Process industry time sequence anomaly detection method based on hierarchical multiple modules

Abstract

The invention belongs to the field of process industry anomaly detection, and particularly relates to a hierarchical multi-module-based process industry time sequence anomaly detection method, which comprises the following steps of: dividing multivariate time sequence data, and respectively inputting the divided data into a hierarchical coding layer through an input layer to obtain a low-dimensional feature vector; inputting the low-dimensional feature vector into a process attention masking layer to obtain a coupling relationship between sub-processes in the data; inputting the low-dimensional feature vectors with the coupling relationship into a process information memory layer, and mining the coupling relationship between adjacent sub-process features; inputting the low-dimensional feature vectors with the coupling relationship between the sub-flows and the coupling relationship between the features of the adjacent sub-flows into a layered decoder to obtain reconstructed features; inputting the reconstruction features into an output layer to obtain an identification result; according to the method, the attention covering layer and the process information memory layer are adopted to capture the global and local coupling relationship between the sub-processes, so that the accuracy of a detection result is improved.

Description

Technical Field

[0001] The present invention belongs to the field of process industry anomaly detection, and in particular relates to a process industry time series anomaly detection method based on layered multi-modules. Background Art

[0002] The process industry mainly includes chemical, energy, building materials and other industries. It is an important pillar of the national economy and an important support for the sustained economic growth of the world's manufacturing power. It not only promotes economic growth, but also promotes the effective use of resources and the efficient use of energy. However, with the continuous expansion of the scale of production in the process industry and the continuous development of production technology, its production process has gradually become more sophisticated and complex, which makes the process industry more prone to anomalies, which inevitably affects the work efficiency of the process industry and even causes major economic losses and safety accidents. Therefore, it is necessary to carry out research on anomaly detection for the process industry, conduct data mining from the existing public process industry time series data, perform accurate anomaly detection and provide anomaly location information, which is of great significance for ensuring the safe and intelligent production of the process industry. In this regard, many scholars have carried out relevant research, and the existing methods can be divided into two categories: methods based on statistical theory and methods based on machine learning.

[0003] Methods based on statistical theory include moving average method, exponential smoothing method, ARIMA model, etc. Methods based on statistical theory have good interpretability. However, statistical methods usually solve problems based on the distribution characteristics of data, but in reality, the distribution of multivariate and high-dimensional process industry data is often very complex, making it difficult for statistical methods to quickly and effectively determine the true distribution characteristics of the data, resulting in the problem of difficult model construction and heavy computational burden. Compared with methods based on statistical theory, machine learning methods can effectively process high-dimensional variables and mine data feature information based on the characteristics and structure of the data itself. Methods based on machine learning include clustering, Bayesian networks, etc., but due to their limited ability to mine feature information, it is difficult to effectively consider the coupling between multivariate variables in process industries, making their anomaly detection accuracy insufficient.

[0004] With the rapid development of deep learning technology in recent years, it has become the mainstream research direction of anomaly detection in process industry due to its advantages such as strong feature extraction ability and avoidance of complex mechanism analysis. Since the number of abnormal samples in process industry is extremely small in actual production, the existing anomaly detection methods are usually based on unsupervised learning methods, using deep neural networks to mine the reconstruction error between normal data and abnormal data to detect anomalies. However, the existing anomaly detection technology based on deep learning mainly mines features based on the time series characteristics of data. Due to the high dimensionality and coupling of multivariate data in process industry, the existing time series anomaly detection methods have little attention, resulting in the need to further improve the accuracy of anomaly detection in process industry data. More importantly, the existing methods are difficult to achieve accurate positioning of anomaly detection. Summary of the invention

[0005] In order to solve the problems existing in the above prior art, the present invention proposes a process industry time series anomaly detection method based on hierarchical multi-modules, the method comprising: obtaining data to be detected, inputting the data to be detected into a trained process industry time series anomaly detection model, and obtaining a detection result; wherein the process industry time series anomaly detection model comprises an input layer, a hierarchical encoder, a masked process attention layer, a process information memory layer, a hierarchical decoder and an output layer;

