Satellite time series data anomaly detection method and system

Abstract

The invention discloses a satellite time series data anomaly detection method and system. The method comprises the following steps: acquiring to-be-detected satellite time series data; constructing a variational auto-encoder, and replacing an encoder network and a decoder network of the variational auto-encoder with a bidirectional LSTM network; wherein distribution parameters of the hidden space of the features are determined through a gating mechanism of the bidirectional LSTM network; performing back propagation on the distribution parameters through a bidirectional LSTM network to generate a new potential variable, and reconstructing an input sequence of satellite time sequence data through variation inference; inputting to-be-detected satellite time sequence data into the trained variational auto-encoder to obtain reconstructed satellite time sequence data; the cosine similarity is adjusted by analyzing the similarity of the distance and the angle of the reconstructed satellite time series data, and the adjusted cosine similarity serves as a reconstruction error; and comparing the reconstruction error with a set error threshold value, and determining abnormal data. According to the method, the accuracy and robustness of data anomaly detection can be improved.

Description

Technical Field

[0001] The present invention relates to the field of anomaly detection and deep learning technology, and more specifically to a satellite time series data anomaly detection method and system based on variational autoencoder. Background Art

[0002] Satellite systems play an important role in the aerospace field. The challenges faced by satellites in orbit are not limited to the reliability of their internal systems, but also include the variability and potential danger of the external environment. Therefore, the research and application of satellite system anomaly detection and fault diagnosis technology is the key to ensure the efficient and stable operation of satellite systems.

[0003] Traditional methods for anomaly detection and fault diagnosis of satellite telemetry data mainly include threshold-based and simple rule-based methods, model-based methods, and data-driven methods. These methods each have their own unique characteristics and applicable scenarios, and can effectively assist ground operators in monitoring and ensuring the stable operation of satellite systems. Among them, the threshold-based method is a traditional and widely used satellite data anomaly detection method. This method relies on engineers to manually review sensor data to determine whether it is within a pre-set normal range. Any data exceeding the threshold is considered an anomaly. The model-based method mainly builds a suitable anomaly detection model. Common methods include autoregressive models, hidden Markov models HMM, and Bayesian models BN. This is achieved by calculating the distance between each data point and its adjacent points. The data-driven method covers a variety of machine learning classifiers, including support vector machines SVM, Bayesian classifiers, and artificial neural networks ANN, which automatically extract features from data and identify complex patterns, with higher accuracy and efficiency than traditional methods.

[0004] However, since the time series data of the satellite system changes dynamically in real time, the traditional anomaly detection and fault diagnosis methods of satellite telemetry data will encounter the problem of gradient vanishing or gradient exploding when processing long sequence data, which makes it difficult to effectively capture the long-term dependencies of the data, and cannot effectively learn and capture the potential characteristics and abnormal patterns of the sequence data, affecting the accuracy and robustness of anomaly detection, thereby affecting the dynamic change trends in the simulated time series data. Summary of the invention

[0005] In response to the problems existing in the above-mentioned fields, the present invention proposes a satellite time series data anomaly detection method and system, which can solve the technical problems that the traditional satellite telemetry data anomaly detection and fault diagnosis methods encounter gradient vanishing or gradient exploding problems when processing long sequence data due to the real-time dynamic changes of the satellite system's time series data, resulting in difficulty in effectively capturing the long-term dependencies of the data, and unable to effectively learn and capture the potential features and abnormal patterns of the sequence data, affecting the accuracy and robustness of anomaly detection.

[0006] In order to solve the above technical problems, the present invention discloses a satellite time series data anomaly detection method, comprising the following steps:

[0007] Obtaining satellite time series data to be detected;

[0008] Construct a variational autoencoder, and replace the encoder and decoder networks of the variational autoencoder with a bidirectional LSTM network. The gating mechanism of the bidirectional LSTM network is used to extract the time-dependent features of the satellite time series data, and determine the distribution parameters of the latent space of the features. The bidirectional LSTM network is then used to back-propagate the distribution parameters to generate new latent variables, and the input sequence of the satellite time series data is reconstructed through variational inference.

[0009] Input the satellite time series data to be detected into the trained variational autoencoder to obtain reconstructed satellite time series data;

[0010] By analyzing the similarity of distance and angle of reconstructed satellite time series data, the cosine similarity is adjusted, and the adjusted cosine similarity is used as the reconstruction error;

[0011] The reconstruction error is compared with the set error threshold. When the reconstruction error is greater than the error threshold, it is determined to be abnormal data.

[0012] Preferably, the replacement process of the encoder comprises the following steps:

[0013] The encoder's task is to convert satellite time series data into a latent variable. The bidirectional LSTM network captures the temporal dependency in the sequence data by combining forward and backward LSTM units. The bidirectional LSTM network introduces memory units and gating mechanisms, including input gates, forget gates, and output gates.

