of the monitored real data, the synthetic minority over-sampling technique (SMOTE) can be used to generate counterfactual fault samples. The improved SMOTE method only oversamples the fault sample boundary to enhance the classification decision boundary. In addition, Adaptive Synthetic (ADASYN) adaptively moves the classification decision boundary by using weighted distributions for different fault samples. The emerging Generative Adversarial Network (GAN) can generate counterfactual data consistent with the distribution of real fault data through adversarial learning. However, most current studies focus on generating synthetic samples that are similar to the collected fault samples without considering the underlying causal mechanisms (data generation mechanisms) within the system, so the performance of anomaly detection models heavily depends on the quality of historical monitoring data.

[0068] In recent years, some researchers have begun to explore how causality promotes the generation of counterfactual data, but current research is mainly concentrated in the field of image recognition and is based on known and certain causal information. In practical applications, due to the lack of prior knowledge, it is often difficult to accurately mine and verify the causal information of complex industrial systems and equipment. The method of generating counterfactual data based on determining causal relationships cannot be extended to anomaly detection tasks. In addition, the advantages of data-driven methods are not fully considered at present, which is undoubtedly abandoning the research height and achievements of data-driven methods. Therefore, under the premise that causal information is inaccurate and cannot be verified, how to make causal relationships promote the generation of counterfactual data, the relevant technology has not yet provided a reasonable and effective technical solution.

[0069] In view of the technical problem that causal-driven counterfactual data cannot be generated based on current methods when the causal relationship is inaccurate in the related art, the embodiments of the present disclosure provide a causal-driven counterfactual data generation and its application method in anomaly detection to reduce the false alarm rate and missed alarm rate of anomaly detection and improve the safety of industrial systems and equipment. The proposed method can be applied to small sample anomaly detection, and is suitable for anomaly detection tasks of high-reliability systems such as electronic systems, electromechanical systems, and software systems, and can be extended to other small sample classification task scenarios.

[0070] The causal-driven counterfactual data generation method provided by the embodiment of the present disclosure includes three parts: causal information mining, causal mechanism decoupling, and counterfactual data generation. Causal information mining: Based on the FCI algorithm of prior constraints, the causal relationship between system monitoring variables is mined. Causal effect decoupling: Design a graph deconvolution network to decouple the influence (causal effect) between system monitoring variables and extract component-level degradation state representation. Counterfactual data generation: Design CGAN to generate counterfactual data that conforms to the causal relationship between system monitoring variables.

[0071] The application method of counterfactual data in anomaly detection includes data enhancement for anomaly detection models, that is, adding counterfactual data to the training data set to enhance the anomaly detection model, so that the model can adapt to the impact of environmental changes, system upgrades, etc., and identify abnormal states not covered in historical monitoring data, thereby improving the generalization performance and stability of the model. In addition, the generated counterfactual monitoring data corresponds to the actual monitoring characteristics and has practical significance. It can not only be compared with the real monitoring data to verify its effectiveness, but also analyze its own distribution characteristics based on expert knowledge.

[0072] Below, several exemplary embodiments are used to introduce the causal-driven counterfactual data generation and the application method in anomaly detection provided by the embodiments of the present disclosure.

[0073] Please refer to Figure 1 , which shows a flowchart of a method for generating causal-driven counterfactual data and applying it in anomaly detection provided by an exemplary embodiment of the present disclosure, and this embodiment is illustrated by using the method in a computing device. The method includes the following steps.

[0074] Step 101 : determining the causal relationship between system monitoring variables according to system monitoring variables, where the system monitoring variables include a plurality of monitoring variables monitored and related to the health status of the system.

[0075] The computing device obtains system monitoring variables, which include multiple monitoring variables collected from the system, such as temperature, pressure, vibration, etc. These data are actually observed and reflect the health status of the system. System monitoring variables can be collected in real time by a data acquisition device (such as a sensor), and data preprocessing techniques such as wavelet analysis, median filtering, Kalman filtering, etc. are used to improve data quality and reduce the impact of noise and interference. Among them, the system can be an electronic system, an electromechanical system, a software system, or other systems, which are not limited by the embodiments of the present disclosure.

[0076] In some embodiments, the type of system monitoring variables includes at least one of system monitoring parameters, system operating condition variables and system operating modes. The system monitoring parameters include variables collected by a data collection device set at a designated location of the system. The system operating condition variables include external condition variables and / or environmental variables of the system. The system operating mode is the operating mode adopted by the system when implementing its functions.

[0077] The computing device determines the causal relationship between the system monitoring variables based on the acquired system monitoring variables. The causal relationship refers to the logical relationship between variables, where the change of one variable is the cause of the change of another variable. In system monitoring, determining the causal relationship between variables helps to understand system behavior and predict system response.

[0078] In some embodiments, the computing device can determine the causal relationship between the system monitoring variables based on the system monitoring variables using the FCI algorithm based on prior constraints. The FCI algorithm is a constraint-based causal discovery algorithm, and the core concept is that different causal structures mean different independent relationships. The FCI algorithm can discover potential (unobserved) confounding factors, and when a "Y" structure is established in the graph, the causal relationship from X to Y is guaranteed not to be confused. In optimization problems, prior constraints refer to providing meaningful initial constraints for certain variables in the absence of sufficient observed data, making the optimization problem solvable. In the FCI algorithm, prior constraints can enhance the robustness of the optimization problem and help the optimizer obtain more accurate estimation results by providing known prior information for the variables in the graph.

[0079] In some embodiments, the a priori constraints include: there is no direct causal relationship between any system operating condition variable and any system operating mode, and / or there is no direct causal relationship between any two system operating condition variables.

[0080] It should be noted that the details of using the FCI algorithm based on prior constraints to determine the causal relationship between system monitoring variables can be found in the relevant description in the following embodiments, which will not be introduced here.

[0081] Step 102 : According to the system monitoring variables and the causal relationship, a component-level degradation state representation is determined through a preset neural network model. The component-level degradation state representation is used to indicate the health status of each of the plurality of components of the system.

[0082] The computing device decouples the causal mechanism based on the system monitoring variables and the causal relationship between the system monitoring variables through a preset neural network model to extract the component-level degradation state representation.

[0083] In some embodiments, the computing device inputs the system monitoring variables and causal relationships into a preset neural network model and outputs a component-level degradation state representation. The neural network model is pre-trained and is used to extract component-level degradation state representations from system monitoring variables and causal relationships. Causal mechanism decoupling refers to analyzing and understanding the causal relationships between system monitoring variables, separating these relationships from the data in order to better understand the behavior and dynamics of the system. The component-level degradation state representation is used to indicate the health status of multiple components of the system. The health status of multiple components of the system cannot be observed. The health status of multiple components of the system directly determines the system failure state and directly affects the system monitoring variables. The neural network model can be trained based on system monitoring variable samples and causal relationship samples, as well as component-level degradation state representation labels corresponding to the samples, based on the training method in the prior art.