[0006] The process industry time series anomaly detection model processes the data to be detected, including: if the data to be detected is multivariate time series data, the multivariate time series data is divided, and the divided data is input into the hierarchical coding layer through the input layer to obtain a low-dimensional feature vector; the low-dimensional feature vector is input into the masked process attention layer to obtain the coupling relationship between each sub-process in the data; the low-dimensional feature vector with the coupling relationship is input into the process information memory layer to mine the coupling relationship between the features of adjacent sub-processes; the low-dimensional feature vector with the coupling relationship between each sub-process and the coupling relationship between the features of adjacent sub-processes is input into the hierarchical decoder to obtain the reconstructed feature; the reconstructed feature is input into the output layer to obtain the recognition result.

[0007] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, it implements any of the above-mentioned process industry timing anomaly detection methods based on hierarchical multi-modules.

[0008] To achieve the above-mentioned purpose, the present invention also provides a process industry timing anomaly detection device based on hierarchical multi-modules, comprising a processor and a memory; the memory is used to store computer programs; the processor is connected to the memory, and is used to execute the computer programs stored in the memory, so that the process industry timing anomaly detection device based on hierarchical multi-modules can execute any of the above-mentioned process industry timing anomaly detection methods based on hierarchical multi-modules.

[0009] Beneficial effects of the present invention:

[0010] Based on the unsupervised learning method, the present invention proposes a hierarchical multi-module framework for multivariate time series anomaly detection in process industries. The framework first decomposes process industry data into multiple low-dimensional sub-process data, and then inputs them into different encoding layers for hierarchical encoding learning. Since there is a one-way flow of data between sub-processes in the process industry, that is, the feature information of the upstream sub-process will be passed to the downstream sub-process, a masked attention layer and a process information memory layer are designed to capture the global and local coupling relationship between each sub-process; the present invention reconstructs each sub-process data by inputting it into different decoding layers, and finally detects anomalies based on the size of the reconstruction error of the process data. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a framework structure diagram of the process industry timing anomaly detection method based on layered multi-modules of the present invention;

[0012] Figure 2 It is a structural diagram of the attention layer of the masking process of the present invention;

[0013] Figure 3 It is a structural diagram of the process information memory layer of the present invention;

[0014] Figure 4 This is a visualization experiment diagram of abnormal location in process industry according to the present invention. DETAILED DESCRIPTION

[0015] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0016] The technical solution adopted to achieve the purpose of the present invention is: first, based on the idea of ​​unsupervised learning, a hierarchical autoencoder for process industry is built. The hierarchical autoencoder reduces the learning complexity and realizes anomaly location by decomposing process industry data, and uses LSTM and spatiotemporal attention mechanism to obtain the time series feature information of time series data. Then, in order to consider the global and local coupling relationship between each sub-process in the process industry, this patent proposes a masked attention layer and a process information memory layer. Combining the hierarchical autoencoder, the masked attention layer and the process information memory layer, a hierarchical multi-module framework for multivariate time series anomaly detection in the process industry is proposed. Finally, in the experiment, three public process industry data sets were used to verify the effectiveness of the present invention in anomaly detection and anomaly location in the process industry.

[0017] A method for detecting anomalies in process industry time series based on hierarchical multi-modules, the method comprising: obtaining data to be detected, inputting the data to be detected into a trained process industry time series anomaly detection model, and obtaining a detection result; wherein the process industry time series anomaly detection model comprises an input layer, a hierarchical encoder, a masked process attention layer, a process information memory layer, a hierarchical decoder, and an output layer; the process industry time series anomaly detection model processes the data to be detected, comprising: if the data to be detected is multivariate time series data, the multivariate time series data is divided, and the divided data is respectively input into a hierarchical encoding layer through the input layer to obtain a low-dimensional feature vector; the low-dimensional feature vector is input into the masked process attention layer to obtain the coupling relationship between each sub-process in the data; the low-dimensional feature vector with the coupling relationship is input into the process information memory layer to mine the coupling relationship between adjacent sub-process features; the low-dimensional feature vector with the coupling relationship between each sub-process and the coupling relationship between adjacent sub-process features is input into the hierarchical decoder to obtain a reconstructed feature; the reconstructed feature is input into the output layer to obtain a recognition result.

