Abnormality detection method, device, equipment and medium

Abstract

The invention discloses an anomaly detection method and device, equipment and a medium, and the method comprises the steps: obtaining to-be-detected data, and carrying out the multivariate time sequence preprocessing of the to-be-detected data, and obtaining time sequence data; performing time coding on the time sequence data through a time sequence correlation difference sub-model of the pre-training detection model to obtain a time sequence correlation abnormal score; performing spatial coding on the time series data through the spatial correlation difference sub-model, and determining a spatial correlation anomaly score; performing data reconstruction according to the time sequence association exception score and the space association exception score through a full-connection network to obtain an exception score at each time point; and comparing each anomaly score with a preset anomaly threshold to obtain an anomaly detection result. The correlation anomaly score of the time sequence and the correlation anomaly score of the space are extracted through the double-branch pre-training detection model, data reconstruction is completed by fusing information of the time sequence and the space based on the full-connection network, anomaly is found from the perspective of space-time correlation, the better anti-noise capacity is achieved, and the accuracy of the detection result is improved.

Description

Technical Field

[0001] The present invention relates to the field of anomaly detection technology, and in particular to an anomaly detection method, device, equipment and medium. Background Art

[0002] Anomaly detection is a key area in the field of data mining in recent years and represents an important task in time series data mining. This research is particularly important in various industrial applications, including fault analysis and diagnosis of industrial equipment such as vibration equipment. By identifying abnormal data in IoT sensors and vibration equipment used for equipment monitoring, it helps prevent potential faults from escalating. This not only ensures the safety of daily production and life, but also reduces unnecessary human and material consumption.

[0003] At present, traditional methods of anomaly detection include: OCSVM is committed to detecting anomalies by maximizing the margin between the origin and normal instances in the data set to establish a decision boundary; Isolation Forest (IForest) uses the distance between the instance and the root node as the criterion for judging anomalies. Modern methods encode time series data through deep learning technology sequence reconstruction or prediction to achieve anomaly detection.

[0004] However, when it comes to anomaly detection in industrial systems, traditional methods do not consider temporal or spatial information and cannot provide satisfactory results. Modern methods only model multivariate time series from a spatial perspective, ignoring the inherent temporal dependencies. Modeling only from a temporal perspective may increase false positives in unsupervised time series anomaly detection when the temporal distribution changes. Summary of the invention

[0005] The present invention provides an anomaly detection method, device, equipment and medium to realize the detection of abnormal data.

[0006] According to a first aspect of the present invention, there is provided an anomaly detection method, comprising:

[0007] Acquire the data to be detected, and perform multivariate time series preprocessing on the data to be detected to obtain time series data;

[0008] Time-encoding the time series data using a time series correlation difference sub-model of a pre-trained detection model to obtain a time series correlation anomaly score;

[0009] Spatially encoding the time series data using the spatial correlation difference sub-model of the pre-trained detection model to determine a spatial correlation anomaly score;

[0010] Reconstructing data according to the temporal correlation anomaly score and the spatial correlation anomaly score through the fully connected network of the pre-trained detection model to obtain anomaly scores at each time point;

[0011] Each of the anomaly scores is compared with a preset anomaly threshold to obtain an anomaly detection result.

[0012] According to a second aspect of the present invention, there is provided an abnormality detection device, comprising:

[0013] A data acquisition module is used to acquire the data to be detected and perform multivariate time series preprocessing on the data to be detected to obtain time series data;

[0014] A first determination module is used to time-code the time series data through a time series correlation difference sub-model of a pre-trained detection model to obtain a time series correlation anomaly score;

[0015] A second determination module is used to spatially encode the time series data through the spatial correlation difference sub-model of the pre-trained detection model to determine a spatial correlation anomaly score;

[0016] A third determination module is used to reconstruct data according to the temporal correlation anomaly score and the spatial correlation anomaly score through a fully connected network of the pre-trained detection model to obtain anomaly scores at each time point;

[0017] The result determination module is used to compare each of the anomaly scores with a preset anomaly threshold to obtain an anomaly detection result.

[0018] According to a third aspect of the present invention, there is provided an electronic device, the electronic device comprising:

[0019] at least one processor; and

[0020] a memory communicatively connected to the at least one processor; wherein,

[0021] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the anomaly detection method described in any embodiment of the present invention.

[0022] According to a fourth aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the anomaly detection method described in any embodiment of the present invention when executed.

[0023] According to a fifth aspect of the present invention, an embodiment of the present invention further provides a computer program product, the computer program product comprising a computer program, and when the computer program is executed by a processor, the anomaly detection method of any embodiment of the present invention is implemented.

[0024] The technical solution of the embodiment of the present invention obtains the data to be detected and performs multivariate time series preprocessing on the data to be detected to obtain time series data; the time series data is temporally encoded by the time series correlation difference submodel of the pre-trained detection model to obtain the time series correlation anomaly score; the time series data is spatially encoded by the spatial correlation difference submodel of the pre-trained detection model to determine the spatial correlation anomaly score; the data is reconstructed according to the time series correlation anomaly score and the spatial correlation anomaly score by the fully connected network of the pre-trained detection model to obtain the anomaly score at each time point; each anomaly score is compared with a preset anomaly threshold to obtain an anomaly detection result. The time series correlation anomaly score and the spatial correlation anomaly score are extracted respectively by using a dual-branch pre-trained detection model, and the information of the two is fused based on the fully connected network to complete the reconstruction of the data, discover anomalies from the perspective of time and space correlation, have better noise resistance, improve the accuracy of the detection results, and improve detection.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flowchart of an anomaly detection method provided according to Embodiment 1 of the present invention;

[0028] Figure 2 is a flow chart of an anomaly detection method provided according to Embodiment 2 of the present invention;

[0029] Figure 3 is a schematic diagram of the structure of an abnormality detection device provided according to Embodiment 3 of the present invention;

[0030] Figure 4 It is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 A flowchart of an anomaly detection method is provided for the first embodiment of the present invention. This embodiment is applicable to the case of data anomaly detection. The method can be executed by an anomaly detection device. The anomaly detection device can be implemented in the form of hardware and / or software. The anomaly detection device can be configured in an electronic device. Figure 1 As shown, the method includes:

[0035] S110, obtaining the data to be detected, and performing multivariate time series preprocessing on the data to be detected to obtain time series data.