[0084] In some embodiments, the neural network model may be a graph deconvolution network model, which is a deep learning model based on a graph structure and is used to process deconvolution problems in signals or data. Deconvolution is a mathematical operation used to recover the original signal from observed data, especially in the fields of signal processing and image processing. The graph deconvolution network model solves the deconvolution problem by learning the deep features of the data and improves the accuracy of signal recovery. The computing device determines the component-level degradation state representation through a preset neural network model based on the system monitoring variables and the causal relationship, which may include: inputting the system monitoring variables and the causal relationship into the preset graph deconvolution network model, and outputting the component-level degradation state representation, and the graph deconvolution network model is used to extract the component-level degradation state representation from the system monitoring variables and the causal relationship. That is, the input parameters of the graph deconvolution network are: the system monitoring variables and the causal relationship between the system monitoring variables, and the output parameters are: the component-level degradation state representation.

[0085] It should be noted that, for the sake of convenience, the following only takes the use of a graph deconvolution network model to determine a component-level degradation state representation as an example. The relevant details of this step can be referred to the relevant description in the following embodiment and will not be introduced here.

[0086] Step 103, based on the component-level degradation state representation, counterfactual data that conforms to the causal relationship is generated, the counterfactual data is used for data enhancement of the anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the system.

[0087] The computing device can generate counterfactual data that conforms to the causal relationship through a preset neural network model based on the component-level degradation state representation, and the neural network model is used to generate counterfactual data that conforms to the causal relationship based on the component-level degradation state representation. In some embodiments, counterfactual data that conforms to the causal relationship is generated through a preset neural network model based on the component-level degradation state representation, system operating condition variables, and system operating mode.

[0088] In some embodiments, the neural network model can be a CGAN model. The CGAN model is a deep learning model that can generate condition-dependent data. In anomaly detection, CGAN can be used to generate simulated data similar to actual observed data but containing abnormal features, i.e., counterfactual data, which can be used to enhance the training data set.

[0089] In some embodiments, the computing device can generate counterfactual data that conforms to the causal relationship based on the component-level degradation state representation, system operating condition variables and system operating mode through a preset CGAN model. The basic idea of ​​the CGAN model is to train two networks, the generator and the discriminator, so that the generator obtains candidate counterfactual data by sparsely operating the component-level degradation state representation, and the discriminator is responsible for judging whether the candidate counterfactual data conforms to the causal relationship. That is, the computing device can input the component-level degradation state representation, the system operating condition variables and the system operating mode into the preset CGAN model, and generate candidate counterfactual data through the generator; when the discriminator determines that the candidate counterfactual data conforms to the causal relationship, the candidate counterfactual data is output as counterfactual data.

[0090] Schematically, CGAN may include a generator and a discriminator, the generator including a graph decoder and a causal mechanism model, the graph decoder is used to generate simulated system monitoring parameters based on component-level degradation state representation, the causal mechanism model is used to generate simulated system fault label data based on component-level degradation state representation, system operating condition variables and system operating mode, the system fault label data is used to indicate whether the system is in a faulty state, the system fault label data may be record data of whether the system is in a faulty state, thereby generating simulated counterfactual data, namely candidate counterfactual data, the candidate counterfactual data including simulated system monitoring parameters, actual system operating condition variables, actual system operating mode and simulated system fault label data, the discriminator is used to determine whether the candidate counterfactual data conforms to the causal relationship, and when it is determined that the candidate counterfactual data conforms to the causal relationship, the candidate counterfactual data is output as counterfactual data.

[0091] It should be noted that, for the sake of convenience, the following only takes the use of the CGAN model to generate counterfactual data that conforms to the causal relationship as an example. The relevant details of this step can be referred to the relevant description in the following embodiment, which will not be introduced here.

[0092] Counterfactual data refers to data that does not exist in the training data set of the anomaly detection model but conforms to the causal relationship. This type of data predicts the possible results by assuming that certain conditions have changed. It can help understand how other variables will respond if a certain variable changes. In anomaly detection, counterfactual data can be data that may occur under certain conditions but did not actually occur. This data is used to simulate the behavior of the system in different situations to enhance the model's ability to identify abnormal situations. Counterfactual data can include simulated system monitoring parameters, system operating condition variables, system operating modes, and simulated system fault label data, that is, the system monitoring parameters and system fault label data in the counterfactual data are simulated data, and the system operating condition variables and system operating modes in the counterfactual data are actually observed data.

[0093] Counterfactual data is used for data augmentation of anomaly detection models, which is a technique to improve model performance by creating additional training samples. In anomaly detection models, data augmentation can help the model learn a more diverse data distribution, thereby improving the model's ability to identify anomalies. Anomaly detection models are machine learning models used to identify anomalies or unusual patterns in data. Anomaly detection models can be unsupervised or semi-supervised, and they are often used to identify outliers in data that may indicate errors, fraudulent behavior, or system failures.

[0094] In some embodiments, the computing device may add counterfactual data to a training data set of an anomaly detection model; train the anomaly detection model based on the added training data set to obtain a data-enhanced anomaly detection model.

[0095] The training dataset is the dataset used to train the anomaly detection model. In an anomaly detection model, the training dataset usually contains normal data and anomaly data. By adding counterfactual data to the training dataset, the diversity of the data can be increased and the generalization ability of the model can be improved. The data-enhanced anomaly detection model is an anomaly detection model that has been enhanced with counterfactual data. By adding counterfactual data during the training process, the model can learn a wider range of anomaly patterns, thereby improving its performance and robustness in practical applications.

[0096] After the anomaly detection model is trained, the application process of the anomaly detection model may include: obtaining real-time monitoring data of the system during operation; based on the real-time monitoring data, calling the pre-trained anomaly detection model, and outputting anomaly detection results, the anomaly detection results are used to indicate whether the system is in a fault state. Among them, based on the real-time monitoring data, calling the pre-trained anomaly detection model and outputting anomaly detection results may further include: pre-processing the real-time monitoring data to obtain pre-processed real-time monitoring data, inputting the pre-processed real-time monitoring data into the pre-trained anomaly detection model, and outputting anomaly detection results. The anomaly detection result is usually a probability value or a classification label, indicating that the system is in a normal or faulty state.

[0097] In some embodiments, interpretation and decision making can be performed based on the anomaly detection results output by the anomaly detection model. If an anomaly is detected, appropriate measures may need to be taken, such as sounding an alarm, automatically shutting down, performing maintenance, etc. In some embodiments, the anomaly detection model can be evaluated and iteratively improved based on actual system performance and maintenance records. This may include retraining the model to improve its accuracy and robustness. In some embodiments, the anomaly detection model is integrated into the system's monitoring system to achieve automated anomaly detection and response.