[0018] This paper proposes a hierarchical multi-module framework for multivariate time series anomaly detection in process industries. Figure 1 As shown in Figure 1, the hierarchical multi-module framework can be divided into four parts: hierarchical encoder, masked process attention layer, process information memory layer, and hierarchical decoder. Process industry operation data can be collected in real time through various monitoring systems and sensors. In the process industry, the entire process consists of many sub-processes, and each sub-process contains many sensors. Therefore, the multivariate time series data set collected in the process industry can be described as follows:

[0019]

[0020] Where P i represents the time series data of the ith sub-process. The data of each sub-process is a subset of the original process industry data set. M represents the number of sub-processes, and x i ∈R T×1 , T represents the length of the time series. After the process industry data set is divided according to formula (1), the sub-process data P i The input is fed into a hierarchical encoder for hierarchical encoding learning.

[0021] The hierarchical encoder is composed of a spatiotemporal attention layer and an LSTM layer. The hierarchical encoder processes data by: using the temporal attention mechanism to process the data of the sub-process to obtain the temporal attention calculation result; using the spatial attention mechanism to process the data of the sub-process to obtain the spatial attention calculation result; setting the temporal weight and spatial weight, and fusing the temporal attention calculation result and the spatial attention calculation result according to the temporal weight and spatial weight to obtain the final output of the spatiotemporal attention; inputting the final output of the spatiotemporal attention into the LSTM layer to obtain a low-dimensional feature vector. The calculation formula of the hierarchical encoder is as follows:

[0022]

[0023] A=α·A T +β·A S ,α+β=1 (4)

[0024] H=LSTM(A) (5)

[0025] Where P i is the data of subprocess i, t represents the number of samples, K and Q represent key and query. T and A S Represent the calculation results of time and space attention respectively, and A is the final output of time and space attention. α and β represent the weights of time attention and space attention respectively, which are used to balance the degree of attention of data to time and space information. Through the LSTM layer, the hierarchical encoder maps each sub-process data into a low-dimensional feature vector z i , as shown in formula (6):

[0026] z i =HEN(P i ) (6)

[0027] Where HEN(*) represents a hierarchical encoder, P i represents the input data of the ith subprocess, z i Indicates P i The low-dimensional feature vector after the layered encoder mapping. i It will be input into the masked process attention layer to capture the coupling relationship between each sub-process from a global perspective. The structure of the masked process attention layer is as follows Figure 2 In the mask process attention layer, we first need to calculate the mask process attention score matrix of each sub-process. The calculation formula is as follows:

[0028]

[0029] Where S is the masking process attention score matrix, S i,jrepresents the attention weight of subprocess i on subprocess j, and mask(*) represents the masking operation, which is used to intercept the lower left triangular part of the attention score matrix and set the rest to 0. The purpose is to enable each subprocess to obtain the influence weight score on itself and the upstream subprocess. Then the low-dimensional feature vector z of each subprocess is i The global process information will be updated through this matrix, and the calculation formula is as follows:

[0030] z i '=LeakyReLu(W i '·z i +b i ') (8)

[0031]

[0032] Among them, W i ′ represents the trainable weight parameter matrix, b i ′ represents the bias, M represents the number of subprocesses, represents the adaptive weight coefficient, z i ′ is the output result of the masked process attention. The masked attention layer sets the attention weight score of the downstream sub-process to 0, thereby ensuring that the current sub-process only pays attention to the information of the upstream process, and at the same time uses the adaptive weight to adaptively increase the attention to the upstream sub-process from far to near.