[0036] In this embodiment, the data to be detected can be understood as data that needs to be detected for abnormality, such as data of different operation directions such as industry. Multivariate time series preprocessing can be understood as preprocessing of time series of multiple variables. Time series data can be understood as data sorted according to time series.

[0037] Specifically, the processor can obtain the data to be detected transmitted by the associated system, and perform multivariate time series preprocessing on the data to be detected, wherein the multivariate time series preprocessing may include operations such as dividing time windows and normalization, so as to improve the quality of the data and the accuracy of the analysis, and ensure that the subsequent model can better capture the potential patterns and relationships in the data.

[0038] S120. Time-encode the time series data through the time series correlation difference sub-model of the pre-trained detection model to obtain a time series correlation anomaly score.

[0039] In this embodiment, the pre-trained detection model can be understood as a model for anomaly detection that meets the training conditions. The time series correlation difference sub-model can be understood as a model for determining time series correlation features. The time series correlation anomaly score can be understood as a score for characterizing the time series correlation difference at each time point.

[0040] Specifically, the processor can input the timing data into the timing correlation difference sub-model of the pre-trained detection model for time encoding. The attention mechanism of the timing correlation difference sub-model will learn the timing correlation pattern of each time point in the current time window, and compare it with the normal timing correlation pattern learned in the training phase to obtain the timing correlation anomaly score. Compared with the normal time point, the timing correlation difference of the abnormal time point will be greater.

[0041] S130. Spatially encode the time series data through the spatial correlation difference sub-model of the pre-trained detection model to determine the spatial correlation anomaly score.

[0042] In this embodiment, the spatial correlation difference sub-model can be understood as a model for determining spatial correlation features. The spatial correlation difference score can be understood as a score for characterizing the spatial correlation difference at each time point.

[0043] Specifically, the processor may input the time series data into the spatial correlation difference sub-model for spatial encoding to obtain a spatial correlation anomaly score.

[0044] S140, reconstructing data according to the temporal correlation anomaly score and the spatial correlation anomaly score through the fully connected network of the pre-trained detection model to obtain the anomaly score at each time point.

[0045] In this embodiment, the fully connected network can be understood as a network structure in which each neuron is connected to all neurons in the previous layer in the neural network. The time point can be understood as the time used to characterize the collection of each data. The abnormal score can be understood as the score that characterizes the whole of time and space.

[0046] Specifically, the processor can concatenate the time-related anomaly scores and the space-related anomaly scores through the fully connected network layer of the pre-trained detection model, map them back to the original space through a linear layer, and then reconstruct the time window to obtain the anomaly scores at each time point. For example, the two can be integrated through operations such as dot multiplication.

[0047] S150: Compare each anomaly score with a preset anomaly threshold to obtain an anomaly detection result.

[0048] In this embodiment, the preset abnormal threshold value can be understood as a threshold value set for determining whether the data is abnormal. The abnormal detection result can be understood as a result for characterizing whether the data is normal or abnormal.

[0049] Specifically, the processor may compare the anomaly score at each time point with a preset anomaly threshold. If the anomaly score is greater than the preset anomaly threshold, the processor may mark the anomaly score at the time point as an abnormal result. Otherwise, the processor may mark the anomaly score at the time point as a normal result, thereby obtaining the anomaly detection result for the data to be detected this time.

[0050] The technical solution of the embodiment of the present invention obtains the time series data by acquiring the data to be detected and performing multivariate time series preprocessing on the data to be detected; temporally encodes the time series data through the time series correlation difference submodel of the pre-trained detection model to obtain the time series correlation anomaly score; spatially encodes the time series data through the spatial correlation difference submodel of the pre-trained detection model to determine the spatial correlation anomaly score; reconstructs the data according to the time series correlation anomaly score and the spatial correlation anomaly score through the fully connected network of the pre-trained detection model to obtain the anomaly score at each time point; and compares each of the anomaly scores with the preset anomaly threshold to obtain the anomaly detection result. The time series correlation anomaly score and the spatial correlation anomaly score are extracted respectively by using a dual-branch pre-trained detection model, and the information of the two is fused based on the fully connected network to complete the reconstruction of the data, discover anomalies from the perspective of time and space correlation, have better noise resistance, and improve the accuracy of the detection results.

[0051] As a first optional embodiment of the first embodiment, based on the above embodiment, the training steps of the pre-trained detection model include:

[0052] An initial detection model and a training sample set are obtained, wherein the initial detection model includes an initial temporal correlation difference sub-model, an initial spatial correlation difference sub-model and an initial fully connected network; the training sample set is preprocessed to obtain a data set to be trained; the initial temporal correlation difference sub-model is iteratively trained based on the data set to be trained and a preset optimizer to obtain a trained temporal correlation difference sub-model; the initial spatial correlation difference sub-model is iteratively trained based on the data set to be trained, a preset optimizer and a preset spatial loss function to obtain a trained spatial correlation difference sub-model; the initial fully connected network is iteratively trained based on the first output result of the initial temporal correlation difference sub-model and the second output result of the initial spatial correlation difference sub-model during each iterative training and the preset optimizer to obtain a trained fully connected network; a pre-trained detection model is obtained based on the temporal correlation difference sub-model, the spatial correlation difference sub-model and the fully connected network.

[0053] In this embodiment, the initial detection model can be understood as an untrained detection model. The initial time series correlation anomaly submodel can be understood as an untrained time series correlation anomaly submodel. The initial spatial correlation anomaly submodel can be understood as an untrained spatial correlation anomaly submodel. The initial fully connected network can be understood as an untrained fully connected network. The training sample set can be understood as a collection of a large amount of data used for training. The data set to be trained can be understood as a data set after preprocessing. The first output result can be understood as the time series score result output by the initial time series correlation difference submodel. The preset spatial loss function can be understood as a loss function used to characterize the error degree of the initial spatial correlation anomaly submodel. The second output result can be understood as the spatial score result output by the initial spatial correlation anomaly submodel. The preset optimizer can be understood as an algorithm for updating model parameters. For example, it can be optimized by the Adam optimizer. The learning rate of the Adam optimizer is set to a fixed value of 0.001, the batch size is set to 512, and (β1, β2) = (0.9, 0.99), where β1 and β2 are the exponential decay rates used to calculate the first-order moment estimate and the second-order moment estimate, respectively.