[0098] In summary, the embodiments of the present disclosure provide a method for generating causal-driven counterfactual data and applying it in anomaly detection, by determining the causal relationship between system monitoring variables according to system monitoring variables, wherein the system monitoring variables include multiple monitoring variables monitored and related to the health status of the system; according to the system monitoring variables and the causal relationship, a component-level degradation state representation is determined by a preset neural network model, and the component-level degradation state representation is used to indicate the health status of multiple components of the system; according to the component-level degradation state representation, counterfactual data that conforms to the causal relationship is generated, and the counterfactual data is used for data enhancement of the anomaly detection model, and the anomaly detection model is used to detect anomalies in the system; the scheme brings the following beneficial effects: 1. Generate causal-driven counterfactual data: by determining the causal relationship, extracting the component-level degradation state representation based on the causal relationship, generating counterfactual data that conforms to the causal relationship, and other technical means, the technical problem that causal-driven counterfactual data cannot be generated when the causal information is inaccurate is solved; 2. Improve the accuracy of anomaly detection: by generating counterfactual data that conforms to the causal relationship, the anomaly detection model can learn a more comprehensive data distribution, including data under normal and abnormal conditions, thereby improving the model's ability to recognize anomalies. 3. Enhance the generalization ability of the model: The addition of counterfactual data makes the training data set more diverse, which helps the model maintain good performance when facing unseen data and enhances the generalization ability of the model. 4. Improve the robustness of the model: The introduction of counterfactual data can help the model maintain stable performance when facing noise and outliers in the data, and improve the robustness of the model. 5. Optimize the model training process: The counterfactual data generated by the CGAN model can simulate the behavior of the system under different circumstances, which helps to optimize the model training process and make model training more efficient. 6. Improve the speed of anomaly detection: By optimizing the model training process, the speed of anomaly detection can be improved, so that the model can quickly respond to system anomalies and take timely measures.

[0099] The causal-driven counterfactual data generation method provided by the embodiment of the present disclosure includes three main parts: 1. FCI algorithm for mining prior constraints of system causal information; 2. Graph deconvolution network model for decoupling causal mechanism; 3. CGAN model for generating counterfactual data. The following is a further introduction to these three main parts.

[0100] Part 1: FCI algorithm for mining system causal information.

[0101] The input parameters of the FCI algorithm are: system monitoring variables, and the output parameters are: partial ancestral graph (PAG), which is used to indicate the causal relationship between system monitoring variables. The FCI algorithm can effectively mine causal information when the data is biased or there are confounding factors. Therefore, the FCI algorithm is used as a benchmark causal discovery algorithm in the embodiments of the present disclosure.

[0102] The output parameter of the FCI algorithm is usually a PAG. The schematic diagram of PAG is as follows Figure 2 As shown. PAG is a graph object used to represent a set of causal Bayesian networks (CBNs) that cannot be distinguished by the algorithm. In PAG, x and y represent variable nodes in the graph, and the relationship between them is represented by different types of edges, which reveal the causal relationship between system monitoring variables. The causal relationship between system monitoring variables includes: the causal relationship structure and causal relationship strength between system monitoring variables. The causal relationship structure between any two system monitoring variables can be one of a plurality of predefined causal relationship structures to identify the causal relationship between them; the causal relationship strength between any two system monitoring variables is used to indicate the size of the causal influence between any two system monitoring variables, reflecting the strength of the influence between them. The causal relationship between any two nodes in a PAG may exist as follows. Figure 3 There are five types shown (taking node i and node j as an example, i and j are both positive integers). Among them, there is no causal relationship between node i and node j: it means that there is no causal relationship between node i and node j. Node i is the ancestor node of node j: it means that node i is before node j in the causal chain. The causal direction of node i and node j cannot be determined: it means that the causal direction between node i and node j cannot be determined. Node i is the direct cause of node j: it means that node i directly affects node j. There is a confounding factor between node i and node j: it means that there is a confounding factor between node i and node j that may affect the causal relationship.

[0103] A PAG containing K nodes can be represented by a K×K dimensional matrix (called the causal adjacency matrix A):

[0104]

[0105] Where K is a positive integer, a ij (i≠j) is the indicative value of the causal relationship from node i to node j (different values ​​are used to represent different types of causal relationships). ii is defined as 0.

[0106] In addition, the embodiment of the present disclosure uses average causal effects (ACE) to quantitatively describe the strength of causal relationships and construct a causal strength matrix A: S as follows:

[0107]

[0108] where a S ij (i≠j) represents the strength of the causal relationship from node i to node j (the magnitude of the causal influence), a S ii is defined as 0.

[0109] In the embodiment of the present disclosure, for Figure 3 The five possible causal relationship structures in the PAG, the elements of the causal adjacency matrix and the causal strength matrix are ij and a S ij The definition of is shown in Table 1. Use the causal inference toolkit in Python to calculate ACE, and select the backdoor criterion (English: BackdoorCriterion) and linear regression method (English: Linear Regression) in the preset function (such as the model.estimate_effect function). In this example, "backdoor.linear_regression" specifies the use of the backdoor criterion and linear regression method to estimate ACE. This method can effectively control the confounding bias and obtain a more accurate causal effect estimate.

[0110] Table 1

[0111]

[0112] Considering that prior knowledge is usually limited and it is often difficult to determine that there is absolutely no causal relationship (including direct and indirect causal relationship) between two variables, the prior constraints designed and added in causal discovery in the embodiments of the present disclosure are divided into the following two types (taking nodes i and j as examples):

[0113] Path constraint: also called "direct causal relationship constraint". In the embodiment of the present disclosure, path constraints are divided into two types: there is a direct causal relationship between node i and node j (represented as a positive path constraint); there is no direct causal relationship between node i and node j (represented as a negative path constraint). The set consisting of all node groups (i, j) with positive path constraints is represented as the positive path constraint set L+, and the set consisting of node groups (i, j) with negative path constraints is represented as the negative path constraint set L-.

[0114] Directional constraint: Constrain node i to be the ancestor node of node j, that is, node i is the direct cause or indirect cause of node j. In the causal network, there is only a causal path from node i to node j. Here, the causal path refers to the combination of link edges from the cause node to the result node, including direct causal paths and indirect causal paths. The set of all direction-constrained node groups (i, j) is represented as a direction constraint set.