[0033] After the masking process attention layer, the low-dimensional feature vector z i ′ will be input into the process information memory layer to mine the coupling relationship between adjacent sub-process features. The structure of the process information memory layer is as follows: Figure 3 As shown. The information of adjacent sub-processes is selectively remembered and forgotten in the process information memory layer and passed to the next sub-process to continue the memory forgetting calculation. Before the information is memorized and forgotten, the weight coefficient of memory forgetting must be calculated. The calculation formula is as follows:

[0034] r i =sigmoid((z i '+c i-1 )·U r +h i-1 ·V r +b r ) (10)

[0035] f i =sigmoid((z i '+c i-1 )·U f +h i-1 ·V f +b f ) (11)

[0036] o i =sigmoid((z i '+c i-1 )·U o +h i-1 ·V o +b o ) (12)

[0037] Among them, r i , f i , o i Represent the memory coefficient, forgetting coefficient and output coefficient respectively, c i-1 and h i-1 represents the process state and output result of the previous subprocess, U and V are randomly initialized weight matrices, and b is the bias. i ′ will use the calculated coefficient to remember and forget information. The calculation formula is as follows:

[0038] g i =tanh(z i '·U g +h i-1 ·V g +b g ) (13)

[0039] c i =f i ·c i-1 +r i ·g i (14)

[0040] h i =o i ·c i (15)

[0041] Formula (14) uses the previous subprocess information c i-1 With the current process information g i To update the process status c i , then formula (15) uses the output coefficient o i With the current process status information c i Calculate the memory forgetting result h i After formulas (13)-(15), the process information memory layer will make the current sub-process remember or forget the information of the current sub-process and the previous sub-process and output it, and pass the result to the next sub-process.

[0042] After the low-dimensional feature vectors of each sub-process are calculated by the masking process attention and process information memory layers, they are input into the hierarchical decoder for hierarchical decoding. The hierarchical decoder gradually restores the dimensions of the low-dimensional feature vectors of each sub-process to the dimensions of the original feature vectors. The internal calculation formula of the hierarchical decoder is the same as that of the hierarchical encoder, so its calculation formula is as follows:

[0043]

[0044] Where HDE(*) represents a hierarchical decoder, Represents the reconstructed data of the ith subprocess. Since the training goal of time series anomaly detection based on unsupervised learning is to minimize the difference between the subprocess data and its reconstructed data, the loss function calculation formula for each subprocess is as follows:

[0045]

[0046] Where P i,j and represents the input data and reconstruction data of the jth feature vector of the i-th subprocess, m represents the number of features in the subprocess, l i represents the loss value of the ith subprocess, and T represents the length of the time series. Since the original time series data set has been divided into multiple subprocess data streams, each subprocess data stream can calculate the loss value l of its reconstructed data through the loss function. i In the training phase of the proposed framework, the model back-propagates the loss values ​​of each sub-process to update the model parameters, and the calculation formula is as follows:

[0047]

[0048] After calculating the abnormal score at each moment, a threshold is used as a criterion for judging abnormalities. To this end, the present invention designs a threshold calculation formula based on mean and variance, and the calculation formula is as follows:

[0049]

[0050]

[0051] in, represents the mean of the anomaly scores at all times, S represents the standard deviation of the anomaly scores at all times, and k is the set hyperparameter. If the anomaly score calculated at the jth moment is greater than the threshold, the corresponding prediction value at that moment is 1 (abnormal), otherwise it is 0 (normal).