[0054] Specifically, the processor can obtain an initial detection model and a training sample set, wherein the initial detection model includes an initial temporal correlation difference sub-model, an initial spatial correlation difference sub-model, and an initial fully connected network. The processor can pre-process the training sample set, wherein the pre-processing includes operations such as dividing a time window and normalization. By pre-processing the training sample set, the data can be effectively sorted, the model convergence can be accelerated, and the training data set can be obtained. The processor can input the training data in the training data set into the initial temporal correlation difference sub-model, obtain the first output result of the initial temporal correlation difference sub-model and the corresponding loss function, and when the loss function does not meet the training end condition, update the parameters in the initial temporal correlation difference sub-model through a preset optimizer for iterative training, and obtain the trained temporal correlation difference sub-model. The processor can input the training data in the training data set into the initial spatial correlation difference sub-model, obtain the second output result output by the initial spatial correlation difference sub-model, and determine the corresponding spatial loss function based on the preset spatial loss function. When the spatial loss function does not meet the training end condition, iterative training is performed on the initial spatial correlation difference sub-model through a preset optimizer to obtain the trained spatial correlation difference sub-model. The processor can input the first output result and the second output result of the initial time series correlation difference sub-model at each iteration training into the initial fully connected network to obtain the total result and the corresponding loss function, determine the total loss function through the loss function of the initial fully connected network, the initial time series correlation difference sub-model and the loss function of each iteration of the initial spatial correlation difference sub-model, iteratively train the initial fully connected network through the total loss function and the preset optimizer to obtain the trained fully connected network. The processor can obtain the pre-trained detection model according to the time series correlation difference sub-model, the spatial correlation difference sub-model and the fully connected network.

[0055] Further, based on the above embodiment, the initial temporal correlation difference sub-model includes an initial first sequence encoding module, an initial temporal attention module and an initial first core module. Accordingly, the initial temporal correlation difference sub-model can be trained based on the training data set and the preset optimizer to obtain the trained temporal correlation difference sub-model in the following steps:

[0056] Input the data in the data set to be trained into the initial first sequence encoding module to obtain the third data; input the third data into the initial Gaussian kernel in the initial temporal attention module to obtain the normal temporal association pattern; input the third data into the initial first attention layer in the initial temporal attention module to obtain the current temporal dependency pattern; determine the first loss function according to the normal temporal association pattern, the current temporal dependency pattern, the initial first core module and the preset temporal loss function; train the initial temporal association difference sub-model according to the first loss function and the preset optimizer to obtain the trained temporal association difference sub-model.

[0057] In this embodiment, the first core module can be understood as a combination of modules for core processing of the initial time series association difference sub-model, for example, it can include modules such as attention layer, layer normalization, feedforward network and residual connection. The third data can be understood as the data result obtained after the initial first sequence encoding module is processed. The initial time series attention module can be understood as an untrained time series association difference attention module. The initial Gaussian kernel can be understood as a kernel function that can be learned to record the correlation between each point and other points in the time dimension. The initial first attention layer can be understood as a function that converts the original attention weight into a probability distribution, that is, a softmax function. The initial first sequence encoding module can be understood as a module for data encoding of the initial time series association difference sub-model. The first loss function is used to characterize the gap between the results of the initial time series association difference sub-model during this training and the standard. The current time series dependency mode can be understood as the association between the time series determined by the current data to be trained. The normal time series association mode can be understood as the association between the time series corresponding to the normal data situation. The preset time series loss function can be understood as a function used to characterize the difference between the results of the initial time series association difference sub-model this training and the standard.

[0058] Specifically, the processor can establish an L-layer Transformer model as an initial temporal association difference sub-model to perform time point encoding and position encoding on the time information in the training data in the training data set. The processor can first use position embedding (such as sine cosine encoding) to adapt to time series of different lengths to obtain the third data. Secondly, following the general Transformer structure, each layer of the initial first core module in the network can include layer normalization, a feedforward network, and another layer of normalized residual connection. The third data is input into the initial Gaussian kernel in the initial temporal attention module, and the initial Gaussian kernel is used to record the correlation between each point and other points in the time dimension to obtain a normal temporal association pattern; the processor can input the third data into the initial first attention layer in the initial temporal attention module to obtain an attention map standardized by the last dimension to obtain the current temporal dependency pattern. The normal timing association mode and the current timing dependency mode are processed through the initial first core module to obtain the timing association difference and combine it with the preset timing loss function to determine the first loss function. When the first loss function does not meet the training end condition, the processor can update the parameters in the initial timing association difference sub-model based on the first loss function and the preset optimizer, and perform the next training until the obtained first loss function or the number of iterations meets the training end condition, thereby obtaining the trained timing association difference sub-model.

[0059] For example, the temporal association difference learning stage uses a Transformer with L layers to treat the training data D trainFirst, position embedding (such as sine-cosine coding) is used to adapt to time series of different lengths. n When encoded, it is mapped to d dimensions. Secondly, following the general Transformer structure, each layer of the first core module in the network contains layer normalization, a feedforward network, and another layer of normalized residual connections. It is worth noting that self-attention can effectively extract the associations between time points. It can be assumed that normal time series exhibit inherent association patterns that should be preserved. It is assumed that anomalies lack global associations and are different from normal time points. To achieve this, a learnable initial Gaussian kernel can be used to remember the correlation of each point with other points in the time dimension. Current sequence association pattern in layer l and the normal temporal association pattern of adaptive learning The calculation is as follows:

[0060]

[0061] in, are the query and key of the self-attention mechanism. Softmax(·) represents the normalized attention map along the last dimension in the first attention layer. represents the current time dependency pattern. i refers to the i-th time point. |ji| represents the distance between the i-th point and the j-th point. Here only σ i is the bandwidth parameter to be learned by the initial Gaussian kernel. The distribution after the process of scaling or rescaling the data through the Rescale function is Represents the normal temporal association pattern learned by the l-th layer.