[0014] Among them, the forget gate determines how much previous information should be forgotten at the current moment, the input gate determines how much new information should be added to the memory unit at the current moment, and the output gate determines how much information in the memory unit should be output at the current moment. By remembering long-term information and selectively forgetting irrelevant information, longer sequences can be processed.

[0015] Preferably, the replacement process of the decoder comprises the following steps:

[0016] The task of the decoder is to generate new latent variables by back-propagating the distribution parameters through the bidirectional LSTM network, convert the generated new latent variables back to the original input sequence, and the decoder generates the output sequence step by step, generating the output of the current time step at each step and using the output as the input of the next time step.

[0017] Preferably, the determining of the distribution parameters of the latent space of the feature comprises the following steps:

[0018] The satellite time series data to be detected is sampled using a sliding window as the input data sequence and sent to the encoder. The bidirectional LSTM network captures the time-dependent features in the input data sequence through a gating mechanism and outputs the distribution parameters of the latent space, including the mean and variance.

[0019] Preferably, the generating new latent variables by back propagation through a bidirectional LSTM network comprises the following steps:

[0020] Use the encoder to mine the posterior distribution of the latent variables, sample the latent variables of the variational autoencoder by reparameterization, and split the sampling process into differentiable parts;

[0021] A bidirectional LSTM network is introduced as a decoder. When processing long sequence data, when encountering the problem of gradient disappearance or gradient explosion, the bidirectional LSTM network is back-propagated to learn and capture the semantic and structural features of the sequence data, simulate the dynamic changes and trends in the time series data, and generate new latent variables.

[0022] Preferably, reconstructing the input sequence of satellite time series data by variational inference comprises the following steps:

[0023] By maximizing the conditional probability p(x s |z s ), the variational autoencoder assumes a conditional probability distribution p(x s |z s ) to get z s The distribution parameters of , and the conditional probability distribution cannot be directly obtained;

[0024] The variational autoencoder uses the Bayesian variational inference method to construct a Gaussian distribution q(z s |x s ) is used to sample the potential factors. The sampling parameters of the Gaussian distribution are two k-dimensional vectors, which are the mean μ and standard deviation σ generated by the neural network.

[0025] Use KL divergence to calculate whether the distribution generated by the encoder is close to the standard distribution. The encoder calculates q(z s |x s), replacing the true posterior probability p(x s |z s ), the calculation formula of KL divergence is:

[0026]

[0027] Based on the KL divergence being always greater than 0, we get:

[0028] logp(x s )≥L(x s )

[0029] Among them, L(x s ) is defined as follows:

[0030]

[0031] This formula is the evidence lower bound of the variational autoencoder, where q(z s |x s ) is the approximate posterior distribution, p(x s |z s ) is the true posterior distribution;

[0032] When the evidence lower bound is maximized, logp(x s ) will also be maximized;

[0033] In the variational autoencoder, the encoder calculates the mean μ and standard deviation σ of the Gaussian distribution, randomly samples the Gaussian distribution, and uses the reparameterization technique to reparameterize the latent factor z by introducing a random variable ε. The reparameterization process specifically includes:

[0034] z=μ+ε*σ

[0035] Among them, ε~N(0,1);

[0036] When performing anomaly detection, the basic idea of ​​variational autoencoders is to learn the latent representation of normal data and use the learned latent representation to generate or reconstruct data.

[0037] Preferably, the adjusting the cosine similarity comprises the following steps:

[0038] Assume that the components of vector a are a1, a2, …, a n , the components of vector b are b1, b2, …, b n , then the dot product of vector a and vector b is expressed as:

[0039] a·b=a1b1+a2b2+…+a n b n

[0040] The norm of a vector is expressed as the square root of the sum of the squares of its components, that is:

[0041]

[0042] The cosine similarity between vector a and vector b is obtained as:

[0043]

[0044] The value range of cosine similarity is [-1,1]; when the cosine similarity is close to 0, it indicates that the angle between the two vectors is close to 90 degrees; when the cosine similarity is close to -1, it indicates that the angle between the two vectors is close to 180 degrees and the directions are basically opposite;

[0045] In order to measure the cosine similarity, the distance calculated by the cosine similarity is transformed according to the following formula:

[0046] Cos_distance(a,b)=1-cosine similarity (a, b)

[0047] Among them, the range of Cos_distance(a, b) is [0, 2]; the larger the distance value, the greater the difference;

[0048] Before calculating the cosine similarity using Cos_distance(a, b), vector a and vector b are decentralized, that is, the mean is subtracted from the vector in each direction, and the adjusted cosine similarity is obtained as follows:

[0049] DCos=A(Cos_distance(a,b))+A(∑w i (a i -b i ) 2 ).