[0052] In this embodiment, the process information memory layer processes the low-dimensional feature vector, including: initializing the memory, forgetting and output calculation vectors for the process information memory layer of each sub-process; calculating the calculation result of the process information memory layer of the previous sub-process with the forgetting variable to obtain the historical state information that the current sub-process should remember; calculating the low-dimensional feature vector of the current sub-process with the memory variable to obtain the current state information that the current sub-process should retain; obtaining the output result of the process information memory layer based on the calculated historical state information and current state information, and the output result is transmitted horizontally to the process information memory layer of the next sub-process for calculation while being output.

[0053] In this embodiment, the present invention uses three publicly available data sets in the experiment. These three data sets are all process industry time series data sets. Table 1 describes the characteristic information of these data sets.

[0054] Table 1 Introduction to process industry datasets

[0055]

[0056] Due to the different feature types of data sets, the units and metrics of the data may be different. It is usually necessary to perform preprocessing operations on the data to unify the data dimensions so that different data have the same units and metrics. Therefore, the present invention adopts a data normalization method to unify the data dimensions. There are no abnormal samples in the training set of these three data sets, but there are abnormal samples in the test set.

[0057] In order to verify the superiority of the method proposed in the present invention, the method of the present invention is compared with the current six mainstream multivariate time series anomaly detection methods:

[0058] USAD: This model is based on unsupervised learning and uses two decoders as discriminators and generators. These two decoders are adversarially trained in an autoencoder and finally detect anomalies through reconstruction errors.

[0059] GDN: GDN is a multivariate time series anomaly detection model based on graph neural networks, which identifies anomalies by combining structural learning methods with graph neural networks.

[0060] OmniAnomaly: This model learns feature representations of multivariate time series through techniques such as random variable concatenation and flat normalization, captures the normal patterns of multivariate time series, reconstructs input data through these representations, and determines anomalies using the reconstruction probabilities.

[0061] MAD-GAN: This model is trained based on the idea of ​​generative adversarial networks, where the discriminator and generator are composed of LSTM-RNN, and finally the DR score is used as the anomaly score to detect anomalies.

[0062] MTAD-GAT: This model uses two graph attention layers to learn the complex correlations of multivariate time series in the time dimension and feature dimension respectively, and finally detects anomalies in time series data through reconstruction and prediction methods.

[0063] FuSAGNet: This model uses a combination of sparse autoencoders and graph neural networks to learn the dependencies between features, and then identifies anomalies through reconstruction and prediction of time series data.

[0064] When conducting experiments, the proposed framework hierarchical settings for the original process industry dataset are shown in Table 2. This setting is based on the dataset document information provided by the official. Taking the SWaT dataset as an example, the SWaT dataset contains 50 features, which constitute 6 sub-processes. The first 5 features belong to the first sub-process, the 6th to 11th features belong to the second sub-process, and so on.

[0065] Table 2 Introduction to process industry datasets

[0066]

[0067] In terms of evaluation indicators, classification accuracy A, classification precision P, classification recall R, and F1 value are used to measure the accuracy of the model in detecting anomalies in process industries. Among them: Classification accuracy refers to the ratio of the number of correctly predicted abnormal samples to the total number of samples, and its calculation formula is as follows:

[0068]

[0069] In the formula, A is the classification accuracy; TP is the number of true abnormal samples correctly classified; TN is the number of true normal samples correctly classified; FN is the number of true abnormal samples misclassified as normal samples; FP is the number of true normal samples misclassified as abnormal samples.

[0070] Classification accuracy refers to the ratio of the number of abnormal samples correctly classified to the number of samples identified as abnormal by the model. The calculation formula is as follows:

[0071]

[0072] Classification recall refers to the ratio of correctly classified abnormal samples to the number of true abnormal samples. The calculation formula is as follows:

[0073]

[0074] The F1 value is an evaluation indicator of the model classification performance, which is the harmonic mean of the precision and recall. The F1 value ranges from 0 to 1. The larger the value, the better the classification performance of the model. Its calculation formula is as follows:

[0075]

[0076] The present invention shows the anomaly detection performance of the proposed anomaly detection framework and other comparison methods in Table 3. In general, it can be observed from the experiments on three real process industry datasets that the proposed anomaly detection framework has the highest accuracy in all cases.