[0062] In order to learn this normal association pattern, the following preset loss function can be set

[0063]

[0064] Among them, l represents the lth layer of Transformer, i represents the i-th time point, represents the difference in timing correlation at each time point in the time window, and ||·||1 represents the 1-norm, which is the sum of the absolute values ​​of all elements in the calculation vector. Will gradually approach the normal timing correlation mode Corresponding to the network, the learnable variance corresponding to each time point will be continuously optimized to learn the time series association pattern under normal working conditions of the current data set. In the test phase, the attention mechanism will learn the time series association pattern of each time point in the current time window, and compare it with the normal time series association pattern learned in the training phase. In comparison, the temporal correlation differences of abnormal time points will be greater than those of normal time points.

[0065] Further, based on the above embodiment, the initial spatial correlation difference sub-model includes an initial second sequence encoding module, an initial spatial attention module and an initial second core module. Accordingly, the initial spatial correlation difference sub-model can be trained based on the training data set and the preset optimizer to obtain the trained spatial correlation difference sub-model. The steps are refined as follows:

[0066] Input the data in the training data set into the initial second sequence encoding module to obtain the fourth data; input the fourth data into each initial sensor of the spatial correlation difference attention module to obtain the normal spatial dependency; each initial sensor includes a learning embedding vector; input the fourth data into the initial second attention layer in the initial spatial attention module to obtain the current spatial dependency; determine the second loss function according to the normal spatial dependency, the current spatial dependency, the initial second core module and the preset spatial loss function; train the initial spatial correlation difference sub-model according to the second loss function and the preset optimizer to obtain the trained spatial correlation difference sub-model.

[0067] In this embodiment, the initial second core module can be understood as a combination of modules for core processing of the initial spatial association difference sub-model, for example, modules such as layer normalization, feedforward network and residual connection can be included. The initial spatial attention module can be understood as an untrained spatial association difference attention module. The initial second sequence encoding module can be understood as a module for data encoding by the initial spatial association difference sub-model. The fourth data can be understood as the data result obtained after the initial second sequence encoding module is processed. The initial sensor can be understood as the self-attention mechanism (Self-Attention Mechanism) of the initial spatial attention module is regarded as a "sensor" for capturing long-distance dependencies in sequence data. Normal spatial dependencies can be understood as the association between spaces corresponding to normal data. The current spatial dependency can be understood as the association between spaces determined by the current data to be trained. The learning embedding vector can be understood as an embedding vector that can be learned to characterize the spatial information of the variable. The preset spatial loss function can be understood as a function used to characterize the difference between the results of this training of the initial spatial association difference sub-model and the standard.

[0068] Specifically, the spatial correlation difference learning stage continues to use Transformer, but the difference is that each sensor is regarded as a basic unit of data, namely a token. Since the order of neuron arrangement already implies the sequential relationship between time points, the initial spatial correlation difference sub-model can automatically perceive the order of these time points. Therefore, there is no need to introduce additional position encoding. The initial second sequence encoding module only needs to use variable encoding to obtain the fourth data, and uniformly encode the fourth data input to each sensor into a latent vector of a specific length along the time dimension. In order to model the spatial correlation pattern of the input sequence, spatial correlation difference attention, namely the initial spatial attention module, is proposed. At each attention layer, a learnable embedding vector is assigned to each sensor. Used to characterize the spatial information of variables. The association matrix is ​​obtained by calculating the cosine similarity between each embedded vector to quantify the dependency between sensors, obtain the normal spatial dependency, and obtain the current spatial dependency by inputting the fourth data into the initial second attention layer in the initial spatial attention module. The processor can determine the second loss function based on the normal spatial dependency, the current spatial dependency and the preset spatial loss function. When the second loss function does not meet the end training condition and the number of training times does not meet the requirement, the processor can adjust the parameters of the initial spatial association difference sub-model based on the second loss function and the preset optimizer, and perform the next training with the data to be trained until the training end condition is met to obtain the trained spatial association difference sub-model.

[0069] Exemplarily, the dependency relationship of sensor i is represented by the similarity between the embedding vector of sensor i and the embedding vector of sensor j.

[0070]

[0071] Here, calculation That is, the embedding vector v i and other embedding vectors v j The normalized dot product between them obtains the normal spatial dependency.

[0072] In addition, assume that the multi-head attention has extracted m kinds of associations, denoted as h0,…,h m-1 Here, h0 represents the potential and invariant spatial dependency, called the current spatial dependency This is also should be learned. At the same time, we do not impose any restrictions on the learned relations of the other m-1 associations. Therefore, the association between sensor embeddings and The distribution of should show a consistent distribution. To this end, the following preset spatial loss function is designed

[0073]

[0074] Among them, dif spatial represents the spatial correlation difference of each sensor within the time window. Once the abnormal data is input, the current spatial dependency will become dependent on normal space Different and far away So that the processor can directly detect anomalies of spatially dependent changes.

[0075] Further, based on the above embodiment, the steps of iteratively training the initial fully connected network based on the first output result of the initial temporal correlation difference sub-model and the second output result of the initial spatial correlation difference sub-model during each iterative training and the preset optimizer to obtain the trained fully connected network are refined as follows:

[0076] The first anomaly score in the first output result of the initial temporal association difference submodel and the second anomaly score in the second output result of the initial spatial association difference submodel are input into the initial fully connected network to obtain a third anomaly score; a reconstruction error function is determined according to the third anomaly score; a total loss function is determined based on the first loss function in the first output result, the second loss function in the second output result, and the reconstruction error function; the initial fully connected network is iteratively trained based on the total loss function and a preset optimizer to obtain a trained fully connected network.