[0050] Among them, A is the normalization function, w i is the weight of each dimension, (a i -b i ) 2 is the distance between two points in each dimension.

[0051] Preferably, the method further includes performing missing value processing, data normalization and standardization processing on the acquired satellite time series data to be detected, specifically including:

[0052] Identify the missing items in the data set, calculate the average of the existing values ​​for each variable, and use the average to fill the missing values ​​of the same variable; after filling, standardize the data by confirming the original properties and distribution of the data. The standardization formula is:

[0053]

[0054] Among them, x is the original data, μ is the mean of the data, σ is the standard deviation of the data, and z is the standardized data;

[0055] The data normalization formula is:

[0056]

[0057] Among them, x is the original data, x norm is the processed data, min(x) and max(x) are the minimum and maximum values ​​in the original data.

[0058] Preferably, a satellite time series data anomaly detection system is also included, comprising:

[0059] A data acquisition module is used to obtain the satellite time series data to be detected;

[0060] A variational autoencoder building module is used to replace the encoder and decoder networks of the variational autoencoder with a bidirectional LSTM network. The gating mechanism of the bidirectional LSTM network is used to extract the time-dependent features of the satellite time series data and determine the distribution parameters of the latent space of the features. The bidirectional LSTM network is then used to back-propagate the distribution parameters to generate new latent variables, and the input sequence of the satellite time series data is reconstructed through variational inference.

[0061] A reconstructed data acquisition module is used to input the satellite time series data to be detected into the trained variational autoencoder to obtain reconstructed satellite time series data;

[0062] The anomaly detection module is used to adjust the cosine similarity by analyzing the similarity of the distance and angle of the reconstructed satellite time series data, and use the adjusted cosine similarity as the reconstruction error; compare the reconstruction error with the set error threshold, and when the reconstruction error is greater than the error threshold, it is determined to be abnormal data.

[0063] Compared with the prior art, the present invention has the following beneficial effects:

[0064] The satellite time series data anomaly detection method proposed in the present invention can break through the problem of gradient vanishing or gradient exploding in the traditional satellite telemetry data anomaly detection and fault diagnosis method when processing long sequence data, which makes it difficult to effectively capture the long-term dependency of the data, and cannot effectively learn and capture the potential characteristics and abnormal patterns of the sequence data, affecting the accuracy and robustness of anomaly detection. The method uses the constructed variational autoencoder, the variational autoencoder VAE to reconstruct the normal data distribution, and combines the bidirectional LSTM network to improve the ability to mine the long-term correlation of the data. The bidirectional LSTM network is combined with the VAE, and the bidirectional LSTM network can be better used to learn the representation and time series pattern of the data, thereby improving the performance of the anomaly detection model and making the anomaly detection result more accurate. The similarity of distance and angle is considered for the data on each dimension of the input sequence, the cosine similarity is adjusted, and the adjusted cosine similarity is used as the reconstruction error, which comprehensively considers the influence of distance, angle and each dimension data on whether the data is abnormal. Compared with the traditional method, the difference between the reconstructed data and the abnormal data is measured by the adjusted cosine similarity, and the calculated similarity is more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0065] Figure 1 It is a schematic diagram of the overall method flow of the present invention;

[0066] Figure 2 This is the architecture diagram of the LSTM-VAE anomaly detection model of the present invention. DETAILED DESCRIPTION

[0067] The following will be combined with the attached embodiment of the present invention Figure 1-2 , the technical solutions in the embodiments of the present invention are clearly and completely described. It should be understood that the terms described in the present invention are only used to describe specific implementation methods and are not used to limit the present invention.

[0068] like Figure 1 As shown, a satellite time series data anomaly detection method provided by an embodiment of the present invention includes the following steps:

[0069] S1: Obtain the satellite time series data to be detected;

[0070] S2: Construct a variational autoencoder and replace the encoder and decoder networks of the variational autoencoder with a bidirectional LSTM network. The gating mechanism of the bidirectional LSTM network is used to extract the time-dependent features of the satellite time series data and determine the distribution parameters of the latent space of the features. The bidirectional LSTM network is then used to back-propagate the distribution parameters to generate new latent variables, and the input sequence of the satellite time series data is reconstructed through variational inference.

[0071] S3: Input the satellite time series data to be detected into the trained variational autoencoder to obtain the reconstructed satellite time series data;

[0072] S4: By analyzing the similarity of the distance and angle of the reconstructed satellite time series data, the cosine similarity is adjusted, and the adjusted cosine similarity is used as the reconstruction error;

[0073] S5: Compare the reconstruction error with the set error threshold. When the reconstruction error is greater than the error threshold, it is determined to be abnormal data.