[0077] It can be observed on the WADI dataset that the precision, recall and F1 score of the proposed framework reached 97.12%, 96.86% and 96.99% respectively, and the F1 score was about 50% higher than the comparison method. Due to the large number of WADI features, the anomaly detection effect of the comparison methods was poor. On the HAI dataset, the proposed framework had the highest F1 score and accuracy, reaching 80.51% and 92.73% respectively, and the accuracy was only 1.35% lower than the FuSAGNet model. Compared with the WADI dataset, the detection effect of the comparison method has improved. The main reason is that the number of features in the HAI dataset is less than that of WADI, which reduces the computational burden of the comparison method. On the SWaT dataset, the precision of the proposed framework reached 99.77%, which is 0.8% higher than that of MAD-GAN, and the accuracy also reached 95.96%. Compared with the WADI dataset, the detection effect of the comparison method on SWaT has been greatly improved, and the performance of the proposed anomaly detection framework on the SWaT dataset is comparable to that of the current mainstream methods. The main reason is that the number of features of the WADI dataset has increased significantly compared to the SWaT dataset. The high-dimensional coupled features make anomaly detection more difficult, resulting in poor detection results of the comparison methods on the WADI dataset. The proposed framework can perform decomposition learning and thus maintain good performance in high-dimensional data.

[0078] Combining the experimental data conducted on the three data sets, we can observe a phenomenon: high-dimensional and complex data feature information will increase the computational complexity of the model, resulting in a decrease in the detection effect of the comparison method. Therefore, as the scale of the problem increases, it is necessary to design methods to simplify the problem and reduce the computational burden. The anomaly detection framework proposed in the present invention can decompose the process characteristics and resolve the original complex process industry anomaly detection problem into multiple sub-process anomaly detection problems, thereby reducing the difficulty of model learning and improving the anomaly detection effect. The results of the anomaly detection performance comparison are shown in Table 3.

[0079] Table 3. Comparison of anomaly detection performance

[0080]

[0081] Since hierarchical autoencoders can decompose high-dimensional time series, the reconstruction error of each subprocess can be calculated and used for anomaly location. Therefore, corresponding anomaly location visualization experiments are conducted in three data sets, such as Figure 4 As shown in Figure 2. The horizontal axis of each sub-graph represents the sub-process, and the vertical axis represents the reconstruction error. Each sub-graph represents two reconstruction errors of the sub-process, representing the errors in normal and abnormal states respectively. Figure 4 (a), (b) and (c) correspond to the experimental data of WADI, HAI and SWaT datasets respectively. Figure 4 It can be seen that there are certain differences in the reconstruction error values ​​of each sub-process under normal and abnormal conditions. Therefore, when the error value of a sub-process is different from the error value under normal conditions, it can be determined that the sub-process is in an abnormal state.

[0082] In one embodiment of the present invention, the present invention also includes a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, it implements any of the above-mentioned process industry timing anomaly detection methods based on hierarchical multi-modules.

[0083] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

[0084] A device for detecting a timing anomaly in a process industry based on a layered multi-module system, comprising a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the device for detecting a timing anomaly in a process industry based on a layered multi-module system executes any of the above-mentioned methods for detecting a timing anomaly in a process industry based on a layered multi-module system.

[0085] Specifically, the memory includes: ROM, RAM, magnetic disk, USB flash drive, memory card or optical disk, etc., which can store program codes.