[0077] In this embodiment, the first output result can be understood as including the output result of the initial temporal correlation difference sub-model and the loss function corresponding to the output result. The first difference score can be understood as the temporal correlation difference score output by the initial temporal correlation difference sub-model in this training. The first loss function can be understood as a function that characterizes the deviation of the initial temporal correlation difference sub-model in this training. The second output result can be understood as including the output result of the initial spatial correlation difference sub-model and the loss function corresponding to the output result. The second difference score can be understood as the spatial correlation difference score output by the initial spatial correlation difference sub-model in this training. The second loss function can be understood as a function that characterizes the deviation of the initial spatial correlation difference sub-model in this training. The reconstruction error function can be understood as the error generated when the fully connected network is reconstructed. The total loss function can be understood as the loss function corresponding to the overall error.

[0078] Specifically, the processor can input the first anomaly score in the first output result of the initial temporal association difference submodel and the second anomaly score in the second output result of the initial spatial association difference submodel into the initial fully connected network to obtain a third anomaly score after the initial fully connected network is reconstructed. The processor can determine the reconstruction error function based on the third anomaly score; determine the total loss function based on the first loss function in the first output result, the second loss function in the second output result, and the reconstruction error function; iteratively train the initial fully connected network based on the total loss function and the preset optimizer to obtain a trained fully connected network.

[0079] For example, the reconstruction stage mainly uses the initial fully connected layer to map the feature space back to the original space. The reconstruction error function The expression is as follows:

[0080]

[0081] Among them, ||·|| F It represents the Fronebius norm, which is to find the square root of the sum of the squares of the elements of the matrix. represents the output result of the initial fully connected layer, and X represents the actual result of the training data.

[0082] According to the above constraints, the total loss function of the sequence X corresponding to the input data to be trained is It can be formalized as:

[0083]

[0084] The first optional embodiment of the first embodiment uses the Gaussian distribution to directly simulate the association pattern of the normal time series through the initial time series association difference sub-model, instead of learning the association pattern of the unknown abnormal time point. This avoids the problem of greatly reducing the scale parameter of the Gaussian kernel caused by directly maximizing the association difference, and improves the accuracy of anomaly detection. The initial spatial association difference sub-model learns the association weight distribution between sensors under normal working conditions. In the learning stage, if the association distribution of a sensor is more inconsistent with the distribution learned in the training stage, it can be considered that the sensor is more likely to be abnormal. Based on this observation, it can not only add distinguishable information to the anomaly metric, but also assist in completing the task of locating the anomaly, so that the anomaly of the spatial dependency change can be directly detected. The anomaly score is determined by the sub-models of the two dimensions of time and space, and a richer feature space is obtained, which effectively avoids overfitting of normal data, improves the performance of the detector, and suppresses the generalization ability of the detector.

[0085] Embodiment 2

[0086] Figure 2 This is a flowchart of an abnormality detection method provided in Embodiment 2 of the present invention. This embodiment is a further refinement of the above embodiment. Figure 2 As shown, the method includes:

[0087] S210, obtaining the data to be detected, and performing multivariate time series preprocessing on the data to be detected to obtain time series data.

[0088] S220. Encode the time series data through the first sequence encoding module in the time series association difference sub-model to obtain first data.

[0089] In this embodiment, the first data can be understood as data processed by the first core module.

[0090] Specifically, the processor can encode the time series data through the first sequence encoding module in the time series association difference sub-model, such as sine cosine encoding, etc., to map time series of different lengths to dimensions of the same length in the spatial association difference sub-model to obtain first data.

[0091] S230. Process the first data through the temporal correlation difference attention module in the temporal correlation difference sub-model to determine the current temporal correlation data and the normal temporal correlation data to obtain the temporal correlation difference; wherein the temporal correlation difference attention module includes a pre-trained Gaussian kernel and a pre-trained first attention layer.

[0092] Specifically, the processor can process the first data through the pre-trained Gaussian kernel in the timing correlation difference attention module in the timing correlation difference sub-model to determine the normal timing correlation data, process the first data through the pre-trained first attention layer to obtain the current timing correlation data, and then determine the timing correlation difference through the normal timing correlation data and the current timing correlation data; wherein, the timing correlation difference attention module includes a pre-trained Gaussian kernel and a pre-trained first attention layer.

[0093] S240, processing the timing correlation difference through the first core module in the timing correlation difference sub-model of the pre-trained detection model to obtain a timing correlation anomaly score.

[0094] In this embodiment, the first core module can be understood as a trained initial first core module.

[0095] Specifically, the processor may process the timing correlation difference through the first core module in the timing correlation difference sub-model of the pre-trained detection model to obtain the timing correlation anomaly score.

[0096] S250. Encode the time series data through the second sequence encoding module of the spatial correlation difference sub-model to obtain second data.

[0097] Specifically, the processor can encode the time series data through the second sequence encoding module of the spatial correlation difference sub-model, such as sine-cosine encoding, etc., to map spatial sequences of different lengths to a dimension with the same length as in the time series correlation anomaly sub-model to obtain second data.

[0098] , S260, processing the second data through the spatial correlation difference attention module of the spatial correlation difference sub-model to obtain the spatial correlation difference; wherein the spatial correlation difference attention module includes a pre-trained sensor and a pre-trained second attention layer.

[0099] Specifically, the processor can process the second data through the pre-trained sensor in the spatial correlation difference attention module of the spatial correlation difference sub-model to obtain the normal spatial dependency, process the second data through the pre-trained second attention layer to obtain the current spatial dependency, and determine the spatial correlation difference through the normal spatial dependency and the current spatial dependency; wherein the spatial correlation difference attention module includes the pre-trained sensor and the pre-trained second attention layer.

[0100] S270 , processing the spatial correlation difference through the second core module of the spatial correlation difference sub-model to obtain a spatial correlation anomaly score.

[0101] In this embodiment, the second core module can be understood as an initial second core module after training.

[0102] Specifically, the processor may process the spatial correlation difference through the second core module of the spatial correlation difference sub-model to obtain the second data.

[0103] S280, reconstructing data according to the temporal correlation anomaly score and the spatial correlation anomaly score through the fully connected network of the pre-trained detection model to obtain the anomaly score at each time point.

