A method and system for identifying anomalies in time series data based on graph learning

Abstract

The present application provides a method and system for identifying anomalies in time series data based on graph learning, including: acquiring multidimensional time series data; preprocessing the multidimensional time series data to obtain preprocessed multidimensional time series data; obtaining a graph structure through graph structure learning based on the preprocessed multidimensional time series data; obtaining a predicted value through a time series prediction model based on a Bayesian network and graph attention based on the graph structure; calculating an anomaly score based on the predicted value; judging whether there is an anomaly based on the anomaly score to obtain an anomaly identification result.

Description

Technical Field

[0001] The present invention relates to the field of information technology, and in particular to a method and system for identifying anomalies in time series data based on graph learning. Background Art

[0002] Anomaly detection in multidimensional time series data faces the dual challenges of complexity and dynamics. Traditional methods often have difficulty in effectively capturing the complex correlations between multiple monitoring devices, and they also fail to fully utilize the dynamic characteristics of time series. This results in low detection accuracy and poor interpretability when processing high-dimensional, nonlinear, and non-stationary data in scenarios such as industrial monitoring or financial risk control. In particular, it becomes more difficult to accurately identify abnormal patterns in the presence of noise interference, sparse data, or equipment failure. In addition, how to uniformly represent and fuse heterogeneous data generated by different devices is also an urgent problem to be solved. With the expansion of monitoring scale and the increase of data dimensions, the computational complexity increases exponentially. How to improve the efficiency of the algorithm while ensuring the detection effect has become a thorny problem. In practical applications, the interpretability of anomaly detection results is crucial to subsequent decision-making, but most current methods find it difficult to give a clear analysis of the causes of anomalies. Therefore, how to design an anomaly detection method that can simultaneously take into account multidimensional correlation, time series dynamics, computational efficiency, and interpretability has become a core technical problem that needs to be broken through in this field. Summary of the invention

[0003] The present invention provides a method for identifying anomalies in time series data based on graph learning, which mainly includes:

[0004] Acquire multidimensional time series data; preprocess the multidimensional time series data to obtain preprocessed multidimensional time series data; obtain a graph structure through graph structure learning based on the preprocessed multidimensional time series data; obtain a predicted value through a time series prediction model based on a Bayesian network and graph attention based on the graph structure; calculate an anomaly score based on the predicted value; determine whether there is an anomaly based on the anomaly score to obtain an anomaly identification result.

[0005] Furthermore, the preprocessing of the multidimensional time series data includes: performing data denoising on the multidimensional time series data to obtain denoised multidimensional time series data; performing data normalization on the denoised multidimensional time series data to obtain normalized multidimensional time series data; and performing sliding segmentation on the normalized multidimensional time series data according to a preset time window to obtain preprocessed multidimensional time series data.

[0006] Furthermore, the data denoising processing of the multidimensional time series data includes: using a sliding mean filtering method to process the multidimensional time series data to remove high-frequency noise and obtain first denoised multidimensional time series data; using a median filtering method to process the first denoised multidimensional time series data to remove isolated noise points and obtain second denoised multidimensional time series data; using a Gaussian filtering method to process the second denoised multidimensional time series data to further smooth the data and obtain denoised multidimensional time series data.

[0007] Furthermore, the graph structure is obtained through graph structure learning based on the preprocessed multidimensional time series data, including: obtaining an embedding vector of a monitoring device, wherein the embedding vector of the monitoring device is used to represent a feature of the monitoring device; calculating the similarity between the monitoring devices based on the embedding vector of the monitoring device to obtain a similarity matrix; and constructing the graph structure based on the similarity matrix, wherein the nodes in the graph structure represent monitoring devices and the edges in the graph structure represent dependencies between the monitoring devices.

[0008] Furthermore, according to the graph structure, a predicted value is obtained through a time series prediction model based on a Bayesian network and graph attention, including: according to the graph structure, features are extracted through a Bayesian network to obtain Bayesian network features; the Bayesian network features are input into a graph attention model, neighbor node information is aggregated through the attention mechanism in the graph attention model, node features are updated, and updated node features are obtained; the updated node features are input into a fully connected layer, and data at future times are predicted through the fully connected layer to obtain a predicted value.

[0009] Furthermore, the calculation of the anomaly score according to the predicted value includes: obtaining the prediction error mean and covariance matrix in the training phase as features under the normal state; calculating the Mahalanobis distance between the prediction error in the test phase and the features under the normal state to obtain a Mahalanobis distance value; and using the Mahalanobis distance value as the anomaly score.

[0010] Furthermore, judging whether there is an abnormality based on the abnormality score and obtaining an abnormality identification result includes: comparing the abnormality score with a preset threshold; if the abnormality score is greater than or equal to the preset threshold, judging that there is an abnormality and obtaining an abnormal warning result; if the abnormality score is less than the preset threshold, judging that there is no abnormality.

[0011] The present invention also provides a time series data anomaly identification system based on graph learning, the system comprising:

[0012] Acquisition module, used to acquire multi-dimensional time series data;

[0013] A data preprocessing module, used for preprocessing the multidimensional time series data to obtain preprocessed multidimensional time series data;

[0014] A data processing module, used for obtaining a graph structure through graph structure learning according to the pre-processed multi-dimensional time series data;

[0015] A prediction module, used to obtain a prediction value according to the graph structure through a time series prediction model based on a Bayesian network and graph attention;

[0016] An anomaly score calculation module, used to calculate an anomaly score according to the predicted value;

[0017] The detection module is used to determine whether an abnormality exists according to the abnormality score and obtain an abnormality identification result.