[0074] In step S1, the acquired satellite time series data to be detected is preprocessed, including missing value processing, data normalization and standardization processing.

[0075] Since there is missing data in the dataset at the alternating moments of charging and discharging, it is necessary to process the missing values. This application uses the mean substitution method to process the missing data. Its main advantage is that it is simple to operate and can maintain the characteristics of the sample group without introducing additional noise. The specific operation process is as follows:

[0076] Identify the missing items in the data set, calculate the average of the existing values ​​for each variable, and use the average to fill the missing values ​​of the same variable; after filling, standardize the data by confirming the original properties and distribution of the data. The standardization formula is:

[0077]

[0078] Among them, x is the original data, μ is the mean of the data, σ is the standard deviation of the data, and z is the standardized data;

[0079] The purpose of data normalization is to convert data to a fixed range, usually [0, 1] or [-1, 1]. The data normalization formula is:

[0080]

[0081] Among them, x is the original data, x norm is the processed data, min(x) and max(x) are the minimum and maximum values ​​in the original data. The normalized data falls within a fixed range, which helps to avoid being affected by outliers while retaining the distribution characteristics of the original data.

[0082] Variational Autoencoder VAE is based on the combination of variational inference and autoencoder. Like autoencoder AE, variational autoencoder consists of two parts: decoder and encoder.

[0083] VAE introduces the concept of latent variables, which are used as the output of the encoder during training and are used to generate the input of the decoder. The introduction of latent variables enables VAE to learn a more meaningful and structured representation of the data.

[0084] VAE uses variational inference to train the model. During variational inference, the model mines the distribution of latent variables. This process involves maximizing the marginal likelihood of the observed data, that is, the probability of the observed data. An encoder is used to mine the posterior distribution of the latent variables.

[0085] In order to make the gradient descent optimization process effective, VAE uses a reparameterization technique, which reparameterizes the sampling process of latent variables so that the gradient can be back-propagated through the network. Since general random sampling operations are not differentiable in back-propagation, this application uses the reparameterization technique to split the sampling process into differentiable parts for back-propagation.

[0086] Although VAE can capture a certain degree of temporal dependency when processing sequence data, it encounters the problem of gradient vanishing or gradient exploding when processing long sequence data, making it difficult to effectively capture long-term dependencies.

[0087] This application uses a bidirectional LSTM network as the network structure of the VAE anomaly detection model, mainly considering that the bidirectional LSTM network has a gating mechanism that can effectively capture long-term dependencies, thereby improving the performance of the model on sequence data. By introducing a bidirectional LSTM network as a decoder, the quality and continuity of the generated sequence data can be improved, because the bidirectional LSTM network can better learn and capture the semantic and structural features of sequence data, and can better simulate the dynamic changes and trends in time series data, thereby improving the model's effectiveness in time series data modeling.

[0088] The encoder's task is to convert satellite time series data into a latent variable. The bidirectional LSTM network captures the temporal dependency in the sequence data by combining forward and backward LSTM units. The bidirectional LSTM network introduces memory units and gating mechanisms, including input gates, forget gates, and output gates.

[0089] Among them, the forget gate determines how much previous information should be forgotten at the current moment, the input gate determines how much new information should be added to the memory unit at the current moment, and the output gate determines how much information in the memory unit should be output at the current moment. It can effectively alleviate the gradient vanishing problem of the RNN network, remember long-term information, and selectively forget irrelevant information, so it can process longer sequences.

[0090] The task of the decoder is to generate new latent variables by back-propagating the distribution parameters through the bidirectional LSTM network, convert the generated new latent variables back to the original input sequence, and the decoder generates the output sequence step by step, generating the output of the current time step at each step and using the output as the input of the next time step.

[0091] By combining the bidirectional LSTM network with VAE, the bidirectional LSTM network can be better utilized to learn the representation and temporal patterns of data, thereby improving the performance of the anomaly detection model.

[0092] In step S2, the distribution parameters of the latent space of the feature are determined, including the following steps:

[0093] The acquired satellite time series data to be detected is sampled using a sliding window as the input data sequence and sent to the encoder. The bidirectional LSTM network attempts to capture the time-dependent features in the input data sequence through a gating mechanism. The encoder outputs the distribution parameters of the latent space, including the mean and variance.