[0115] By limiting the search space of the FCI algorithm and adding prior constraints, we can not only obtain a more realistic causal network, but also reduce the amount of calculation to a certain extent. The causal discovery process by limiting the search space and adding prior constraints is also divided into two steps, as shown below:

[0116] The pseudo code for determining the skeleton based on path constraints is as follows Figure 4 As shown, this pseudocode describes an algorithm for determining a skeleton C and a separation set S based on path constraints. The following is a natural language description of the various steps of the pseudocode:

[0117] 1. Input node set (variable set) V, positive path constraint set L+, negative path constraint set L-. These sets define the relationship between nodes. Positive path constraint means there is a direct path between two nodes, and negative path constraint means there is no direct path between two nodes.

[0118] 2. Output the skeleton C and the separation set S. The skeleton C is the processed graph, and the separation set S means that in the skeleton C, for each pair of directly related nodes Vi and Vj (denoted as edge (i, j)), there is a specific node set that can cut off or block the direct connection between Vi and Vj. In other words, the separation set S contains all such node sets that can make the originally directly connected node pairs no longer directly related after considering the influence of these node sets. In short, the separation set S is the sum of the node sets corresponding to all the connecting edges in the skeleton C, and these node sets can separate the directly connected node pairs (i, j).

[0119] 3. Establish a completely undirected graph that contains all nodes in the node set V, and there is an edge between any two nodes.

[0120] 4. Delete all the corresponding edges in the positive path constraint set L+ and the negative path constraint set L-. This means that if there is a positive path constraint between two nodes, the edge between them will be deleted; if there is a negative path constraint, the edge between them will also be deleted.

[0121] 5. Initialize variable l to -1 and C to the empty set.

[0122] 6. Start a loop that will repeat until a certain condition is met.

[0123] 7. At the beginning of each loop, increase the value of l by 1.

[0124] 8. Start another loop, which will be repeated until all undirected edge node groups (i, j) in C are traversed.

[0125] 9. In this cycle, select a new pair of undirected edge node groups (i, j) in the skeleton C, and the number of connected nodes of node i except node j is greater than or equal to l.

[0126] 10. Start an inner loop that will be repeated until all possible subsets k of the node set V are traversed.

[0127] 11. Select a new subset k, the node set k contains l elements.

[0128] 12. If nodes i and j are independent under the given conditions (i.e., the edge between them can be deleted), then proceed to the next step.

[0129] 13. Delete undirected edges And define the new graph as skeleton C. This means that node i and node j are no longer directly connected.

[0130] 14. Save the node set k into the separation set S(i,j) from i to j and the separation set S(j,i) from j to i. This means that k is the node set that makes i and j independent.

[0131] 15. If nodes i and j are not independent, continue to check the next subset k.

[0132] 16. Until the undirected edge is deleted or all possible subsets k are traversed.

[0133] 17. Until all undirected edge node groups (i, j) in C are traversed.

[0134] 18. If the conditions are met for all undirected edge node groups (i, j) in C, the loop ends.

[0135] 19. Add all the edges corresponding to the positive path constraint set L+ to the skeleton C. This means adding the edges corresponding to the positive path constraints that were previously deleted back to the graph.

[0136] The pseudo code for determining PAG based on directional constraints is as follows Figure 5 As shown, this pseudocode describes an algorithm for determining PAG based on directional constraints. The following is a natural language description of the various steps of the pseudocode:

[0137] 1. Input: The algorithm receives three inputs: skeleton C, separation set S, and orientation constraint set The skeleton C is the graph structure determined based on the path constraints. The separation set S contains the set of nodes that can separate certain node pairs. The direction constraint set Contains information about the directionality between nodes.

[0138] 2. Output: The output of the algorithm is PAG G, which is a directed graph in which the edges represent the causal relationship between variables.

[0139] 3. Traverse the groups of nodes that are not directly connected: The algorithm traverses all pairs of nodes (i, j) that are not directly connected in the skeleton C, as well as their common neighbor nodes k.

[0140] 4. Check conditions: For each such node group (i, j) and k, the algorithm checks whether there is a condition that determines that there is a directional relationship between nodes i and j.

[0141] 5. Replace edge: If the conditions are met, the algorithm replaces the undirected edge in the skeleton C. Replace with directed edges And define the resulting graph as G.

[0142] 6. End condition check: This step is the end of the previous step, indicating that the condition check and edge replacement of all indirect connected node groups have been completed.

[0143] 7. End traversal: Complete the traversal of all pairs of nodes that are not directly connected.

[0144] 8. Traverse the node groups corresponding to the direction constraints: The algorithm traverses all the node groups in the direction constraint set. The node pairs (i, j) specified in , and the path p between them.

[0145] 9. Path check: If the path p contains only undirected edges Directed Edge and “→”, then all undirected edges in path p are oriented as

[0146] 10. Processing includes Path: If the path p contains type of edge, the algorithm will Oriented to And orient all undirected edges in path p as

[0147] 11. Processing paths containing “←”: If the path p contains an edge of type “←”, the algorithm needs to return to the first step, adjust the parameters of the conditional independence test, or delete the edge with the smallest causal strength in the path p to block the path p.

[0148] 12. End path check: complete the check of all paths.

[0149] 13. End traversal of direction constraints: complete the traversal of all direction constraints.

[0150] 14. Apply the FCI algorithm: In the obtained graph G, orient as many undirected edges as possible by repeatedly applying the 10 orientation rules R1-R10 of PAG determined in the FCI algorithm.

[0151] Usually, the prior constraints are derived from prior knowledge such as expert experience and physical knowledge. Considering that in practical applications, it is possible that the prior knowledge of the target system is too scarce to obtain an effective prior constraint set, the embodiment of the present disclosure proposes a method for constructing a prior constraint set based on data.

[0152] Assume that the target system observes data D = [V, Y], V ∈ R N×K is a system monitoring variable related to the health status of the system, Y∈R N×1 is the system fault label data, that is, the record data of whether the system is in a fault state, the target system observation data includes N samples, and the system monitoring variables include K variables, where N and K are both positive integers. In this embodiment, the multiple variables V included in the system monitoring variables can be 1 ,V 2 ,...,V K ) is divided into three categories: system monitoring parameters η, system operating condition variables C and system operating mode M. Among them, system monitoring parameters refer to variables collected by data collection devices (such as sensors) set at designated locations of the system based on expert experience. System operating condition variables refer to the collected system exogenous variables, that is, the external condition variables and / or environmental variables of the system. The system operating mode refers to the operating mode (that is, the operation or setting mode) when it realizes different functions, which is usually determined by relevant staff based on actual needs and experience. Multiple variables V can be arranged in the order of system monitoring parameters η, system operating condition variables C and system operating mode M, that is, η=(η 1 ,η 2 ,...,η H )=(V 1 ,V 2 ,...,V H ), C=(C 1 ,C 2 ,...,C Q )=(VH+1 ,V H+2 ,...,V H+Q ), M=V H+Q+1 =V K , where the system monitoring parameters η include H, the system operating condition variables C include Q, and both H and Q are positive integers.

