Transform and GCN network-based satellite communication server abnormal data detection method

Abstract

The invention relates to an anomaly detection method for satellite communication server data. Specifically, the problem of poor anomaly detection effect caused by high complexity of server data and varied data stream characteristics in a satellite communication system is solved. According to the method, an adjacent matrix between features is constructed through a Spearman correlation coefficient, high-quality prior information is provided for a GCN, a complex dependency relationship between time sequence features is captured, and global feature representation is generated. Then, the global features extracted by the GCN serve as input and are sent into a Transform model, and a dynamic mode and a long-range dependency relationship in a time sequence are mined through a self-attention mechanism of the Transform model; transformer can be combined with the time sequence characteristics of the sequence data to further optimize the temporal correlation expression of the global characteristics, so that the description capability of the characteristics is improved. And finally, an abnormal point in the time sequence is accurately positioned and predicted by using an abnormal detection module in combination with output features of GCN and Transform. According to the method provided by the invention, the global dependency relationship is captured by using the GCN, and the time dynamic mode is modeled through Transform, so that the accuracy and robustness of the anomaly detection of the satellite communication server are remarkably improved.

Description

Technical Field

[0001] The invention belongs to the field of time series and anomaly detection, and specifically relates to an abnormal data detection method for a satellite communication server based on Transformer and GCN networks. Background Art

[0002] Satellite communication servers are important infrastructure for data processing and task management in modern satellite systems and space-ground integrated environments. Satellite communication servers support multiple functions such as satellite link monitoring, data transmission, and task planning through efficient computing resource allocation and communication task scheduling, providing high reliability, high throughput, and real-time service capabilities. In satellite communication systems, anomaly detection aims to identify abnormal data points that deviate from normal communication patterns, and has become an important means to ensure the safe operation of the system and the quality of communication.

[0003] Traditional machine learning methods usually rely on sufficient labeled data and clear feature representation. Their performance is easily affected in scenarios with high-dimensional data, nonlinear relationships, and dynamic changes in distribution. Typical techniques include support vector machines, K-means clustering, isolation forests, and principal component analysis. Deep learning can automatically extract deep features of data through the multi-layer structure of neural networks, and is particularly suitable for processing high-dimensional data and unstructured data. In time series anomaly detection, technologies such as recurrent neural networks, long short-term memory networks, and transformers have been widely used. However, the high computational requirements for large-scale data, the dependence on labeled data, and the lack of interpretability of the model. Therefore, existing methods still need to be improved in terms of balancing model performance and efficiency, and improving the adaptability of the model in dynamic environments. Summary of the invention

[0004] The purpose of the present invention is to provide a satellite communication server abnormal data detection method based on Transformer and GCN network, which finds out the potential data patterns in the satellite communication server data by combining time series characteristics and multivariate relationship modeling. The method can comprehensively analyze the complex characteristics of system operation data, build an accurate normal behavior benchmark, and then effectively detect abnormal situations that deviate from the expected behavior of the system. Through this method, the anomaly detection accuracy and real-time response capability of the satellite communication server system can be improved, thereby ensuring the stability of the system and data security.

[0005] To achieve the above object, the technical solution adopted by the present invention comprises the following steps:

[0006] Step 1: Preprocess the multivariate time series data of the satellite communication server, split it into fixed-length time windows, and generate embedded features;

[0007] Step 2: Calculate the Spearman correlation coefficient between each feature pair in the data set to quantify the rank correlation between features, construct a correlation matrix between features, and provide reliable prior information for subsequent models;

[0008] Step 3: Use the Spearman graph neural network to extract complex relationships in multivariate time series and update the representation of each node through feature aggregation of GCN;

[0009] Step 4: Input the features extracted by GCN into the original Transformer model and use the standard self-attention mechanism to process the time series data;

[0010] Step 5: Calculate the reconstruction error of each time window based on the model output, and the time window with anomaly score higher than the preset threshold is judged as abnormal.

[0011] Optionally, the execution process of step 1 includes the following steps:

[0012] Step 1.1: Normalize each feature in the original time series data and scale the value to the range of [0, 1] to eliminate the impact of dimensional differences between features on model training.

[0013] Step 1.2: Perform sliding window segmentation on the normalized time series data to generate fixed-length time segments. The length N of the time window and the sliding step size can be adjusted according to the specific application scenario.