[0094] Backpropagation through the bidirectional LSTM network generates new latent variables, including the following steps:

[0095] The encoder is used to mine the posterior distribution of latent variables, and the latent variables of the variational autoencoder are sampled by reparameterization, and the sampling process is split into differentiable parts to make this process differentiable for backpropagation. A bidirectional LSTM network is introduced as a decoder. When processing long sequence data, when encountering the problem of gradient disappearance or gradient explosion, the bidirectional LSTM network is backpropagated to learn and capture the semantic and structural features of the sequence data, simulate the dynamic changes and trends in the time series data, and generate new latent variables.

[0096] The reconstruction error and KL divergence are calculated by reconstructing the input sequence to optimize the model parameters during the training process. Reconstructing the input sequence of satellite time series data by variational inference specifically includes the following steps:

[0097] Variational Autoencoders (VAEs) use variational inference to train models. During variational inference, the model mines the distribution of latent variables. This process involves maximizing the marginal likelihood of the observed data, which is the probability of the observed data. An encoder is used to mine the posterior distribution of the latent variables.

[0098] In order to make the gradient descent optimization process work effectively, VAE uses the reparameterization technique. This technique reparameterizes the sampling process of the latent variables so that the gradient can be back-propagated through the network. This is because the general random sampling operation is not differentiable in back propagation, and the reparameterization technique can split the sampling process into differentiable parts.

[0099] The process of reconstructing data can be achieved by maximizing the conditional probability p(x s |z s ), the variational autoencoder assumes a conditional probability distribution p(x s |z s ) to get z s The distribution parameters of the conditional probability distribution cannot be directly obtained. VAE uses the Bayesian variational inference method to construct a Gaussian distribution q(z s |x s ) is used to sample the potential factors. The sampling parameters of the Gaussian distribution are two k-dimensional vectors, which are the mean μ and standard deviation σ generated by the neural network.

[0100] Use KL divergence to calculate whether the distribution generated by the encoder is close to the standard distribution. The encoder calculates q(z s |x s ), replacing the true posterior probability p(x s |z s ), the calculation formula of KL divergence is:

[0101]

[0102] where KL(q(z s |x s )||p(x s |z s ))KL divergence, z s is a hidden variable, x s is the observed data. Based on the KL divergence being always greater than 0, we get:

[0103] logp(x s )≥L(x s )

[0104] Among them, L(x s ) is the evidence lower bound (ELBO), which is defined as follows:

[0105]

[0106] This formula is the evidence lower bound of the variational autoencoder, where q(z s |x s ) is the approximate posterior distribution, p(x s |z s ) is the true posterior distribution; when the evidence lower bound is maximized, logp(x s ) will also be maximized;

[0107] In the variational autoencoder, the encoder calculates the mean μ and standard deviation σ of the Gaussian distribution and randomly samples the Gaussian distribution. However, random sampling is a discontinuous process, which makes it impossible to calculate its derivatives, and therefore it is impossible to train the parameters of the VAE through back propagation. To solve this problem, VAE uses the reparameterization technique to reparameterize the latent factor z by introducing a random variable ε. The reparameterization process specifically includes:

[0108] z=μ+ε*σ

[0109] Among them, ε~N(0,1);

[0110] When performing anomaly detection, the basic idea of ​​the variational autoencoder is to learn the latent representation of normal data and use the learned latent representation to generate or reconstruct data. Abnormal data usually has a large reconstruction error in the latent space, so anomalies can be identified by comparing the difference between the original data and the reconstructed data. The VAE anomaly detection model hopes to reconstruct normal data with a small reconstruction error, so it can be used to determine whether it is abnormal data.

[0111] In the VAE anomaly detection model, the reconstruction error is compared with the set threshold. When the reconstruction error is greater than the error threshold, it is judged as abnormal data, otherwise it is normal data, so as to determine whether the data to be detected is abnormal data. There are many ways to measure the difference between reconstructed data and abnormal data. The present invention uses cosine similarity to measure the reconstruction error.

[0112] Cosine similarity is used to measure the cosine value of the angle between two vectors and is usually used to calculate the similarity between high-dimensional data. When calculating cosine similarity, the direction of the vector is mainly considered rather than the size, so it is applicable to vectors of any length.

[0113] Assume that the components of vector a are a1, a2, …, a n , the components of vector b are b1, b2, …, b n , then the dot product of vector a and vector b is expressed as:

[0114] a·b=a1b1+a2b2+…+a n b n

[0115] The norm of a vector is expressed as the square root of the sum of the squares of its components, that is:

[0116]

[0117] The cosine similarity between vector a and vector b is obtained as:

[0118]

[0119] The value range of cosine similarity is [-1,1]; when the cosine similarity is close to 0, it indicates that the angle between the two vectors is close to 90 degrees; when the cosine similarity is close to -1, it indicates that the angle between the two vectors is close to 180 degrees and the directions are basically opposite.