[0153] Schematically, based on the classified variable categories, the causal relationship between different types of system monitoring variables can be described as Figure 6 The general structure shown. The variables in the solid box (i.e., the system monitoring parameter η, the system operating condition variable C, and the system operating mode M) are usually observable and collectable, while the variables in the dotted box (i.e., the health status U of each component) cannot be observed. The health status U of each component includes H', where H' is a positive integer. Among them, the health status of each component directly determines the fault state of the complex system and directly affects the system monitoring variables. The system operating mode and the system operating condition variables affect the system monitoring parameters by affecting the action relationship between components (i.e., the causal relationship structure and strength). Different system operating modes often correspond to different combinations and connection relationships of components in the system, so that the system can achieve different functions. Different system operating condition variables will affect the frequency and intensity of interaction between components. In addition, it is often impossible to determine that the system operating mode and the system operating condition variables will inevitably affect all system monitoring parameters.

[0154] Taking the system as a high-speed rail electromechanical control system as an example, the health status of each component cannot be observed but directly affects the system fault state. System operating condition variables, such as external temperature, humidity, required speed, input voltage, etc., represent the application environment instantaneously monitored by the electromechanical system, and therefore will not affect the health status of each component, but will affect the system monitoring parameters (such as line current, internal temperature). The system operation mode corresponds to the functions implemented by the electromechanical system. Usually, the train driver selects different operation modes according to mileage, stations, emergencies, etc., so there is no causal relationship between the system application environment, and it will not affect the health status of each component, but it will affect the system monitoring parameters. In some embodiments, the system monitoring parameters include multiple state monitoring values, and there is a one-to-one correspondence between the multiple state monitoring values ​​and the multiple components, that is, each state monitoring value is used to uniquely indicate the health status of a component.

[0155] In the disclosed embodiment, the prior constraints obtained based on the data only have negative path constraints, that is, they can only determine which system monitoring variables do not have direct causal relationships. Therefore, based on the causal relationship between different types of system monitoring variables in the above system, the following prior constraints can be constructed:

[0156] 1. There is no direct causal relationship between any system operating condition variable and the system operating mode, that is, the node pairs (H+1,K), (H+2,K),..., (H+Q,K) are all elements in the negative path constraint L-; and / or, 2. There is no direct causal relationship between any two system operating condition variables, that is, for any node pair (s,t), as long as H+Q≥s,t≥H+Q and s≠t are satisfied, these node pairs are all elements in the negative path constraint L-, where s and t are both positive integers.

[0157] Part 2, graph deconvolution network model for decoupled causal mechanisms.

[0158] In a single system operation mode and system operation condition, when it is assumed that the electromechanical system contains H' = H components and each component has only one state monitoring value, H is a positive integer, and it is assumed that the structural causal equations between components are linear regression equations, and the component-level degradation state representation U' = [U 1 ′,U 2 ′,...,U′ H ] to simplify the causal mechanism, the causal relationship of the system (i.e., the generation mechanism of the system monitoring parameter η) can be expressed as:

[0159]

[0160] Among them, A S It is the causal strength matrix of the whole system. The causal strength matrix is ​​used to indicate the causal relationship (i.e., causal relationship structure and causal relationship strength) between multiple system monitoring parameters of the system. I is the unit matrix.

[0161] When the causal relationships among multiple system monitoring parameters are all linear, according to the causal relationship (i.e., the generation mechanism of the system monitoring parameter η shown in the above formula), the process of decoupling the component-level degradation state representation is as follows:

[0162] U′=η(Ι-A S )

[0163] In order to prevent the change in dimension from affecting the fault information in the data, generally, we hope that the characterization learning process does not change the dimension of the data. Therefore, the embodiment of the present disclosure normalizes the above formula as shown below:

[0164]

[0165] in is a diagonal matrix whose i-th row and i-th column elements are (i.e. A S The sum of the elements in the jth row of ), and all other elements are 0. It is called the causal intensity matrix A S The degree matrix of .

[0166] The disclosed embodiments use linear causal models multiple times to fit the nonlinear causal relationships that are prevalent in anomaly detection tasks, and decouple component-level degradation state representation from system monitoring parameters. In some embodiments, the structure diagram of the deconvolution network model is shown in FIG. Figure 7 As shown in Figure 2, the core idea of ​​the graph deconvolution network model is to expand the graph convolution operation in the frequency domain, and then process the frequency domain representation of the graph through a series of causal decoupling layers, where the jth causal decoupling layer is j The operation process is as follows:

[0167]

[0168] Among them, L j and L j+1 They are the jth causal decoupling layer of the graph deconvolution network model. j Input parameters and output parameters of W j ∈R H×H It is Layer j The trainable weight matrix of .

[0169] The optimization goal of the graph deconvolution network is to make the decoupled causal representation vector explainable to the system operation mode and system fault state. Explainability here means that the obtained component-level degradation state representation vector can distinguish different system operation modes and system fault states. The loss function of the proposed graph deconvolution network is DA for:

[0170] Loss DA =-silhouette_score(U′,YM)

[0171] Among them, YM is a variable obtained by label encoding the combination of system fault label data Y and system operation mode M, indicating how many forms of combinations of Y and M there are; silhouette_score() is a function for calculating the average silhouette coefficient, which can be directly calculated by the silhouette_score() function in the Python toolkit sklearn.metrics.

[0172] By optimizing the number of layers of the graph deconvolution network and the feature weight matrix of each layer to minimize the loss function, the component-level degradation state representation U′ can be obtained. This process involves adjusting the network structure and parameters to ensure that the representation vector output by the model has high interpretability in distinguishing different system states.

[0173] Part III, CGAN for generating counterfactual data.

[0174] CGAN can include a generator G and a discriminator D. The generator can include a graph decoder η′=g(U′) and a causal mechanism model Y=f′(U′,C,M), while the discriminator determines whether the generated data conforms to the causal relationship of the system based on the preset FCI algorithm. Generally speaking, it is required that the counterfactual data should not differ too much from the actual data, otherwise it is difficult to evaluate its credibility. Considering that the instantaneous monitoring value of environmental factors has little impact on the system fault state, and the system operation mode is fixed. Therefore, in the generator, the counterfactual data is generated by sparsely operating the component-level degradation state representation U′. This sparse operation involves randomly selecting one or more features in the component-level degradation state representation U′ and replacing them with white noise. The purpose of this method is to simulate various abnormal situations that may be encountered in practical applications, thereby enhancing the adaptability and robustness of the model to different system states. When the discriminator determines that the generated data does not conform to the causal relationship of the system, the sparse operation mode is improved, that is, the random mapping mechanism is restarted. This method increases the diversity and uncertainty of the data generation process by replacing the selected features and the injected white noise. In this way, richer counterfactual data that is closer to actual application scenarios can be generated.