[0018] The technical solution provided by the embodiment of the present invention may have the following beneficial effects:

[0019] The present invention discloses a multi-dimensional time series anomaly detection method based on a graph attention neural network. The method preprocesses and denoises the time series data of multiple monitoring devices, converts them into graph structure data, and generates an adjacency matrix in combination with pre-trained device embedding vectors. After extracting features through a Bayesian network, the graph attention neural network is used to aggregate and learn the node information, and finally outputs the prediction result. The present invention calculates the anomaly score and compares it with a preset threshold to judge the abnormal situation, thereby realizing effective analysis and anomaly detection of complex multi-dimensional time series data. This method integrates graph structure representation, attention mechanism and deep learning technology, can accurately capture the correlation between devices and the dynamic characteristics of time series, improves the accuracy and interpretability of anomaly detection, and provides strong technical support for industrial monitoring, financial risk control and other fields. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 The present invention is a flowchart of a method for identifying anomalies in time series data based on graph learning.

[0021] Figure 2 This is a framework diagram of a time series data anomaly identification system based on graph learning of the present invention. DETAILED DESCRIPTION

[0022] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0023] like Figure 1 -2. In this embodiment, a method for identifying anomalies in time series data based on graph learning may specifically include:

[0024] Step S101 : acquiring multidimensional time series data including a plurality of monitoring devices, wherein the time series data includes monitoring values ​​of each monitoring device at each time point.

[0025] Various types of sensors are deployed, including carbon dioxide concentration monitoring sensors and meteorological condition monitoring devices such as temperature, humidity, and wind speed sensors, to monitor carbon emissions from different sources. An embedding vector vi∈Rd is introduced for each monitoring device to represent its characteristics, where i∈{1, 2, …, M}, d is the dimension of the embedding vector, and M is the total number of monitoring devices. These embedding vectors are initialized to random values ​​and learned during the model training process to capture the characteristics of the monitoring device itself and the complex interactions between different monitoring devices. The monitoring values ​​of each monitoring device at each time point are obtained to form multidimensional time series data containing multiple monitoring devices. Through the monitoring device embedding method, the high-dimensional and complex data of each monitoring device is converted into a compact representation in a low-dimensional space, which is convenient for subsequent data analysis and processing. According to the distance and similarity between the embedding vectors, the relationship between the monitoring devices is quantified, revealing the potential patterns and dependencies behind the behavior of the monitoring devices. Graph neural networks (GNNs) are applied to model these multivariate time series data to more accurately capture and utilize the complex dependencies and dynamic changes between different monitoring devices. By deeply exploring the application potential of GNNs in the field of regional carbon emission data quality management, the performance of carbon emission monitoring technology can be improved, providing a solid data foundation for achieving carbon neutrality goals, responding to climate change, and promoting sustainable development. Understand monitoring equipment data in multidimensional space, identify subtle differences between normal operation and abnormal status, and provide insights across monitoring equipment types, thereby achieving more efficient and accurate monitoring and anomaly detection in regional carbon emission data.

[0026] Specifically, in the regional carbon emission monitoring system, carbon dioxide concentration monitoring sensors and meteorological condition monitoring devices, such as SenseAir K30 carbon dioxide sensor and DHT22 temperature and humidity sensor, can be deployed. For each monitoring device, a 50-dimensional embedding vector is introduced to represent its features, with a total of 100 monitoring devices. These embedding vectors are initialized as random values ​​that obey the normal distribution N(0, 0.01) and are updated with a learning rate of 0.001 using the Adam optimizer during model training. The monitoring values ​​of each monitoring device every 10 minutes in the past 30 days are obtained to form a 100×4320×2 multidimensional time series data, where 4320 is the number of time steps and 2 indicates that each device has two monitoring indicators: carbon dioxide concentration and temperature and humidity. Through the monitoring device embedding method, the original data is converted into a low-dimensional representation of 100×50. The distance between the embedding vectors is calculated based on the cosine similarity. When the similarity is greater than 0.8, the two monitoring devices are judged to have a strong correlation. The time-aware graph attention network (T-GAT) is applied to model multivariate time series data, the gated recurrent unit (GRU) is used to encode time dependencies, and the information of different monitoring devices is aggregated through the multi-head attention mechanism. After 20 epochs of training, T-GAT achieved an accuracy of 95% in the task of carbon emission anomaly detection, which is 10% higher than the traditional isolation forest algorithm. By analyzing the attention weight matrix of T-GAT, it is found that the carbon dioxide concentration sensor located in the industrial park has a strong interaction with the nearby temperature and humidity sensors, indicating that the exhaust gas emissions caused by industrial activities are closely related to local climate conditions. Using this discovery, environmental protection departments can formulate more targeted emission reduction policies and provide data support for achieving carbon neutrality goals.

[0027] Step S102, preprocessing the multidimensional time series data, removing noise by combining sliding mean filtering, median filtering and Gaussian filtering, and evaluating the filtering effect by wavelet transform to obtain the denoised time series data.

[0028] Time series data denoising is a process of processing time series data to reduce or eliminate noise components. Noise refers to random or irregular fluctuations in data, which may be caused by measurement errors or external interference. Noise reduction is very important for improving data quality and the accuracy of subsequent analysis and model prediction. Data is diverse. This study uses a variety of filtering methods to process data based on the characteristics of noise, and uses wavelet transform to evaluate the effect of the processing results, confirming that the output data is optimal.