[0014] Step 1.3: Embed the data of each time window, map the original high-dimensional features to the low-dimensional embedding space through dimensionality reduction or feature encoding technology, and retain the key feature information for subsequent modeling.

[0015] Optionally, a normalization method is used in step 1 to scale the eigenvalues ​​to a range of zero to one to reduce the impact of different feature magnitudes on the model. When splitting the time window, the length of the sliding window is fixed to 100 and the sliding step is set to 50 to ensure a balance between data coverage and computational efficiency.

[0016] Optionally, the execution process of step 3 includes the following steps:

[0017] Step 3.1: Use the Spearman correlation matrix generated in step 2 as the adjacency matrix to initialize the topological structure of the graph neural network to reflect the correlation between features.

[0018] Step 3.2 updates the feature representation of each node through the feature aggregation operation of the graph neural network layer. The calculation formula is:

[0019] F (l) =σ(A·F (l-1) ·W (l) )

[0020] Where A is the Spearman correlation matrix, F (l-1) is the node feature matrix of the previous layer, F (l) is the node feature matrix of the current layer, W (l) is the weight matrix that can be optimized for training, and σ is the activation function. The multi-layer stacking of GCN extracted features can capture the complex relationship between nodes.

[0021] Optionally, when constructing the Spearman correlation matrix, feature pairs with correlation coefficients greater than 0.5 are selected as connecting edges to filter out weakly correlated or irrelevant feature relationships. The activation function uses ReLU to enhance nonlinear expression capabilities, and the number of GCN layers is set to two to balance the depth of feature extraction and computational complexity.

[0022] Optionally, the execution process of step 5 includes the following steps:

[0023] Step 5.1: Compare the reconstruction result output by the Transformer model with the input features and calculate the reconstruction error for each time window. The formula is:

[0024]

[0025] Among them, X is the input feature, The result of model reconstruction.

[0026] Step 5.2: Set the threshold for anomaly detection based on the reconstructed error distribution of the training data, usually determined by percentile or fixed value.

[0027] Step 5.3: Calculate the anomaly score for each time window of the test data. If the score is higher than the threshold, the time window is determined to be an abnormal time period.

[0028] Optionally, when calculating the reconstruction error, the mean square error is used as an evaluation metric to measure the difference between the model output and the input. The threshold for anomaly detection is set to the 95th percentile of the reconstruction error distribution, and the time window exceeding this value is considered anomaly to ensure the sensitivity of anomaly detection.

[0029] The present invention provides a method for detecting abnormal data of a satellite communication server based on a Transformer and GCN network. The multivariate time series data of a satellite communication server is used as the research object. The rank correlation between features is calculated using the Spearman correlation coefficient method for the complex nonlinear correlation and time series dependency between multivariate features, and a correlation matrix between features is constructed to extract the potential pattern relationship in the multivariate time series. At the same time, in view of the problem that traditional methods are difficult to effectively capture the complex relationship between multiple variables, a graph neural network is used to extract the local and global correlation between features, and the self-attention mechanism of the Transformer model is used to further extract the deep pattern relationship in the time series features. In addition, in order to ensure the accuracy and robustness of anomaly detection, the present invention optimizes the feature aggregation mechanism in GCN and reasonably sets the model parameters, thereby improving the accuracy and generalization ability of anomaly detection in complex environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly and in detail illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings involved in the embodiments or the prior art description are briefly introduced below. These drawings are intended to provide auxiliary understanding of the technical solutions of the present invention, but are limited to some embodiments of the present invention and do not constitute a limitation of the present invention.

[0031] Figure 1 This is a topology diagram of the network structure for abnormal data detection in satellite communication servers based on Transformer and GCN networks.

[0032] Figure 2 This is a flow chart of the abnormal data detection method for satellite communication servers based on Transformer and GCN networks.

[0033] Figure 3 It is a data correlation diagram of a specific embodiment of the present invention.

[0034] Figure 4 It is a data processing flow chart of the present invention.

[0035] Figure 5 It is an abnormality determination flow chart of the present invention. DETAILED DESCRIPTION

[0036] The present invention is described in detail below in conjunction with specific implementation cases. The following implementation cases will help those skilled in the art to further understand the present invention, but will not limit the present invention in any form.