[0104] For example, using the above formula,

[0105]

[0106] A r_s_t (X) = Softmax(dif temporal )⊙Ascore r_s (X)

[0107] Among them, ⊙ is the dot product operation, A r_s (X)∈R w×1 represents the spatial anomaly score at the tth time point calculated in combination with the spatial correlation difference, A r_s_t (X)∈R w×1Represents the anomaly score of the t-th time point calculated by combining the spatiotemporal correlation difference. If a certain anomaly point has a small reconstruction error, this criterion can still find the anomaly from the spatiotemporal correlation error with contextual information.

[0108] S290: Compare each anomaly score with a preset anomaly threshold to obtain an anomaly detection result.

[0109] The technical solution of this embodiment is to extract the time series features of the time series data through the first sequence encoding module, the time series difference attention module and the first core module in the time series correlation difference sub-model of the pre-trained detection model to obtain the time series correlation anomaly score; and to extract the spatial features of the time series data through the second sequence encoding module, the spatial correlation difference attention module and the second core module in the spatial correlation difference sub-model of the pre-trained detection model to obtain the spatial correlation anomaly score. Then, the two are reconstructed through a fully connected network to obtain an anomaly score, which is compared with the preset anomaly threshold to obtain an anomaly detection result. Anomalies are discovered from the perspective of spatiotemporal correlation, with better noise resistance, which improves the accuracy of the detection results.

[0110] For example, in order to demonstrate that the present invention has advantages in both performance and adaptability, the following experiments are performed for verification and analysis:

[0111] First, the experimental dataset adopts: Normal samples use three datasets: SWaT, WADI and MSL. The SWaT and WADI datasets are collected and open sourced by institutions, representing safe water treatment and water distribution scenarios, respectively. WADI provides a more comprehensive and realistic water treatment, storage and distribution network. MSL contains telemetry anomaly data derived from the accidental anomaly (ISA) report of the spacecraft monitoring system. After dividing it into training and test sets, the following table summarizes the statistics of these datasets.

[0112] Table 1 Dataset statistics

[0113] Dataset Dimensions Training set Test Set Abnormality rate SWaT 51 495000 449918 12.14％ WADI 127 118795 172803 5.77％ MSL 55 58317 73729 10.5％

[0114] In order to make the evaluation criteria clearer, precision (Pre), recall (Rec) and F1-score (F1) are used to evaluate the performance of the pre-trained detection model and the baseline on the test dataset. The formulas are as follows:

[0115]

[0116] where tp, fp and fn are the number of true positives, false positives and false negatives respectively.

[0117] Precision measures the false positive rate of the model, recall measures the false negative rate, and F1 score is an indicator that takes both into account. For these indicators, higher values ​​indicate better performance. This method selects a threshold based on the anomaly rate to evaluate the performance of the model.

[0118] In the experimental results, three evaluation indicators are used to show the performance of this method and other detectors (for example, this comparison includes LOF, iForest, AE, DAGMM, OmniAnomaly, USAD, MAD-GAN, MTAD-GAT, GDN, AnomalyTransformer and ranAD). The results show that this method is better than the detection effect of other detectors in all datasets. In particular, on the WADI dataset, which is more unbalanced and has higher dimensions than the SWaT and MSL datasets, this method surpasses the next best detector in terms of score. This shows that this method can handle a variety of real-world scenarios, including imbalanced and high-dimensional situations. The experimental results are shown in the following table:

[0119] Table 2 Results comparison table

[0120]

[0121]

[0122] Embodiment 3

[0123] Figure 3 This is a schematic diagram of the structure of an abnormality detection device provided in Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a data acquisition module 31, a first determination module 32, a second determination module 33, a third determination module 34 and a result determination module 35.

[0124] The data acquisition module 31 is used to acquire the data to be detected and perform multivariate time series preprocessing on the data to be detected to obtain time series data;

[0125] A first determination module 32 is used to perform time encoding on the time series data by using a time series correlation difference sub-model of a pre-trained detection model to obtain a time series correlation anomaly score;

[0126] A second determination module 33 is used to perform spatial encoding on the time series data by using the spatial correlation difference sub-model of the pre-trained detection model to determine a spatial correlation anomaly score;

[0127] A third determination module 34 is used to reconstruct data according to the temporal correlation anomaly score and the spatial correlation anomaly score through a fully connected network of the pre-trained detection model to obtain anomaly scores at each time point;

[0128] The result determination module 35 is used to compare each of the anomaly scores with a preset anomaly threshold to obtain an anomaly detection result.

[0129] The technical solution of the embodiment of the present invention obtains the data to be detected and performs multivariate time series preprocessing on the data to be detected to obtain time series data; the time series data is temporally encoded by the time series correlation difference submodel of the pre-trained detection model to obtain the time series correlation anomaly score; the time series data is spatially encoded by the spatial correlation difference submodel of the pre-trained detection model to determine the spatial correlation anomaly score; the data is reconstructed according to the time series correlation anomaly score and the spatial correlation anomaly score by the fully connected network of the pre-trained detection model to obtain the anomaly score at each time point; each anomaly score is compared with a preset anomaly threshold to obtain an anomaly detection result. The time series correlation anomaly score and the spatial correlation anomaly score are extracted respectively by using a dual-branch pre-trained detection model, and the information of the two is fused based on the fully connected network to complete the reconstruction of the data, discover anomalies from the perspective of time and space correlation, have better noise resistance, improve the accuracy of the detection results, and improve detection.

[0130] Furthermore, the first determining module is specifically configured to:

[0131] Processing the time series data by a first core module in the time series correlation difference sub-model of the pre-trained detection model to obtain first data;

[0132] The first data is processed by the temporal correlation difference attention module in the temporal correlation difference sub-model to determine the current temporal correlation data and the normal temporal correlation data to obtain the temporal correlation difference; wherein the temporal correlation difference attention module includes a pre-trained Gaussian kernel and a pre-trained first attention layer;

[0133] The temporal correlation difference is encoded by the first sequence encoding module in the temporal correlation difference sub-model to obtain a temporal correlation anomaly score.