[0029] Obtain multidimensional time series data, and preprocess the data by combining sliding mean filtering, median filtering and Gaussian filtering according to the data characteristics and noise type, and remove the noise interference in the data by combining multiple filtering algorithms. Perform wavelet transform on the filtered time series data, analyze the filtering effect by the statistical characteristics of the wavelet coefficients, and judge whether the noise is effectively removed. If the filtering effect is not good, return to step 1 to adjust the filtering algorithm parameters until the optimal denoised time series data is obtained. Use graph neural network to model the denoised multidimensional time series data, take each time point as the node of the graph, and the correlation between different dimensions as the edge, to build a time series data graph model to capture the dynamic characteristics and long-range dependencies in the time series. By performing message passing and aggregation operations on the graph structure, the graph convolutional neural network is used to extract the high-order feature representation of the nodes in the time series data graph, and learn the intrinsic pattern and evolution law of the time series data. Introduce the attention mechanism to weightedly fuse the output of the graph neural network, and adaptively focus on the importance of different time steps through the attention weight, so as to improve the model's ability to detect abnormalities at critical moments. The time series features extracted by the graph neural network are input into the anomaly detection module, and the unsupervised learning algorithm such as isolation forest is used to calculate the anomaly score of each time point to determine whether the current moment is an anomaly. A threshold is set according to the anomaly score, and the time points exceeding the threshold are marked as anomalies to achieve anomaly detection of real-time time series data. If the data at the current moment is abnormal, an early warning is triggered. Feedback information of the detection results is obtained, and statistical analysis of false positives and missed negatives is performed. The accuracy and real-time performance of the detection are continuously improved through continuous learning and optimization of the graph neural network model and anomaly detection algorithm. The optimized time series anomaly detection results are output, and the detected anomaly point information is fed back to the relevant business system to assist in risk decision-making and early warning management, and improve the security and reliability of the system.

[0030] Specifically, for the preprocessing of multidimensional time series data, a sliding mean filter with a window size of 10 and a step size of 5, a median filter with a window size of 5, and a Gaussian filter with a standard deviation of 1.5 can be used. The combination of these three filtering algorithms can remove high-frequency noise and singular points in the data. Then, the filtered data is decomposed into 5 levels of wavelet, and the statistical features such as the mean, variance, and skewness of the wavelet coefficients are extracted. The filtering effect is judged by setting a threshold. If the mean is less than 0.1 and the variance is less than 0.05, it is considered that the noise has been effectively removed. When constructing a time series data graph model, the correlation between different dimensions can be calculated based on the Pearson correlation coefficient, and a connecting edge is added when the correlation coefficient is greater than 0.6. The convolution kernel size of the graph convolutional neural network is set to 3, the number of convolution layers is 4, and the output feature dimension of each layer is 64. The attention mechanism uses additive attention, and the attention weight is obtained by performing softmax normalization on the last layer of convolution features. In the anomaly detection module, the number of trees of the isolation forest algorithm is set to 100, the subsampling ratio is 0.8, the anomaly threshold is set to 0.6, and an early warning is issued for points detected as anomalies for three consecutive time steps. By counting the anomaly detection results for a week, if the false alarm rate is higher than 5% or the missed alarm rate is higher than 2%, the structure and parameters of the graph neural network are fine-tuned, and the anomaly threshold is updated to improve the detection performance. Finally, the timestamp, anomaly score and other information of the anomaly point are packaged and sent to the business system to trigger the corresponding risk control strategy.

[0031] Step S103, converting the preprocessed multidimensional time series data into graph structure data, wherein the nodes of the graph represent monitoring devices, and the edges represent the association relationship between the monitoring devices.

[0032] The preprocessed multidimensional time series data is obtained, in which the data of each monitoring device is represented as a time series vector. By analyzing and processing these vectors, the feature representation of each monitoring device is obtained. The monitoring device embedding technology is used to map the feature representation of each monitoring device into a low-dimensional space to generate the corresponding embedding vector, which can compactly encode the characteristics and functions of the monitoring device. According to the similarity between the embedded vectors of the monitoring devices, the cosine similarity between different monitoring devices is calculated. By setting a threshold, it is determined whether there is an association relationship between two monitoring devices, thereby determining the edge in the graph. An adjacency matrix is ​​constructed, and the similarity scores between the monitoring devices are used as elements in the adjacency matrix to form graph structure data, in which the monitoring devices are represented as nodes of the graph, and the association relationship between the monitoring devices is represented as the edge of the graph. If the similarity score of a monitoring device with other monitoring devices is lower than the set threshold, it is considered that there is no significant association relationship between the monitoring device and the other monitoring devices, and the corresponding edge is not added to the graph structure. By analyzing the connection mode and topological structure between the nodes in the graph structure data, the dependency and interaction mode between different monitoring devices are identified, providing a basis for subsequent anomaly detection and prediction. If there are isolated nodes in the graph structure data or the connection density between nodes is too low, consider introducing additional domain knowledge or business rules and adding virtual edges or nodes to the graph to enhance the connectivity and integrity of the graph. Using technologies such as graph neural networks, end-to-end training and optimization are performed on the learned graph structure. Through node embedding and message passing mechanisms, complex interactions and propagation patterns between nodes are learned to extract high-level feature representations. Based on the output results of the graph neural network, it is determined whether the status of each monitoring device is abnormal, and combined with the dynamic change trend of time series data, the behavior pattern and carbon emission level of the monitoring equipment in the future are predicted to provide decision support for regional carbon emission data quality management.

[0033] Specifically, in the preprocessing stage, the sliding window method can be used to divide the original multidimensional time series data into subsequences of fixed length, each of which represents the state of a monitoring device within a specific time range. Then, the feature vector of each monitoring device is normalized so that it falls within [0, 1].