[0037] The present invention provides a method for detecting abnormal data of a satellite communication server based on a Transformer and a GCN network, comprising the following steps:

[0038] S1: Preprocess the multivariate time series data of the satellite communication server, split it into fixed-length time windows, and generate embedded features;

[0039] S2: Calculate the Spearman correlation coefficient between each feature pair in the data set to quantify the rank correlation between features, construct a correlation matrix between features, and provide reliable prior information for subsequent models;

[0040] S3: Extract complex relationships in multivariate time series using Spearman graph neural network and update the representation of each node through feature aggregation of GCN;

[0041] S4: Input the features extracted by GCN into the original Transformer model and use the standard self-attention mechanism to process time series data;

[0042] S5: The reconstruction error of each time window is calculated based on the model output, and the time window with anomaly score higher than the preset threshold is judged as abnormal.

[0043] The specific implementation steps and processes are as follows: Figure 1 As shown, the following is further described in conjunction with specific embodiments and execution steps:

[0044] The execution process of step S1 can be divided into the following steps:

[0045] (1.1) Collect various performance indicator data from the satellite communication server. Performance indicators include CPU usage, memory usage, network traffic, disk I / O, etc. The data set is recorded in the form of a time series, with a time step of one minute. The record at each time point contains multiple feature data, forming a multidimensional vector. If there are M performance indicators, then the data at each time point contains M values. The structure of the data is a two-dimensional matrix, where each row represents the data at a time point and each column represents the value of a performance indicator.

[0046] (1.2) In order to eliminate the impact of dimensional differences between different features on subsequent model training, the data needs to be normalized. After normalization, the value of each feature will be mapped to the same range, so that each feature can be compared and calculated at the same scale. The normalization formula for each feature is as follows:

[0047]

[0048] Among them, X is the original eigenvalue, and X′ is the normalized eigenvalue. The normalization operation maps the minimum value of each feature to 0 and the maximum value to 1, ensuring that the values ​​of all features are between 0 and 1.

[0049] For each feature, find the minimum and maximum values ​​of the feature in all sample data, and use the formula to scale the original data to the [0, 1] interval.

[0050] (1.3) The normalized time series data is split according to a sliding window of fixed length. Each time window contains data for N consecutive time steps. The window length N is set to 100 and the sliding step is set to 50, which means that each time the window is slid, the window moves forward 50 time steps to generate multiple time windows. Then the feature matrix of each time window is calculated to form an N×M matrix, where N is the time window length and M is the number of features. PCA is applied to reduce the dimension of the standardized data, and the variance that retains more than 90% is selected as the main component.

[0051] The execution process of step S2 can be divided into the following steps:

[0052] (2.1) Extract each feature (such as CPU usage, memory usage, network traffic, etc.) from the multivariate time series data of the satellite communication server. Assume that there are N samples, each containing M features. For each pair of features, first sort their values ​​on all samples. For example, sort each sample value of feature A and feature B to get a ranking, i.e., rank. Assume that the sample values ​​of feature A and feature B are A and B, respectively. 1 , A 2 …, A N and B 1 , B 2 …, B N , sort them separately and get the order column R A and R B For each pair of samples i, calculate the rank difference d on features A and B i ,Right now:

[0053]

[0054] in, and Respectively represent the ranks of features A and B on sample i. If two sample values ​​are equal, they are given the same rank and the average of the ranks is calculated.

[0055] (2.2) The Spearman correlation coefficient ρ is calculated using the following formula:

[0056]

[0057] Where n is the number of samples, d iis the rank difference between each pair of samples on features A and B. The denominator in the formula is a normalization factor to ensure that the value of the correlation coefficient is in the range [-1, 1]. Finally, ρ represents the rank correlation between feature A and feature B. Repeat the above process for all feature pairs in the dataset and calculate the Spearman correlation coefficient between each pair of features. The final result is a symmetric correlation coefficient matrix, where each element of the matrix represents the rank correlation between the corresponding two features.

[0058] (2.3) Construct an M×M symmetric matrix. Each element C in the matrix ij represents the Spearman correlation coefficient ρ between feature i and feature j ij . Fill the calculated Spearman correlation coefficient of each pair of features into the correlation matrix. The diagonal elements C of the matrix ii is 1, indicating that the correlation between each feature and itself is the largest. ij is the correlation coefficient between feature i and feature j. According to the correlation matrix, filter out the feature pairs that are most correlated with the target variable. Feature pairs with a correlation coefficient greater than 0.5 can be selected, which play an important role in the model.