[0175] In some embodiments, a graph decoder is designed and trained to restore the component-level degradation state representation U′ to the simulated system monitoring parameters. The graph decoder has the same number of layers as the trained graph deconvolution network to ensure structural consistency during the decoding process. The i-th layer of the graph decoder can be expressed as:

[0176]

[0177] Among them, L i and L i+1 are the input parameters and output parameters of the i-th layer of the graph decoder, W i ′ is the trainable weight matrix of the i-th layer.

[0178] The graph decoder optimizes W i ′ is trained to minimize the gap between the actual system monitoring parameter η and the system monitoring parameter η′ output by the decoder. The loss function Loss of the decoder is 2 for:

[0179] Loss 2 =||η-η′|| 2

[0180] Where || ||2 is the L of the matrix 2 -norm, which represents the sum of squares of non-zero elements in the matrix. This loss function measures the error between the actual system monitoring parameters and the system monitoring parameters output by the decoder, and the graph decoder is trained by minimizing this error.

[0181] After training, the obtained graph decoder is denoted as η′=g(U′). This trained graph decoder can accurately convert component-level degradation state representation back to simulated system monitoring parameters, providing a powerful tool for system health monitoring and fault diagnosis.

[0182] In some embodiments, a causal mechanism model may be defined as:

[0183] Y=f′(U′,C,M)

[0184] Considering that the optimization goal of the component-level degradation state representation U′ is to cluster the samples in the data [U′, YM] according to different YMs, the obtained U′ has a high separability, and there is no need to use a complex machine learning model to fit the mapping relationship between it and Y. The embodiment of the present disclosure uses a single-layer perceptron training to obtain a causal mechanism model Y=f′(U′, C, M).

[0185] In some embodiments, the loss function of CGAN is 3 as follows:

[0186] Loss 3 =||A″-A|| 2

[0187] Where A is the causal adjacency matrix of the system monitoring variables, A″ is the causal adjacency matrix obtained by using the FCI algorithm based on counterfactual data, and || ||2 is the L matrix of the matrix 2 -norm, which represents the sum of the squares of the non-zero elements in the matrix.

[0188] To avoid the impact of data volume on the discrimination process (i.e., the process of determining whether counterfactual data conforms to the causal network), the sample size of counterfactual data generated by the generative adversarial network is set to be the same as the sample size of the original data. When a large amount of counterfactual data is needed, it can be obtained in batches by running the causal generative adversarial network multiple times.

[0189] In some embodiments, a flowchart of the process of generating counterfactual data by CGAN is as follows: Figure 8As shown. The process includes the following steps: 1. Obtain input parameters (U′, C, M), that is, the input parameters include component-level degradation state representation U′, system operating condition variable C and system operating mode M. 2. Sparsely operate the features in U′. This operation involves selecting one or more features in U′ and replacing them with white noise to simulate the uncertainty or abnormality in the data, thereby obtaining data (U″, C, M), where U″ represents the data after sparse operation. 3. Input the data (U″, C, M) into the generator G, and output the counterfactual data (η″, C, M, Y″), where the generator includes a graph decoder and a causal mechanism model. The graph decoder is used to generate the simulated system monitoring parameter η″ according to the component-level degradation state representation U′, and the causal mechanism model is used to generate the simulated system fault label data Y″ according to the component-level degradation state representation U′, the system operating condition variable C and the system operating mode M. 4. Input the counterfactual data (η″, C, M, Y″) into the discriminator D, which judges whether the generated counterfactual data conforms to the causal relationship of the system based on the classic FCI algorithm. 5. If the generated counterfactual data conforms to the causal relationship of the system relationship, then these data are considered to be valid counterfactual data and can be output for further analysis or application. 6. If the generated counterfactual data does not conform to the causal relationship of the system, these data will be rejected, and it is necessary to improve the operation mode, adjust its parameters and regenerate the data until the generated data can pass the evaluation of the discriminator. The whole process is an iterative process. The generator and the discriminator constantly compete with each other during the training process. The generator tries to generate more and more realistic data, while the discriminator tries to more accurately identify which data is real and which is generated. In this way, CGAN is able to learn to generate high-quality counterfactual data that meets specific conditions and system causal relationships.

[0190] In an illustrative example, based on a simulation dataset D of an aircraft-borne electromechanical system with an imbalanced category, ( ' 10) , D ( ' 20) , D ( ' 30) , D ( ' 50) , D ( ' 100) , verifying the effectiveness of the causal-driven counterfactual data generation method provided by the embodiment of the present disclosure, the flowchart of the comparative experiment of different data enhancement methods is as follows Fig. 9As shown. The process includes the following steps: 1. Obtain observation data of complex electromechanical systems. 2. Necessary data preprocessing: including cleaning data, handling missing values, standardizing or normalizing features, etc., to ensure that the data is suitable for training models. 3. Training set preparation: The data is divided into multiple training sets, which are listed as training set 1, training set 2, and training set 10. These training sets can be used for different model training or for cross-validation. 4. Generate data: Generate additional data to enhance the training set, which are listed as generated data 1, generated data 2, and generated data 10. These data can be obtained through data enhancement methods to improve the generalization ability of the model. 5. Test set preparation: Similar to the training set, the test set is also divided into multiple, including test set 1, test set 2, and test set 10. These test sets are used to evaluate the performance of the model. 6. Processing of different fault diagnosis models: Use different fault diagnosis models to train and test the data. Different fault diagnosis models may include: Logistic Regression (LR), K-Nearest Neighbors (KNN) algorithm and Support Vector Machine (SVM). 7. Model evaluation: Evaluate the performance of these models on the test set. The evaluation indicators include the mean precision, the variance of precision, the mean recall and the variance of recall. The mean precision refers to the average value of the precision calculated in multiple experiments; the variance of precision refers to the variance of the precision values ​​calculated in multiple experiments, which reflects the fluctuation of the precision values; the mean recall refers to the average value of the recall values ​​calculated in multiple experiments; the variance of recall refers to the variance of the recall values ​​calculated in multiple experiments, which reflects the fluctuation of the recall values. The whole process starts with data preprocessing, goes through model training and testing, and finally evaluates the performance of the model through statistical analysis of accuracy and recall.