[0034] The dimensional differences between different features are eliminated within the interval. In the process of embedding monitoring equipment, word embedding algorithms such as Word2Vec can be used to map the feature vector of each monitoring device to a 128-dimensional embedding space. The similarity between monitoring devices is calculated based on cosine similarity, and the threshold is set to 0.8. That is, when the cosine similarity of two monitoring devices is greater than or equal to 0.8, it is considered that there is an association relationship between them, and the corresponding edge is added to the graph. For a sparse graph with 1000 nodes and 5000 edges, the adjacency list can be used to store graph structure data to reduce space complexity. In the training process of the graph neural network, the GraphSAGE algorithm is used for node embedding learning, and the embedded representation of the node is generated by aggregating the local neighborhood information of the node. At the same time, the attention mechanism is introduced to dynamically adjust the weights of different neighboring nodes according to the semantic similarity between nodes to improve the expressive power of the graph neural network. Finally, based on the output of the graph neural network, the threshold for anomaly judgment is set to 0.9. That is, when the abnormal probability of a node is greater than or equal to 0.9, it is marked as an abnormal node. Combined with the time series data of the past 24 hours, the LSTM model is used to predict the carbon emission level in the next hour to assist in regional carbon emission data quality management.

[0035] Step S104, obtaining a monitoring device embedding vector obtained through pre-training, wherein the monitoring device embedding vector represents characteristics of different monitoring devices.

[0036] Initialize the embedding vector of monitoring equipment: randomly generate an embedding vector vi of dimension d for each monitoring equipment in the regional carbon emission monitoring system, where i∈{1, 2, …, M}, and M is the total number of monitoring equipment. Collect monitoring equipment data: collect time series data from carbon dioxide concentration monitoring sensors and meteorological condition monitoring equipment (such as temperature, humidity and wind speed sensors). The data contains the readings of different monitoring equipment at different time points. Preprocess monitoring equipment data: clean and standardize the collected time series data, including removing outliers, filling missing values, and normalizing to ensure data quality. Construct a training data set: construct a data set for training embedding vectors based on the preprocessed monitoring equipment data. Each data contains a sequence of readings of a monitoring equipment over a period of time. Train the embedding vector of monitoring equipment: use a deep learning model, such as a model based on a recurrent neural network or a Transformer, with the input being the sequence of readings of the monitoring equipment over a period of time. By minimizing the prediction error, learn and update the embedding vector vi of each monitoring equipment, so that the embedding vectors of monitoring equipment with similar behavior patterns are closer in the vector space, thereby characterizing the characteristics of the monitoring equipment. If the deep learning model training reaches the preset convergence condition or number of training rounds, the trained embedding vector is saved; otherwise, return to step 5 to continue training. Obtain the pre-trained monitoring device embedding vector: From the model trained in step 6, extract the embedding vector vi corresponding to each monitoring device. These vectors represent the characteristics and functions of different monitoring devices. Calculate the cosine similarity between monitoring devices: Using the embedding vector obtained in step 7, for each monitoring device i, calculate the cosine similarity cosji between it and the embedding vector of other monitoring devices j, where i, j∈{1, 2,…, M}, and i≠j. Construct an adjacency matrix based on cosine similarity: Use the cosine similarity cosji as the weight between monitoring devices i and j to construct an adjacency matrix, in which the element cosji represents the strength of the dependency relationship between monitoring devices i and j, so as to determine the edges in the graph structure. The adjacency matrix represents the mutual dependency between monitoring devices and can be used for subsequent anomaly detection and prediction.

[0037] Specifically, when initializing the embedding vector of the monitoring device, assume that there are 10 monitoring devices in the system, and the embedding vector dimension of each device is set to 64. Ten 64-dimensional vectors are generated through a random number generator. For example, the embedding vector v1 of the first device may be [0.12, -0.34, 0.56, ..., 0.78]. When collecting monitoring device data, data is collected continuously for 24 hours at a time interval of 5 minutes to obtain readings at 288 time points. For example, the reading of the carbon dioxide concentration monitoring sensor at the first time point is 400ppm. When preprocessing the data, the Z-Score normalization method is used to subtract the mean from the reading of each monitoring device and divide it by the standard deviation to ensure that the data mean is 0 and the standard deviation is 1. When constructing the training data set, the readings of the first 10 consecutive time points of each device are used as the input sequence, and the readings of the next time point are used as the label, forming 288-10=278 training data. When training the embedding vector, use the LSTM-based neural network model, set the hidden layer dimension to 128, the learning rate to 0.001, and use the Adam optimizer to train the model. Update the embedding vector each iteration until the model loss function value stabilizes below 0.01. After reaching the convergence condition, save the model and extract the embedding vector of each device. For example, v1 is updated to

[0038] [-0.15, 0.28, -0.42, ... , 0.65]. When calculating the cosine similarity, for the embedding vectors v1 and v2 of device 1 and device 2, calculate their dot product divided by the product of their respective moduli, and get the cosine similarity cos12 = 0.85. When constructing the adjacency matrix based on the cosine similarity, fill the cosine similarities between all devices into a 10x10 matrix. If the first row and second column of the matrix is ​​0.85, it indicates the strength of the dependency relationship between device 1 and device 2. In this way, the system automatically constructs a graph structure that reflects the mutual dependency of monitoring devices, providing a basis for subsequent anomaly detection and prediction.

[0039] Step S105, based on the monitoring device embedding vector, by calculating the similarity between nodes, learning to generate an adjacency matrix of the graph, the adjacency matrix represents the connection relationship between the nodes in the graph.