[0134] Furthermore, the second determining module is specifically configured to:

[0135] Processing the time series data through a second core module of the spatial correlation difference sub-model to obtain second data;

[0136] Processing the second data by a spatial correlation difference attention module of the spatial correlation difference sub-model to obtain a spatial correlation difference; wherein the spatial correlation difference attention module includes a pre-trained sensor and a pre-trained second attention layer;

[0137] The spatial correlation difference is encoded by the second sequence encoding module of the spatial correlation difference sub-model to obtain a spatial correlation anomaly score.

[0138] Optionally, the device also includes: a model training module.

[0139] The model training module includes:

[0140] An information acquisition unit, used to acquire an initial detection model and a training sample set, wherein the initial detection model includes an initial temporal correlation difference sub-model, an initial spatial correlation difference sub-model and an initial fully connected network;

[0141] A data set acquisition unit, used for preprocessing the training sample set to obtain a data set to be trained;

[0142] A first determining unit, configured to iteratively train the initial time series correlation difference sub-model based on the to-be-trained data set and a preset optimizer to obtain a trained time series correlation difference sub-model;

[0143] A second determining unit is used to iteratively train the initial spatial correlation difference sub-model based on the to-be-trained data set, the preset optimizer and the preset spatial loss function to obtain a trained spatial correlation difference sub-model;

[0144] A third determining unit is used to iteratively train the initial fully connected network based on the first output result of the initial temporal correlation difference sub-model and the second output result of the initial spatial correlation difference sub-model during each iterative training and the preset optimizer to obtain a trained fully connected network;

[0145] The fourth determination unit is used to obtain a pre-trained detection model according to the temporal correlation difference sub-model, the spatial correlation difference sub-model and the fully connected network.

[0146] The initial temporal correlation difference sub-model includes an initial first sequence encoding module, an initial temporal attention module and an initial first core module. Accordingly, the first determination unit is specifically used for:

[0147] Inputting the data in the to-be-trained data set into the initial first sequence encoding module to obtain third data;

[0148] Inputting the third data into the initial Gaussian kernel in the initial temporal attention module to obtain a normal temporal association pattern;

[0149] Inputting the third data into the initial first attention layer in the initial temporal attention module to obtain a current temporal dependency pattern;

[0150] Determine a first loss function according to the normal timing association mode, the current timing dependency mode, the initial first core module and a preset timing loss function;

[0151] The initial time series correlation difference sub-model is trained according to the first loss function and the preset optimizer to obtain a trained time series correlation difference sub-model.

[0152] The initial spatial correlation difference sub-model includes an initial second sequence encoding module, an initial spatial attention module and an initial second core module. Accordingly, the second determination unit is specifically used for:

[0153] Inputting the data in the to-be-trained data set into the initial second sequence encoding module to obtain fourth data;

[0154] Inputting the fourth data into each initial sensor of the spatial association difference attention module to obtain a normal spatial dependency relationship; each of the initial sensors includes a learning embedding vector;

[0155] Inputting the fourth data into the initial second attention layer in the initial spatial attention module to obtain the current spatial dependency relationship;

[0156] Determine a second loss function according to the normal spatial dependency, the current spatial dependency, the initial second core module and the preset spatial loss function;

[0157] The initial spatial correlation difference sub-model is trained according to the second loss function and the preset optimizer to obtain a trained spatial correlation difference sub-model.

[0158] Further, the third determining unit is specifically configured to:

[0159] Inputting a first anomaly score in a first output result of the initial temporal association difference sub-model and a second anomaly score in a second output result of the initial spatial association difference sub-model into the initial fully connected network to obtain a third anomaly score;

[0160] determining a reconstruction error function according to the third anomaly score;

[0161] Determine a total loss function based on a first loss function in the first output result, a second loss function in the second output result, and the reconstruction error function;

[0162] The initial fully connected network is iteratively trained based on the total loss function and the preset optimizer to obtain a trained fully connected network.

[0163] The anomaly detection device provided in the embodiment of the present invention can execute the anomaly detection method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0164] Embodiment 4

[0165] Figure 4 A schematic diagram of the structure of an electronic device 40 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0166] like Figure 4 As shown, the electronic device 40 includes at least one processor 41, and a memory connected to the at least one processor 41, such as a read-only memory (ROM) 42, a random access memory (RAM) 43, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 41 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 42 or the computer program loaded from the storage unit 48 to the random access memory (RAM) 43. In the RAM 43, various programs and data required for the operation of the electronic device 40 can also be stored. The processor 41, the ROM 42, and the RAM 43 are connected to each other through a bus 44. An input / output (I / O) interface 45 is also connected to the bus 44.

[0167] A number of components in the electronic device 40 are connected to the I / O interface 45, including: an input unit 46, such as a keyboard, a mouse, etc.; an output unit 47, such as various types of displays, speakers, etc.; a storage unit 48, such as a disk, an optical disk, etc.; and a communication unit 49, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 49 allows the electronic device 40 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0168] The processor 41 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 41 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 41 performs the various methods and processes described above, such as an anomaly detection method.

[0169] In some embodiments, the anomaly detection method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 48. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 40 via the ROM 42 and / or the communication unit 49. When the computer program is loaded into the RAM 43 and executed by the processor 41, one or more steps of the anomaly detection method described above may be performed. Alternatively, in other embodiments, the processor 41 may be configured to perform the anomaly detection method in any other suitable manner (e.g., by means of firmware).

[0170] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0171] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0172] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0173] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0174] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0175] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0176] In one embodiment, the embodiment of the present invention further includes a computer program product, the computer program product includes a computer program, and the computer program implements the anomaly detection method of any embodiment of the present invention when executed by a processor.

[0177] In the process of implementation, the computer program product can be written in one or more programming languages ​​or a combination thereof to perform the computer program code of the present invention, including object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (for example, using an Internet service provider to connect through the Internet).