[0120] Cosine similarity only considers the directionality of the vector, not its length. As a result, even when two vectors have different lengths, their cosine similarity may be very high, because as long as their directions are similar, the cosine similarity will be close to 1, because cosine similarity ignores the actual distance difference between the vectors.

[0121] In order to measure the cosine similarity, the distance calculated by the cosine similarity is transformed according to the following formula:

[0122] Cos_distance(a,b)=1-cosine similarity (a, b)

[0123] Among them, the range of Cos_distance(a, b) is [0, 2]; the larger the distance value, the greater the difference;

[0124] Since cosine similarity does not take into account the differences in the impact of vectors in different dimensions on whether the data is abnormal, the present invention designs a similarity calculation method that simultaneously considers distance, angle and data of each dimension based on the need to comprehensively consider the impact of distance, angle and data of each dimension on whether the data is abnormal, namely, distance cosine similarity. By weighting the length similarity and direction similarity of the vectors, a weighted cosine similarity is obtained to measure the difference between the reconstructed data and the abnormal data.

[0125] Before calculating the cosine similarity using Cos_distance(a, b), vector a and vector b are decentralized, that is, the mean is subtracted from the vector in each direction, and the adjusted cosine similarity is obtained as follows:

[0126] DCos=A(Cos_distance(a,b))+A(∑w i (a i -b i ) 2 ).

[0127] Among them, A is the normalization function, w i is the weight of each dimension, (a i -b i ) 2 It is the distance between two points in each dimension, so the distance factor is added to measure the similarity.

[0128] Based on the satellite time series data anomaly detection method proposed in this application, a satellite time series data anomaly detection system is also proposed, including:

[0129] A data acquisition module is used to obtain the satellite time series data to be detected;

[0130] A variational autoencoder building module is used to replace the encoder and decoder networks of the variational autoencoder with a bidirectional LSTM network. The gating mechanism of the bidirectional LSTM network is used to extract the time-dependent features of the satellite time series data and determine the distribution parameters of the latent space of the features. The bidirectional LSTM network is then used to back-propagate the distribution parameters to generate new latent variables, and the input sequence of the satellite time series data is reconstructed through variational inference.

[0131] A reconstructed data acquisition module is used to input the satellite time series data to be detected into the trained variational autoencoder to obtain reconstructed satellite time series data;

[0132] The anomaly detection module is used to adjust the cosine similarity by analyzing the similarity of the distance and angle of the reconstructed satellite time series data, and use the adjusted cosine similarity as the reconstruction error; compare the reconstruction error with the set error threshold, and when the reconstruction error is greater than the error threshold, it is determined to be abnormal data.

[0133] Example

[0134] (1) Dataset processing

[0135] The collected satellite time series data set is preprocessed, mainly including missing value processing, data normalization and standardization, and the preprocessed data is divided into a training set and a test set, with the ratio of training set to test set being 7:3.

[0136] (2) Model training

[0137] The data set is sampled using a sliding window, and the input sequence is sent to the encoder (bidirectional LSTM network). The bidirectional LSTM network attempts to capture the temporal dependencies and features in the input data. The output of the encoder is used to determine the distribution parameters (mean and variance) of the latent space, and new latent variables are sampled from the distribution, while making this process differentiable for backpropagation. The decoder (bidirectional LSTM network) accepts the latent variables and attempts to reconstruct the input sequence, calculating the reconstruction loss (such as squared error loss) and KL divergence to optimize the model parameters during training.

[0138] (3) Anomaly Detection Model

[0139] The evaluation indicators are established and the model is iterated multiple times to obtain the trained anomaly detection model.

[0140] In the time series data anomaly detection experiment, it is crucial to evaluate the accuracy and effectiveness of the model performance. The evaluation indicators are accuracy, false positive rate, precision and recall. This article mainly uses recall and precision to measure the performance of the algorithm. The definitions are as follows:

[0141] (1) Recall refers to the proportion of all abnormal data that are detected. An increase in recall means that the model is better at covering all real anomalies and can reduce missed alarms.

[0142] (2) Accuracy means the proportion of all data that are correctly judged, including normal data judged as normal and abnormal data judged as abnormal. Although accuracy can intuitively reflect the overall performance of the model, its evaluation results may be misleading when facing an unbalanced data set, because even if the model only accurately identifies a large number of normal samples, it may obtain a high accuracy. In the task of anomaly detection, if normal data is detected as abnormal data, the system will have a false alarm phenomenon, and if abnormal data is detected as normal, the system will have a missed alarm phenomenon. For a high-precision and strict system such as satellites, missed alarms have a greater impact on the system than false alarms. However, if there are too many false alarms, subsequent investigations will consume too much time and energy. Therefore, this article mainly considers the recall rate of the model and secondarily considers the accuracy rate.