[0040] Initialize the monitoring device embedding vector: For each monitoring device i, assign a random embedding vector vi of dimension d, where i∈{1, 2, …, M}, M is the total number of monitoring devices. Calculate the cosine similarity of the embedding vector: traverse all monitoring device pairs (i, j), according to the formula cosji=(vi·vj) /

[0041] (||vi||||vj||) Calculate the cosine similarity between the embedded vectors of monitoring devices i and j to obtain the similarity score cosji. Determine the similarity threshold to generate adjacency matrix elements: If cosji is greater than or equal to the preset similarity threshold, the adjacency matrix element Aji is set to cosji, indicating that there is a connection between monitoring devices i and j; if cosji is less than the preset similarity threshold, the adjacency matrix element Aji is set to 0, indicating that there is no connection between monitoring devices i and j. By traversing all device pairs, a complete adjacency matrix A is generated. Obtain the Bayesian network feature extraction results: For each monitoring device node xi, obtain its corresponding feature vector from the Bayesian network feature extraction module. Linearly transform the feature vector: Use the learnable weight matrix W to linearly transform the feature vector of each node to obtain the transformed feature vector. Concatenate the transformed feature vector with the monitoring device embedding vector: Concatenate the transformed feature vector with the embedding vector vi of the monitoring device i to obtain a new vector ci. Calculate the attention coefficient: For each neighbor node j of node i, use ci and cj to calculate an attention coefficient aij. Normalize the attention coefficient: Use the Softmax function to normalize the attention coefficients of all neighbor nodes of node i to ensure that the sum of the attention coefficients of all neighbor nodes is 1. Aggregate neighbor node information: According to the normalized attention coefficient, perform weighted summation on the feature vectors of all neighbor nodes of node i to obtain the aggregate representation zi of node i.

[0042] Specifically, when initializing the embedded vector of the monitoring device, assuming that there are 10 monitoring devices, the embedding vector dimension of each device is set to 64, and the uniform distribution U(-1, 1) is used to generate the initial vector. For example, the embedding vector v1 of device 1 may be [0.12, -0.35, 0.47, ... , 0.29]. When calculating the cosine similarity of the embedded vector, take the embedding vectors v1 and v2 of device 1 and device 2, and calculate cos12 = (v1·v2) / (||v1||||v2||). If v1 = [0.12, -0.35, 0.47, ... , 0.29] and v2 = [-0.18, 0.42, 0.31, ... , -0.22], then cos12≈0.45. Determine the similarity threshold to generate the adjacency matrix elements. Set the threshold to 0.5. Since cos12<0.5, A12=0. Obtain the Bayesian network feature extraction results. Assume that the feature vector f1 of device 1 is [0.8, 0.2,

[0043] 0.5, . . . , 0.3]. Linearly transform the feature vector, use the weight matrix W (64x64), the transformed feature vector f1'=W·f1, if some elements of W are [0.1, 0.2; -0.1, 0.3; . . . ], then f1'=[0.15, 0.35, . . . , 0.25]. Concatenate the transformed feature vector with the monitoring device embedding vector to get c1=[0.15, 0.35, . . . , 0.25, 0.12, -0.35, . . . , 0.29]. Calculate the attention coefficient, for the neighbor device 2 of device 1, use c1 and c2 to calculate aij, the formula is aij=exp(c1·c2) / Σexp(c1·ck), if c2=[0.2, 0.4, . . . , 0.1, -0.2, 0.3, . . . , -0.1], then aij≈0.6. Normalized attention coefficient, device 1 has 3 neighbors, the coefficients are 0.6, 0.3, 0.1, and after normalization, they are [0.6 / 1, 0.3 / 1, 0.1 / 1] = [0.6, 0.3, 0.1]. Aggregate neighbor node information, according to the normalized coefficient, the aggregate representation of device 1 is z1 = 0.6·f2'+0.3·f3'+0.1·f4'. If f2' = [0.2,

[0044] 0.5,… ,0.4], f3′=[0.3, 0.1,… ,0.2], f4′=[0.1, 0.6,… ,0.3], then z1=[0.18, 0.42,… ,0.33].

[0045] Step S106, using the Bayesian network to extract features from the graph structure data to obtain a feature vector for each node.

[0046] The Bayesian network is used to model the graph structure data. The nodes represent the monitoring devices, and the edges represent the relationships between the monitoring devices. The probability relationship between the variables is learned through the probabilistic graph model. Each node corresponds to a feature vector, which represents the probability distribution characteristics of the monitoring device in the Bayesian network. The feature vector of each node is linearly transformed and linearly mapped using the learnable weight matrix W to obtain the transformed feature vector. This transformation aims to map the features extracted by the Bayesian network to a new space with better representation capabilities and improve the discriminability of the features. The monitoring device embedding vector vi is obtained. This vector represents the different behaviors of different types of monitoring devices. The embedding vector is obtained by a pre-trained model or artificial construction. The transformed feature vector is concatenated with the corresponding monitoring device embedding vector vi to form a new vector ci, which combines the features extracted by the Bayesian network and the specific attributes of the device itself. Introduce a learnable weight vector a, calculate the attention coefficient aij of node i and each of its neighbor nodes j, introduce nonlinear transformation through LeakyReLU activation function, and use softmax function for normalization to ensure that the sum of the attention coefficients of all neighbor nodes of node i is 1. The attention coefficient reflects the importance of neighbor node j to node i. Determine whether the neighbor node set is empty. If the neighbor node set is empty, use the node's own feature vector ci as the updated feature vector zi. If the neighbor node set is not empty, proceed to the next step. According to the calculated attention coefficient aij, weight the transformed feature vector hj of the neighbor node to obtain the weighted neighbor node feature. Aggregate the weighted neighbor node features, accumulate the weighted neighbor node feature vectors, and obtain the aggregated neighbor information. Use the aggregated neighbor information to update the feature vector zi of node i. The updated feature vector zi combines the important information of its own information and neighbor nodes. zi represents the comprehensive feature representation of node i in the graph structure, which is used for subsequent prediction or other analysis tasks.