[0086] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0087] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting anomalies in process industry time series based on hierarchical multi-modules, characterized in that: include: Obtain the data to be tested, input the data to be tested into the trained process industry time series anomaly detection model, and obtain the detection results; The process industry time series anomaly detection model includes an input layer, a hierarchical encoder, a masked process attention layer, a process information memory layer, a hierarchical decoder, and an output layer; The process industry time series anomaly detection model processes the data to be detected, including: if the data to be detected is multivariate time series data, the multivariate time series data is divided, and the divided data is input into the hierarchical coding layer through the input layer to obtain a low-dimensional feature vector; the low-dimensional feature vector is input into the masked process attention layer to obtain the coupling relationship between each sub-process in the data; the low-dimensional feature vector with the coupling relationship is input into the process information memory layer to mine the coupling relationship between the features of adjacent sub-processes; the low-dimensional feature vector with the coupling relationship between each sub-process and the coupling relationship between the features of adjacent sub-processes is input into the hierarchical decoder to obtain the reconstructed feature; the reconstructed feature is input into the output layer to obtain the recognition result.

2. The process industry timing anomaly detection method based on hierarchical multi-modules according to claim 1 is characterized in that: The hierarchical encoder consists of spatiotemporal attention layers and LSTM layers; The hierarchical encoder processes data by: using the temporal attention mechanism to process the data of the sub-process to obtain the temporal attention calculation result; using the spatial attention mechanism to process the data of the sub-process to obtain the spatial attention calculation result; setting the temporal weight and the spatial weight, and fusing the temporal attention calculation result and the spatial attention calculation result according to the temporal weight and the spatial weight to obtain the final output of the spatiotemporal attention; inputting the final output of the spatiotemporal attention into the LSTM layer to obtain a low-dimensional feature vector.

3. The process industry timing anomaly detection method based on hierarchical multi-modules according to claim 1 is characterized in that: The masked process attention layer processes the low-dimensional feature vector by: calculating the masked process attention score matrix of each sub-process; using the masked process attention score matrix to update the global information of the low-dimensional feature vector to obtain the coupling relationship between each sub-process.

4. The process industry timing anomaly detection method based on hierarchical multi-modules according to claim 3 is characterized in that: Calculating the masking process attention score matrix includes: Among them, S is the mask process attention score matrix, mask is the mask operation, is the process key vector, Q m is the process query vector, d m for The dimension size of .

5. The method for detecting anomalies in process industry timing based on hierarchical multi-modules according to claim 3 is characterized in that: Updating the global information of the low-dimensional feature vector includes: With i '=LeakyReLu(W i '·With i +b i ') Among them, W i ′ represents the trainable weight parameter matrix, b i ′ represents the bias, M represents the number of subprocesses, represents the adaptive weight coefficient, z i ′ is the output result of the masking process attention, S i,j represents the attention weight of sub-process i to sub-process j.

6. The method for detecting anomalies in process industry timing based on hierarchical multi-modules according to claim 1, characterized in that: The process information memory layer processes the low-dimensional feature vector, including: initializing the memory, forgetting and output calculation vectors for the process information memory layer of each sub-process; calculating the calculation result of the process information memory layer of the previous sub-process with the forgetting variable to obtain the historical state information that the current sub-process should remember; calculating the low-dimensional feature vector of the current sub-process with the memory variable to obtain the current state information that the current sub-process should retain; obtaining the output result of the process information memory layer based on the calculated historical state information and current state information, and the output result is transmitted horizontally to the process information memory layer of the next sub-process for calculation while being output.

7. The process industry timing anomaly detection method based on hierarchical multi-modules according to claim 1 is characterized in that: The layered decoder processes the input features by: in, represents the reconstructed data of subprocess i, Represents the input data to the layered decoder.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement any one of claims 1 to 7 of the process industry timing anomaly detection method based on hierarchical multi-modules.

9. A process industry timing anomaly detection device based on layered multi-modules, characterized in that: It includes a processor and a memory; the memory is used to store computer programs; the processor is connected to the memory and is used to execute the computer programs stored in the memory, so that the process industry timing anomaly detection device based on hierarchical multi-modules can execute any one of the process industry timing anomaly detection methods based on hierarchical multi-modules in claims 1 to 7.

Images