[0143] (4) Anomaly Detection

[0144] The trained anomaly detection model is used to perform anomaly detection on the test set, and the model performance is evaluated by analyzing the detection results.

[0145] Accuracy Recall Local Outlier Factor LOF 90.21％ 83.23％ Support Vector Machine (SVM) 65.20％ 61.30％ Autoencoder AE 82.41％ 81.21％ Variational Autoencoder VAE 87.64％ 84.26％ LSTM-VAE 88.21％ 86.62％

[0146] From the above table, we can see that from AE to VAE and then to LATM-VAE, both indicators have improved. The accuracy and recall of LSTM-VAE are 91.25% and 89.48% respectively. The results of both data are relatively good. In the satellite anomaly detection scenario, due to the unbalanced distribution of satellite data, there are fewer abnormal data, and most of the data sets are normal data. The effect of the support vector machine classification algorithm is poor when processing such data, and the encoder type of anomaly detection model has better performance. Compared with the LOF algorithm, although the accuracy rate is reduced, the recall rate of the LSTM-VAE model has a significant advantage, so there will be fewer missed alarms, which is more important for the anomaly detection model.

[0147] The above description is only a preferred specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any technician familiar with the technical field can make equivalent replacements or changes according to the technical scheme and inventive concept of the present invention within the technical scope disclosed by the present invention, which should be covered by the protection scope of the present invention.

[0148] In addition, unless otherwise specified, all technical and scientific terms used in the present invention have the same meanings as commonly understood by those skilled in the art to which the present invention belongs. All documents mentioned in this specification are incorporated by reference to disclose and describe the methods related to the documents. In the event of any conflict with any incorporated document, the content of this specification shall prevail.

Claims

1. A satellite time series data anomaly detection method, characterized in that: The following steps are involved: Obtaining satellite time series data to be detected; Construct a variational autoencoder, and replace the encoder and decoder networks of the variational autoencoder with a bidirectional LSTM network. The gating mechanism of the bidirectional LSTM network is used to extract the time-dependent features of the satellite time series data, and determine the distribution parameters of the latent space of the features. The bidirectional LSTM network is then used to back-propagate the distribution parameters to generate new latent variables, and the input sequence of the satellite time series data is reconstructed through variational inference. Input the satellite time series data to be detected into the trained variational autoencoder to obtain reconstructed satellite time series data; By analyzing the similarity of distance and angle of reconstructed satellite time series data, the cosine similarity is adjusted, and the adjusted cosine similarity is used as the reconstruction error; The reconstruction error is compared with the set error threshold. When the reconstruction error is greater than the error threshold, it is determined to be abnormal data.

2. The satellite time series data anomaly detection method according to claim 1, characterized in that: The replacement process of the encoder comprises the following steps: The encoder's task is to convert satellite time series data into a latent variable. The bidirectional LSTM network captures the temporal dependency in the sequence data by combining forward and backward LSTM units. The bidirectional LSTM network introduces memory units and gating mechanisms, including input gates, forget gates, and output gates. Among them, the forget gate determines how much previous information should be forgotten at the current moment, the input gate determines how much new information should be added to the memory unit at the current moment, and the output gate determines how much information in the memory unit should be output at the current moment. By remembering long-term information and selectively forgetting irrelevant information, longer sequences can be processed.

3. The satellite time series data anomaly detection method according to claim 1, characterized in that: The replacement process of the decoder comprises the following steps: The task of the decoder is to generate new latent variables by back-propagating the distribution parameters through the bidirectional LSTM network, convert the generated new latent variables back to the original input sequence, and the decoder generates the output sequence step by step, generating the output of the current time step at each step and using the output as the input of the next time step.

4. The satellite time series data anomaly detection method according to claim 3, characterized in that: The step of determining the distribution parameters of the latent space of the feature comprises the following steps: The satellite time series data to be detected is sampled using a sliding window as the input data sequence and sent to the encoder. The bidirectional LSTM network captures the time-dependent features in the input data sequence through a gating mechanism and outputs the distribution parameters of the latent space, including the mean and variance.

5. The satellite time series data anomaly detection method according to claim 4, characterized in that: The method of generating new latent variables through back propagation of the bidirectional LSTM network includes the following steps: Use the encoder to mine the posterior distribution of the latent variables, sample the latent variables of the variational autoencoder by reparameterization, and split the sampling process into differentiable parts; A bidirectional LSTM network is introduced as a decoder. When processing long sequence data, when encountering the problem of gradient disappearance or gradient explosion, the bidirectional LSTM network is back-propagated to learn and capture the semantic and structural features of the sequence data, simulate the dynamic changes and trends in the time series data, and generate new latent variables.