[0047] Specifically, the Bayesian network is used to model the graph structure data. Assuming that there are 5 monitoring device nodes in the graph, the probability distribution feature vector of each node is obtained through Bayesian network learning. For example, the feature vector of node 1 is [0.2, 0.5, 0.3]. The feature vector of each node is linearly transformed and mapped using the weight matrix W (for example, a 3x3 matrix). The feature vector of node 1 is transformed to W*[0.2, 0.5, 0.3], and a new feature vector [0.1, 0.4, 0.2] is obtained. The monitoring device embedding vector vi is obtained. Assuming that the embedding vector of node 1 is [0.3, 0.7], the transformed feature vector is concatenated with the embedding vector to form a new vector ci=[0.1, 0.4, 0.2, 0.3, 0.7]. Introduce a learnable weight vector a (e.g., a 5-dimensional vector), calculate the attention coefficient aij of node 1 and its neighbor node 2, process the dot product of the concatenated vector and the weight vector through the LeakyReLU activation function, and then normalize it using the softmax function. Assume that the attention coefficient aij = 0.6 is obtained. Determine that the neighbor node set of node 1 is not empty and proceed to the next step. According to the attention coefficient of 0.6, the transformed feature vector h2 = [0.2, 0.3, 0.5] of the weighted neighbor node 2 is obtained to obtain the weighted feature [0.12, 0.18, 0.3]. Aggregate the weighted features of all neighbor nodes. Assume that node 1 also has a neighbor node 3 with an attention coefficient of 0.4. Its feature vector h3 = [0.1, 0.2, 0.7] is weighted to [0.04, 0.08, 0.28], and the aggregated feature [0.16, 0.26, 0.58] is accumulated. The feature vector zi of node 1 is updated using the aggregated neighbor information. The own feature vector ci is added to the aggregated feature vector to obtain the updated feature vector zi = [0.26, 0.66, 0.78, 0.3, 0.7]. This vector combines the important information of node 1 itself and neighbor nodes for subsequent analysis.

[0048] Step S107, input the graph structure data into the graph attention neural network, aggregate the information of neighbor nodes through the attention mechanism, and combine the characteristics of the node itself to learn the hidden state representation of the node.

[0049] The graph structure data is input into the graph attention neural network, and the feature vector of each node is linearly transformed. The feature extraction of the Bayesian network is mapped to a new space with more suitable representation capabilities. The transformed features are obtained using the learnable weight matrix W. The transformed vector is concatenated with the monitoring device vector, and ci is obtained by combining the monitoring device embedding vector vi, so that attention can be focused on the relevant monitoring devices. The attention coefficient is calculated. For each neighbor node j of node i, an attention coefficient aij is calculated. This coefficient indicates the importance of node j to node i. By using the softmax function, the sum of the attention coefficients of all neighbor nodes of node i is guaranteed to be 1, so that attention can be allocated to neighbor nodes. Aggregate neighbor information, use the attention coefficient aij and the transformed feature vector hj of the neighbor node to update the feature vector of node i, weight the features of the neighbor nodes according to the calculated attention coefficient, and then aggregate these weighted features to update the features of the current node. Fusion of the node's own information, the updated features of each node not only contain its own information, but also integrate the important information of its neighbors. By dynamically assigning different weights to different neighbor nodes, it can more accurately simulate the dynamic changes in the time series, thereby improving the accuracy of prediction. Determine whether it is non-stationary time series data. If so, the graph attention network is particularly suitable for processing because it can re-evaluate and adjust the dependencies between nodes in each time step. Through the multi-layer stacking of the graph attention mechanism, high-level node representations are gradually extracted to capture the complex patterns and dependencies in the graph structured data, and learn the hidden state representation of the nodes. The learned node hidden state representation is input into downstream tasks, such as node classification, link prediction, etc., and the expressive node features extracted by the graph attention mechanism are used to improve the performance of downstream tasks. Through end-to-end training, the parameters of the graph attention network are optimized so that it can adaptively learn the attention allocation in the graph structured data, and continuously improve the representation and generalization capabilities of the model to better support the analysis and prediction tasks of various graph structured data.

[0050] Specifically, in the graph attention neural network, LeakyReLU can be used as a nonlinear activation function to linearly transform the feature vector of each node, for example, using a 256-dimensional learnable weight matrix W to map the original features to a new space. Then, the transformed vector is concatenated with the 128-dimensional monitoring device embedding vector vi to obtain a 384-dimensional vector ci. For each neighbor node j of node i, the attention coefficient aij is obtained by calculating the dot product of ci and cj and applying the softmax function, which represents the importance of node j to node i. When aggregating neighbor information, the transformed feature vectors of the neighbor nodes are weighted summed using the attention coefficient to update the feature vector of node i. For non-stationary time series data, the graph attention network can adapt to dynamic changes by recalculating the attention coefficient at each time step. By stacking multiple layers of graph attention mechanisms, for example, using 3 layers, each with an output dimension of 256, 128, and 64, high-level node representations are gradually extracted. Finally, the learned 64-dimensional node hidden state representation is input into downstream tasks, such as node classification using the cross entropy loss function, or link prediction using the edge reconstruction loss function. Through end-to-end back-propagation and gradient optimization algorithms such as Adam, the parameters of the graph attention network are continuously updated to improve the representation and generalization capabilities of the model.