[0178] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0179] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An anomaly detection method, characterized in that: include: Acquire the data to be detected, and perform multivariate time series preprocessing on the data to be detected to obtain time series data; Time-encoding the time series data using a time series correlation difference sub-model of a pre-trained detection model to obtain a time series correlation anomaly score; Spatially encoding the time series data using the spatial correlation difference sub-model of the pre-trained detection model to determine a spatial correlation anomaly score; Reconstructing data according to the temporal correlation anomaly score and the spatial correlation anomaly score through the fully connected network of the pre-trained detection model to obtain anomaly scores at each time point; Each of the anomaly scores is compared with a preset anomaly threshold to obtain an anomaly detection result.

2. The method according to claim 1, characterized in that The time series data is time-encoded by the time series correlation difference sub-model of the pre-trained detection model to obtain a time series correlation anomaly score, including: Encoding the time series data through the first sequence encoding module in the time series association difference sub-model to obtain first data; The first data is processed by the temporal correlation difference attention module in the temporal correlation difference sub-model to determine the current temporal correlation data and the normal temporal correlation data to obtain the temporal correlation difference; wherein the temporal correlation difference attention module includes a pre-trained Gaussian kernel and a pre-trained first attention layer; The timing correlation difference is processed by the first core module in the timing correlation difference sub-model of the pre-trained detection model to obtain a timing correlation anomaly score.

3. The method according to claim 1, characterized in that The spatially encoding the time series data by using the spatial correlation difference sub-model of the pre-trained detection model to determine the spatial correlation anomaly score includes: Encoding the time series data by a second sequence encoding module of the spatial correlation difference sub-model to obtain second data; Processing the second data by a spatial correlation difference attention module of the spatial correlation difference sub-model to obtain a spatial correlation difference; wherein the spatial correlation difference attention module includes a pre-trained sensor and a pre-trained second attention layer; The spatial correlation difference is processed by the second core module of the spatial correlation difference sub-model to obtain a spatial correlation anomaly score.

4. The method according to claim 1, characterized in that The training steps of the pre-trained detection model include: Acquire an initial detection model and a training sample set, wherein the initial detection model includes an initial temporal correlation difference sub-model, an initial spatial correlation difference sub-model and an initial fully connected network; Preprocessing the training sample set to obtain a data set to be trained; Iteratively training the initial time series correlation difference sub-model based on the to-be-trained data set and a preset optimizer to obtain a trained time series correlation difference sub-model; Iteratively training the initial spatial correlation difference sub-model based on the to-be-trained data set, the preset optimizer and the preset spatial loss function to obtain a trained spatial correlation difference sub-model; Iteratively training the initial fully connected network based on the first output result of the initial temporal correlation difference sub-model and the second output result of the initial spatial correlation difference sub-model during each iterative training and the preset optimizer to obtain a trained fully connected network; A pre-trained detection model is obtained according to the temporal correlation difference sub-model, the spatial correlation difference sub-model and the fully connected network.

5. The method according to claim 4, characterized in that The initial temporal association difference sub-model includes an initial first sequence encoding module, an initial temporal attention module and an initial first core module. Accordingly, the initial temporal association difference sub-model is trained based on the to-be-trained data set and the preset optimizer to obtain the trained temporal association difference sub-model, including: Inputting the data in the to-be-trained data set into the initial first sequence encoding module to obtain third data; Inputting the third data into the initial Gaussian kernel in the initial temporal attention module to obtain a normal temporal association pattern; Inputting the third data into the initial first attention layer in the initial temporal attention module to obtain a current temporal dependency pattern; Determine a first loss function according to the normal timing association mode, the current timing dependency mode, the initial first core module and a preset timing loss function; The initial time series correlation difference sub-model is trained according to the first loss function and the preset optimizer to obtain a trained time series correlation difference sub-model.

6. The method according to claim 4, characterized in that The initial spatial correlation difference sub-model includes an initial second sequence encoding module, an initial spatial attention module and an initial second core module. Accordingly, the initial spatial correlation difference sub-model is trained based on the to-be-trained data set and the preset optimizer to obtain the trained spatial correlation difference sub-model, including: Inputting the data in the to-be-trained data set into the initial second sequence encoding module to obtain fourth data; Inputting the fourth data into each initial sensor of the spatial association difference attention module to obtain a normal spatial dependency relationship; each of the initial sensors includes a learning embedding vector; Inputting the fourth data into the initial second attention layer in the initial spatial attention module to obtain the current spatial dependency relationship; Determine a second loss function according to the normal spatial dependency, the current spatial dependency, the initial second core module and the preset spatial loss function; The initial spatial correlation difference sub-model is trained according to the second loss function and the preset optimizer to obtain a trained spatial correlation difference sub-model.

7. The method according to claim 4, characterized in that The iterative training of the initial fully connected network based on the first output result of the initial temporal correlation difference sub-model and the second output result of the initial spatial correlation difference sub-model during each iterative training and the preset optimizer to obtain a trained fully connected network includes: Inputting a first anomaly score in a first output result of the initial temporal association difference sub-model and a second anomaly score in a second output result of the initial spatial association difference sub-model into the initial fully connected network to obtain a third anomaly score; determining a reconstruction error function according to the third anomaly score; Determine a total loss function based on a first loss function in the first output result, a second loss function in the second output result, and the reconstruction error function; The initial fully connected network is iteratively trained based on the total loss function and the preset optimizer to obtain a trained fully connected network.

8. An abnormality detection device, characterized in that: include: A data acquisition module is used to acquire the data to be detected and perform multivariate time series preprocessing on the data to be detected to obtain time series data; A first determination module is used to time-code the time series data through a time series correlation difference sub-model of a pre-trained detection model to obtain a time series correlation anomaly score; A second determination module is used to spatially encode the time series data through the spatial correlation difference sub-model of the pre-trained detection model to determine a spatial correlation anomaly score; A third determination module is used to reconstruct data according to the temporal correlation anomaly score and the spatial correlation anomaly score through a fully connected network of the pre-trained detection model to obtain anomaly scores at each time point; The result determination module is used to compare each of the anomaly scores with a preset anomaly threshold to obtain an anomaly detection result.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can perform the abnormality detection method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the anomaly detection method according to any one of claims 1 to 7 when executed.

Images