[0191] In order to verify the effect of using associated counterfactual data for data enhancement, the commonly used data enhancement methods: SMOTE, Borderline-SMOTE1, Borderline-SMOTE2, ADASYN and classic GAN are used as comparison methods. When comparing the impact of adding different data to the training process (i.e., incorporating them into the training set) on the generalization performance of the model, it is usually necessary to use an off-the-shelf classification algorithm as an anomaly detection model to avoid the impact of flexible and uncertain fitting relationships in the algorithm on the results. Therefore, LR, KNN and SVM algorithms are used as benchmark anomaly detection models.

[0192] Tables 2, 3, 4, 5 and 6 show the results of different data augmentation methods on the simulation dataset D of the aircraft-borne electromechanical system.( ' 10) , D ( ' 20) , D ( ' 30) , D ( ' 50) , D ( ' 100) The comparison results of generalization effects on . The models shown in the table are combinations of different data augmentation methods and different anomaly detection models. For example, SMOTE-LR is an anomaly detection model built using the LR algorithm after generating data based on SMOTE. LR, KNN, and SVM are anomaly detection models that do not use data augmentation methods. LR*, KNN*, and SVM* are anomaly detection models built using the LR, KNN, and SVM algorithms after data augmentation using associated counterfactual data. Among them, the generalization effect is evaluated using a variety of evaluation indicators, including mean precision, variance of precision, mean recall, and variance of recall.

[0193] Table 2

[0194]

[0195]

[0196] Table 3

[0197] Model Mean precision Precision Variance Mean recall Recall Variance LR 0.6324 0.0033 0.5854 0.0080 LR* 0.7884 0.0003 0.7085 0.0009 SMOTE-LR 0.6306 0.0041 0.5860 0.0056 BorderlineSMOTE1-LR 0.6229 0.0052 0.5690 0.0078 BorderlineSMOTE2-LR 0.6263 0.0052 0.5566 0.0078 ADASYN-LR 0.6329 0.0084 0.5437 0.0086 GAN-LR 0.6268 0.0094 0.5710 0.0076 KNN 0.6209 0.0085 0.5747 0.0066 KNN* 0.7740 0.0009 0.7066 0.0007 SMOTE-KNN 0.6330 0.0092 0.5982 0.0029 BorderlineSMOTE1-KNN 0.6246 0.0093 0.6084 0.0063 BorderlineSMOTE2-KNN 0.6106 0.0020 0.6341 0.0046 ADASYN-KNN 0.6269 0.0022 0.6062 0.0038 GAN-KNN 0.6234 0.0018 0.5987 0.0039 SVM 0.6606 0.0020 0.5321 0.0049 SVM* 0.7518 0.0007 0.7286 0.0008 SMOTE-SVM 0.5959 0.0014 0.6134 0.0056 BorderlineSMOTE1-SVM 0.6068 0.0013 0.5962 0.0093 BorderlineSMOTE2-SVM 0.5856 0.0014 0.6247 0.0095 ADASYN-SVM 0.5982 0.0070 0.6214 0.0098 GAN-SVM 0.5995 0.0069 0.6082 0.0127

[0198] Table 4

[0199] Model Mean precision Precision Variance Mean recall Recall Variance LR 0.5976 0.0082 0.6407 0.0075 LR* 0.7625 0.0003 0.7597 0.0004 SMOTE-LR 0.6144 0.0021 0.6533 0.0101 BorderlineSMOTE1-LR 0.6097 0.0009 0.6592 0.0122 BorderlineSMOTE2-LR 0.6148 0.0013 0.6484 0.0123 ADASYN-LR 0.6184 0.0050 0.6207 0.0114 GAN-LR 0.5985 0.0053 0.6055 0.0127 KNN 0.5858 0.0088 0.6022 0.0149 KNN* 0.7561 0.0014 0.7030 0.0010 SMOTE-KNN 0.5990 0.0109 0.5749 0.0092 BorderlineSMOTE1-KNN 0.6099 0.0101 0.5813 0.0079 BorderlineSMOTE2-KNN 0.6163 0.0103 0.6077 0.0043 ADASYN-KNN 0.6363 0.0072 0.6236 0.0041 GAN-KNN 0.6459 0.0068 0.6189 0.0036 SVM 0.7146 0.0046 0.6078 0.0021 SVM* 0.7765 0.0006 0.7559 0.0003 SMOTE-SVM 0.6143 0.0067 0.6521 0.0072 BorderlineSMOTE1-SVM 0.6111 0.0068 0.6422 0.0102 BorderlineSMOTE2-SVM 0.5875 0.0068 0.6263 0.0126 ADASYN-SVM 0.5832 0.0068 0.6308 0.0130 GAN-SVM 0.6009 0.0124 0.6093 0.0122

[0200] Table 5

[0201]

[0202]

[0203] Table 6

[0204]

[0205]

[0206] It can be seen that for unbalanced simulation data, the generalization performance of current simple classifiers (LR, KNN, and SVM) is poor. Commonly used data augmentation methods: SMOTE, Borderline-SMOTE1, Borderline-SMOTE2, ADASYN, and classic GAN can all improve the generalization performance of the model, but it is difficult to conclude that "these methods can improve the stability of the model" based on this case. In fact, the stability of these commonly used data augmentation methods usually depends on the distribution difference between the training set and the test set.

[0207] However, when the model constructed based on the method of generating associated counterfactual data (i.e., LR*, KNN*, SVM*) is used, it can be found that the average values ​​of these models in terms of precision and recall are the highest, and the variance is the smallest. This shows that the data enhancement technology combined with the method provided in the embodiment of the present disclosure can not only significantly improve the generalization performance of the anomaly detection model, but also has high stability. This finding has been verified on simulation data sets of different complexity, thereby confirming the effectiveness of the scheme provided in the embodiment of the present disclosure, and further showing that the data enhancement method based on counterfactual data generation has wide applicability.

[0208] The following is an apparatus embodiment of the present disclosure. For parts not described in detail in the apparatus embodiment, reference may be made to the technical details disclosed in the above method embodiment.

[0209] Please refer to Fig.10 , which shows a schematic diagram of the structure of a device for generating causal-driven counterfactual data and its application in anomaly detection provided by an exemplary embodiment of the present disclosure. The device can be implemented in whole or in part by software, hardware, or a combination of the two, which is called a computing device. The device includes: a first determination module 1010, a second determination module 1020, and a generation module 1030.

[0210] A first determination module 1010 is used to determine the causal relationship between system monitoring variables according to system monitoring variables, where the system monitoring variables include a plurality of monitoring variables monitored and related to the health status of the system;

[0211] A second determination module 1020 is used to determine a component-level degradation state representation through a preset neural network model according to the system monitoring variables and the causal relationship, where the component-level degradation state representation is used to indicate the health state of each of the plurality of components of the system;

[0212] The generation module 1030 is used to generate counterfactual data that conforms to the causal relationship according to the component-level degradation state representation. The counterfactual data is used for data enhancement of the anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the system.