[0051] Step S108, in the output layer of the graph attention neural network, the hidden state is mapped to the predicted value through the fully connected layer to obtain the prediction result of the future time series.

[0052] According to the multi-dimensional time series carbon emission data, the time series prediction algorithm based on the attention mechanism is used to learn data features and generate a prediction model. The graph attention neural network layer constructs a graph structure based on the learned data features. The nodes represent different time points or regions, and the edges represent the dependencies between nodes. The attention mechanism is used to aggregate the hidden states of neighboring nodes and update the representation of each node. If the graph attention neural network layer completes the message transmission and node state update, the message transmission mechanism captures the association strength between nodes by calculating the attention coefficient between nodes, and applies the association strength to the node state update process. Through multiple message transmissions, the interaction and fusion of global information are realized. After multiple message transmissions and aggregations of the graph neural network layer, each node obtains a hidden state representation that fully integrates the global information. The output of the graph neural network layer is obtained, which contains the hidden state of each node. The fully connected layer is used to map the hidden state of each node to a new vector space. The dimension of this vector is the same as the dimension of the predicted time series. The value of this vector space represents the predicted value of the future time series. The sliding mean filter processes the predicted value by setting a fixed-size sliding window, sliding on the time series, calculating the average value of the data in the window, and using this average value as the filtering result at the current moment. The wavelet transform method processes the predicted value, selects the appropriate wavelet basis function, performs multi-scale decomposition on the predicted value, extracts the characteristics of different frequency components, analyzes and processes these characteristics, and then inputs the predicted result into the effect evaluation link. The effect evaluation link determines the accuracy and reliability of the predicted result, generates anomaly scores, combines the predicted value with the anomaly score, outputs the anomaly detection result, and outputs this data result as data output.

[0053] Specifically, in the multi-dimensional time series carbon emission data, the trend, seasonality and randomness of the data are learned through the time series prediction algorithm based on the attention mechanism, such as the autoregressive integrated moving average (ARIMA) model, to generate a prediction model. The graph attention neural network layer constructs a graph structure based on the learned data features. The nodes represent different time points or regions, and the edges represent the dependencies between nodes. The hidden states of neighboring nodes are aggregated using the attention mechanism, such as the multi-head self-attention mechanism in the Transformer, to update the representation of each node. The message passing mechanism captures the association strength between nodes by calculating the attention coefficient between nodes, such as dot product attention or additive attention, and applies the association strength to the update process of the node state. Through multiple message passing, the interaction and fusion of global information are realized. After the message passing and aggregation of the three-layer graph neural network layer, each node obtains a 256-dimensional hidden state representation. The fully connected layer is used to map the hidden state of each node to a new vector space. The dimension of this vector is the same as the dimension of the predicted time series. For example, if the carbon emissions in the next 7 days are predicted, the output dimension is 7. The sliding mean filter processes the predicted value, sets a sliding window of size 3, slides on the time series, calculates the average value of the data in the window, and uses this average value as the filtering result at the current moment. The wavelet transform method processes the predicted value, selects the Haar wavelet basis function, performs a 3-layer multi-scale decomposition on the predicted value, extracts the features of different frequency components, thresholds these features, and then reconstructs the final prediction result. The effect evaluation stage uses the mean square error (MSE) and mean absolute percentage error (MAPE) to evaluate the accuracy of the prediction results, generates anomaly scores, combines the predicted value with the anomaly score, outputs the anomaly detection result, and outputs this data result as data.

[0054] Step S109, based on the error between the predicted value and the true value, calculate the anomaly score, compare the anomaly score with the preset threshold, determine whether there is an anomaly, and issue an anomaly warning if the anomaly score exceeds the threshold.

[0055] According to the prediction model, the input multidimensional time series data is predicted to obtain the predicted value sequence for a period of time in the future. The error sequence between the predicted value sequence and the true value sequence is calculated, and the error mean and covariance matrix are obtained as the features under normal conditions. For each time point in the test set, the Mahalanobis distance between its prediction error and the mean of the prediction error under normal conditions is calculated as the anomaly score of the time point. A suitable anomaly threshold is set. If the anomaly score at a certain time point exceeds the threshold, it is judged that there is an abnormal sign at the time point. If the anomaly scores of multiple consecutive time points exceed the threshold, it is further determined that anomalies may occur in the future. By integrating historical data and expert experience, the anomaly threshold is dynamically adjusted to adapt to different business scenarios and data characteristics. When it is judged that an abnormal risk occurs, the early warning mechanism is immediately triggered, and an alarm message is sent to relevant personnel, with detailed information such as the abnormal time point and anomaly score. According to the early warning information, corresponding countermeasures are taken, such as data review, model optimization, business adjustment, etc., to reduce the negative impact of the anomaly. Continuously track data changes after the abnormal time point, evaluate the accuracy and timeliness of the early warning, and optimize the anomaly detection model and early warning strategy accordingly.