6. The satellite time series data anomaly detection method according to claim 5, characterized in that: The method of reconstructing the input sequence of satellite time series data by variational inference includes the following steps: By maximizing the conditional probability p(x s |z s ), the variational autoencoder assumes a conditional probability distribution p(x s |z s ) to get z s The distribution parameters of , and the conditional probability distribution cannot be directly obtained; The variational autoencoder uses the Bayesian variational inference method to construct a Gaussian distribution q(z s |x s ) is used to sample the potential factors. The sampling parameters of the Gaussian distribution are two k-dimensional vectors, which are the mean μ and standard deviation σ generated by the neural network. Use KL divergence to calculate whether the distribution generated by the encoder is close to the standard distribution. The encoder calculates q(z s |x s ), replacing the true posterior probability p(x s |z s ), the calculation formula of KL divergence is: Based on the KL divergence being always greater than 0, we get: logp(x s )≥L(x s ) Among them, L(x s ) is defined as follows: This formula is the evidence lower bound of the variational autoencoder, where q(z s |x s ) is the approximate posterior distribution, p(x s |z s ) is the true posterior distribution; When the evidence lower bound is maximized, logp(x s ) will also be maximized; In the variational autoencoder, the encoder calculates the mean μ and standard deviation σ of the Gaussian distribution, randomly samples the Gaussian distribution, and uses the reparameterization technique to reparameterize the latent factor z by introducing a random variable ε. The reparameterization process specifically includes: z=μ+ε*σ Among them, ε~N(0,1); When performing anomaly detection, the basic idea of ​​variational autoencoders is to learn the latent representation of normal data and use the learned latent representation to generate or reconstruct data.

7. The satellite time series data anomaly detection method according to claim 6, characterized in that: The step of adjusting the cosine similarity comprises the following steps: Assume that the components of vector a are a1, a2, …, a n , the components of vector b are b1, b2, …, b n , then the dot product of vector a and vector b is expressed as: a·b=a1b1+a2b2+…+a n b n The norm of a vector is expressed as the square root of the sum of the squares of its components, that is: The cosine similarity between vector a and vector b is obtained as: The value range of cosine similarity is [-1,1]; when the cosine similarity is close to 0, it indicates that the angle between the two vectors is close to 90 degrees; when the cosine similarity is close to -1, it indicates that the angle between the two vectors is close to 180 degrees and the directions are basically opposite; In order to measure the cosine similarity, the distance calculated by the cosine similarity is transformed according to the following formula: Cos_distance(a,b)=1-cosine similarity (a,b) Among them, the range of Cos_distance(a, b) is [0, 2]; the larger the distance value, the greater the difference; Before calculating the cosine similarity using Cos_distance(a, b), vector a and vector b are decentralized, that is, the mean is subtracted from the vector in each direction, and the adjusted cosine similarity is obtained as follows: DCos=A(Cos_distance(a,b))+A(∑w i (from i -b i ) 2 )。 Among them, A is the normalization function, w i is the weight of each dimension, (a i -b i ) 2 is the distance between two points in each dimension.

8. The satellite time series data anomaly detection method according to claim 7, characterized in that: It also includes missing value processing, data normalization and standardization of the acquired satellite time series data to be detected, including: Identify the missing items in the data set, calculate the average of the existing values ​​for each variable, and use the average to fill the missing values ​​of the same variable; after filling, standardize the data by confirming the original properties and distribution of the data. The standardization formula is: Among them, x is the original data, μ is the mean of the data, σ is the standard deviation of the data, and z is the standardized data; The data normalization formula is: Among them, x is the original data, x norm is the processed data, min(x) and max(x) are the minimum and maximum values ​​in the original data.

9. A satellite time series data anomaly detection system, characterized in that: include: A data acquisition module is used to obtain the satellite time series data to be detected; A variational autoencoder building module is used to replace the encoder and decoder networks of the variational autoencoder with a bidirectional LSTM network. The gating mechanism of the bidirectional LSTM network is used to extract the time-dependent features of the satellite time series data and determine the distribution parameters of the latent space of the features. The bidirectional LSTM network is then used to back-propagate the distribution parameters to generate new latent variables, and the input sequence of the satellite time series data is reconstructed through variational inference. A reconstructed data acquisition module is used to input the satellite time series data to be detected into the trained variational autoencoder to obtain reconstructed satellite time series data; The anomaly detection module is used to adjust the cosine similarity by analyzing the similarity of the distance and angle of the reconstructed satellite time series data, and use the adjusted cosine similarity as the reconstruction error; compare the reconstruction error with the set error threshold, and when the reconstruction error is greater than the error threshold, it is determined to be abnormal data.

Images