[0213] In one possible implementation, the type of system monitoring variables includes at least one of system monitoring parameters, system operating condition variables and system operating modes. The system monitoring parameters include variables collected by a data collection device set at a designated location of the system. The system operating condition variables include external condition variables and / or environmental variables of the system. The system operating mode is the operating mode adopted by the system when implementing its functions.

[0214] In another possible implementation, the first determining module 1010 is further configured to:

[0215] According to the system monitoring variables, the FCI algorithm based on prior constraints is used to determine the causal relationship between the system monitoring variables.

[0216] In another possible implementation, the prior constraints include:

[0217] There is no direct causal relationship between any system operating condition variable and any system operating mode, and / or there is no direct causal relationship between any two system operating condition variables.

[0218] In another possible implementation, the neural network model is a graph deconvolution network model, and the second determination module 1020 is further configured to:

[0219] The system monitoring variables and causal relationships are input into the preset graph deconvolution network model, and the component-level degradation state representation is output;

[0220] Among them, the graph deconvolution network model is used to extract component-level degradation state representation from system monitoring variables and causal relationships.

[0221] In another possible implementation, the generating module 1030 is further configured to:

[0222] Based on the component-level degradation state representation, system operating condition variables and system operating mode, the preset CGAN model is used to generate counterfactual data that conforms to the causal relationship;

[0223] Among them, the counterfactual data includes simulated system monitoring parameters, actual system operating condition variables, actual system operating mode and simulated system fault label data.

[0224] In another possible implementation, the CGAN model includes a generator and a discriminator, and the generation module 1030 is further used to:

[0225] Generate candidate counterfactual data through a generator according to component-level degradation state representation, system operating condition variables, and system operating mode;

[0226] When the discriminator determines that the candidate counterfactual data conforms to the causal relationship, the candidate counterfactual data is output as the counterfactual data.

[0227] In another possible implementation, the apparatus further includes: a training module, configured to:

[0228] Add counterfactual data to the training dataset of the anomaly detection model;

[0229] The anomaly detection model is trained according to the added training data set to obtain a data-enhanced anomaly detection model.

[0230] It should be noted that the device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example to implement its functions. In practical applications, the above-mentioned functions can be assigned to different functional modules according to actual needs, that is, the content structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0231] Regarding the device in the above embodiment, the specific manner in which each module performs operations has been described in detail in the embodiment of the method, and will not be elaborated here.

[0232] An embodiment of the present disclosure further provides a computing device, the device comprising: a processor; a memory for storing instructions executable by the processor; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0233] The embodiment of the present disclosure also provides a non-volatile computer-readable storage medium on which computer program instructions are stored. When the computer program instructions are executed by a processor, the above method is implemented.

[0234] The embodiments of the present disclosure also provide a computer program product, including a computer-readable code, or a non-volatile computer-readable storage medium carrying the computer-readable code. When the computer-readable code runs in a processor of a computing device, the processor in the computing device executes the above method.

[0235] Fig.11 1 is a block diagram of an apparatus 1900 provided according to an exemplary embodiment of the present disclosure. For example, the apparatus 1900 may be provided as a server or a terminal device, and may include the above-mentioned causal-driven counterfactual data generation and its application apparatus in anomaly detection. Fig.11, the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0236] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output interface 1958 (I / O interface). The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™ or the like.

[0237] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0238] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0239] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0240] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0241] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0242] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0243] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0244] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0245] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0246] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A causally driven counterfactual data generation method and its application in anomaly detection, characterized in that: The method comprises: Determining a causal relationship between system monitoring variables according to the system monitoring variables, wherein the system monitoring variables include a plurality of monitoring variables monitored and related to a health status of the system; Determining a component-level degradation state representation through a preset neural network model according to the system monitoring variables and the causal relationship, wherein the component-level degradation state representation is used to indicate the health state of each of the plurality of components of the system; According to the component-level degradation state representation, counterfactual data that conforms to the causal relationship is generated, and the counterfactual data is used for data enhancement of anomaly detection model, and the anomaly detection model is used to perform anomaly detection on the system.

2. The method according to claim 1, characterized in that The types of the system monitoring variables include at least one of system monitoring parameters, system operating condition variables and system operating modes. The system monitoring parameters include variables collected by a data collection device set at a specified position of the system. The system operating condition variables include external condition variables and / or environmental variables of the system. The system operating mode is the operating mode adopted by the system when implementing its functions.

3. The method according to claim 2, characterized in that Determining the causal relationship between the system monitoring variables according to the system monitoring variables includes: According to the system monitoring variables, a fast causal inference (FCI) algorithm based on prior constraints is used to determine the causal relationship between the system monitoring variables.

4. The method according to claim 3, characterized in that The prior constraints include: There is no direct causal relationship between any one of the system operating condition variables and any one of the system operating modes, and / or there is no direct causal relationship between any two of the system operating condition variables.

5. The method according to claim 2, characterized in that: The neural network model is a graph deconvolution network model, and the component-level degradation state representation is determined by a preset neural network model according to the system monitoring variables and the causal relationship, including: Inputting the system monitoring variables and the causal relationship into the preset graph deconvolution network model, and outputting the component-level degradation state representation; Wherein, the graph deconvolution network model is used to extract the component-level degradation state representation from the system monitoring variables and the causal relationship.

6. The method according to claim 2, characterized in that The generating counterfactual data conforming to the causal relationship according to the component-level degradation state representation includes: According to the component-level degradation state representation, the system operating condition variables and the system operating mode, counterfactual data that conforms to the causal relationship is generated through a preset causal adversarial generative network CGAN model; The counterfactual data include simulated system monitoring parameters, actual system operating condition variables, actual system operating mode and simulated system fault label data.

7. The method according to claim 6, characterized in that The CGAN model includes a generator and a discriminator. According to the component-level degradation state representation, the system operating condition variables and the system operating mode, a preset causal adversarial generative network CGAN model is used to generate counterfactual data that conforms to the causal relationship, including: generating candidate counterfactual data by the generator according to the component-level degradation state representation, the system operating condition variable and the system operating mode; In a case where the discriminator determines that the candidate counterfactual data conforms to the causal relationship, the candidate counterfactual data is output as the counterfactual data.

8. The method according to any one of claims 1 to 7, characterized in that The method further comprises: Adding the counterfactual data to a training data set of the anomaly detection model; The anomaly detection model is trained according to the added training data set to obtain the data-enhanced anomaly detection model.

9. A causally driven counterfactual data generation and its application in anomaly detection, characterized in that: include: processor; a memory for storing processor-executable instructions; The processor is configured to implement the method described in any one of claims 1 to 8 when executing the instructions stored in the memory.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images