[0056] Specifically, an LSTM prediction model is trained based on historical data to predict time series data of 10 dimensions such as temperature, humidity, and pressure in the next 24 hours. By calculating the error between the predicted value and the true value, the error mean is 0.5, and the diagonal elements of the covariance matrix are all 0.1. For each time point in the test set, the Mahalanobis distance between its prediction error and the mean 0.5 is calculated, and the obtained anomaly score ranges from 0 to 10. The anomaly threshold is set to 5, and for time points where the anomaly score exceeds 5, it is judged that there are abnormal signs. If the anomaly scores of three consecutive time points are all greater than 5, it is predicted that the equipment may fail within the next 2 hours. According to the historical anomalies of different equipment, the anomaly threshold is dynamically adjusted to between 4 and 6. When the anomaly risk is confirmed, an early warning is sent to the on-duty personnel in the form of text messages and emails, including the abnormal time point, anomaly score, and possible impact range. After receiving the early warning, the on-duty personnel immediately check the equipment operation status, activate the emergency plan if necessary, and adjust the production plan to reduce potential losses. After the warning is issued, the data after the abnormal time point is continuously monitored for 2 hours. If the abnormal state disappears, the warning is accurate, otherwise it is considered a false alarm. According to the warning results, the anomaly detection model is retrained and optimized using the latest data, and the threshold and trigger conditions of the warning strategy are adjusted.

[0057] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the concept of the present application. For example, the above features are replaced with the technical features with similar functions disclosed in the present application (but not limited to) to form a technical solution.

Claims

1. A method for identifying anomalies in time series data based on graph learning, characterized in that: include: Get multidimensional time series data; Preprocessing the multidimensional time series data to obtain preprocessed multidimensional time series data; According to the preprocessed multidimensional time series data, a graph structure is obtained through graph structure learning; According to the graph structure, a prediction value is obtained through a time series prediction model based on a Bayesian network and graph attention; Calculating an anomaly score based on the predicted value; According to the abnormality score, it is determined whether there is an abnormality, and an abnormality identification result is obtained.

2. The method according to claim 1, characterized in that The preprocessing of the multidimensional time series data includes: Performing data denoising processing on the multidimensional time series data to obtain denoised multidimensional time series data; Performing data normalization processing on the denoised multidimensional time series data to obtain normalized multidimensional time series data; According to a preset time window, the normalized multidimensional time series data is slidingly segmented to obtain preprocessed multidimensional time series data.

3. The method according to claim 2, characterized in that The performing data noise reduction processing on the multidimensional time series data comprises: The multidimensional time series data is processed by a sliding mean filtering method to remove high-frequency noise, thereby obtaining multidimensional time series data after first noise reduction; Using a median filtering method to process the first denoised multidimensional time series data to remove isolated noise points, thereby obtaining second denoised multidimensional time series data; The second denoised multidimensional time series data is processed by a Gaussian filtering method to further smooth the data to obtain denoised multidimensional time series data.

4. The method according to claim 1, characterized in that The method of obtaining a graph structure by graph structure learning based on the preprocessed multidimensional time series data includes: Obtaining an embedding vector of a monitoring device, where the embedding vector of the monitoring device is used to represent a feature of the monitoring device; Calculating similarities between the monitoring devices according to the embedded vectors of the monitoring devices to obtain a similarity matrix; The graph structure is constructed according to the similarity matrix, wherein the nodes in the graph structure represent monitoring devices, and the edges in the graph structure represent dependency relationships between monitoring devices.

5. The method according to claim 1, characterized in that According to the graph structure, a prediction value is obtained through a time series prediction model based on a Bayesian network and graph attention, including: According to the graph structure, extract features through a Bayesian network to obtain Bayesian network features; Inputting the Bayesian network features into a graph attention model, aggregating neighbor node information through the attention mechanism in the graph attention model, updating node features, and obtaining updated node features; The updated node features are input into the fully connected layer, and the data at the future moment is predicted through the fully connected layer to obtain the predicted value.

6. The method according to claim 1, characterized in that The calculating the anomaly score according to the predicted value comprises: Obtain the prediction error mean and covariance matrix during the training phase as features in the normal state; Calculating the Mahalanobis distance between the prediction error in the test phase and the feature in the normal state to obtain a Mahalanobis distance value; The Mahalanobis distance value is used as an anomaly score.

7. The method according to claim 1, characterized in that The determining whether there is an abnormality based on the abnormality score to obtain an abnormality identification result includes: comparing the anomaly score to a preset threshold; If the abnormality score is greater than or equal to the preset threshold, it is determined that an abnormality exists and an abnormality warning result is obtained; If the abnormality score is less than the preset threshold, it is determined that there is no abnormality.

8. A time series data anomaly identification system based on graph learning, characterized in that: The system comprises: Acquisition module, used to acquire multi-dimensional time series data; A data preprocessing module, used for preprocessing the multidimensional time series data to obtain preprocessed multidimensional time series data; A data processing module, used for obtaining a graph structure through graph structure learning according to the pre-processed multi-dimensional time series data; A prediction module, used to obtain a prediction value according to the graph structure through a time series prediction model based on a Bayesian network and graph attention; An anomaly score calculation module, used to calculate an anomaly score according to the predicted value; The detection module is used to determine whether an abnormality exists according to the abnormality score and obtain an abnormality identification result.

9. The system according to claim 8, characterized in that The data preprocessing module is also used for: Performing data denoising processing on the multidimensional time series data to obtain denoised multidimensional time series data; Performing data normalization processing on the denoised multidimensional time series data to obtain normalized multidimensional time series data; According to a preset time window, the normalized multidimensional time series data is slidingly segmented to obtain preprocessed multidimensional time series data.

10. The system according to claim 9, characterized in that The data preprocessing module is also used for: The multidimensional time series data is processed by a sliding mean filtering method to remove high-frequency noise, thereby obtaining multidimensional time series data after first noise reduction; Using a median filtering method to process the first denoised multidimensional time series data to remove isolated noise points, thereby obtaining second denoised multidimensional time series data; The second denoised multidimensional time series data is processed by a Gaussian filtering method to further smooth the data to obtain denoised multidimensional time series data.

Images