[0059] The execution process of step S3 can be divided into the following steps:

[0060] (3.1) The adjacency matrix is ​​normalized using the degree matrix normalization method. Each diagonal element D in the degree matrix ii Represents the degree of feature i, that is, the sum of the correlations between feature i and other features. The adjacency matrix normalization formula is:

[0061] A′=D- 1 / 2 AD- 1 / 2

[0062] Among them, A is the original adjacency matrix, D is the degree matrix, and A′ is the normalized adjacency matrix. This normalization process helps to balance the influence of different nodes in the graph neural network and avoid deviations caused by excessive node degrees.

[0063] (3.2) The input features of each node come from the data in step S1 and step S2. Each node represents the features within a time window, and the initial node feature matrix consists of the feature vectors of each time window, that is, the features obtained after the data of each time window is preprocessed. For each layer of the graph neural network, the node features are updated using the following formula:

[0064] F( l )=σ(AF( l -1).W( l ))

[0065] Among them, F (l-1) is the node feature matrix of the previous layer, which indicates the feature representation of each node in the previous layer. A is the adjacency matrix, which is used to describe the relationship and dependency between features. W(l) is the optimizable weight matrix of the current layer, which is used to learn the transformation of node features. σ is the activation function using ReLU, which is used to introduce nonlinearity so that the model can learn complex feature relationships.

[0066] The execution process of step S4 can be divided into the following steps:

[0067] (4.1) The features extracted by the graph neural network in step 3 are used as the input of the Transformer model. The feature matrix F output by GCN has a dimension of T×D, where T is the number of time steps and D is the feature dimension of each time step. The features of each input time step will be mapped to the query vector Q, key vector K and value vector V through linear transformation. This operation can be completed by the following matrix multiplication:

[0068] Q=F·W Q , K=F·W K , V=F·W V

[0069] Among them, W Q , W K and W V is a training optimizable weight matrix, which is used to generate query, key and value vectors respectively. The inner product of query vector Q and key vector K is used to calculate the attention weight, and the formula is as follows:

[0070]

[0071] Among them, d k is the dimension of the key vector, Q·K T is the dot product of the query and key vectors, indicating the similarity between them. The importance of each time step is obtained by scaling the dot product result and calculating the normalized weight through the softmax function. The value vector V is weighted summed by the calculated attention weight to obtain the final feature representation of each time step.

[0072] (4.2) Each layer of Transformer first calculates the feature importance of each time step in the sequence through the self-attention mechanism, and then performs nonlinear transformation on the features of each time step through the feedforward neural network. The feedforward neural network usually consists of two fully connected layers and an activation function:

[0073] FFN(x)=ReLU(xW 1 +b 1 )W 2 +b 2

[0074] Among them, W 1 and W 2 is the weight matrix, b 1 and b 2 is the bias term. In each layer of Transformer, the input and output are added through the residual connection to ensure that information can be effectively transmitted and avoid the gradient vanishing problem. The formula is:

[0075] Output l =LayerNorm(F (l) +AttentionOutput)

[0076] Among them, AttentionOutput is the output of the self-attention layer, F (l) is the input of the current layer, and LayerNorm is a layer normalization operation to ensure that the scale of each layer output is consistent. By stacking multiple Transformer layers, the output of each layer will be used as the input of the next layer, and finally a deep feature representation is obtained.

[0077] The execution process of step S5 can be divided into the following steps:

[0078] (5.1) By calculating the reconstruction error of each time window, the model's ability to reconstruct the input data is evaluated. For each time window i, the reconstruction error calculation formula is:

[0079]

[0080] Among them, X i is the input feature of time window i, is the reconstruction result output by the model, ||·|| 2 Represents the square of the Euclidean distance, that is, the difference between the original data and the reconstructed data. If the reconstruction error is large, it means that the input data of the time window is not well reconstructed by the model and there may be anomalies. On the contrary, a small error indicates that the data of the time window conforms to the normal pattern learned by the model.

[0081] (5.2) Calculate the reconstruction error of each time window based on the training data. By calculating the reconstruction error distribution of all time windows in the training data, select the time window with a reconstruction error greater than the 95% percentile as abnormal data. For each time window i, calculate its reconstruction error Error i , and collect the reconstruction error values ​​in all training sets.

[0082] (5.3) For each time window in the test data, calculate its anomaly score. The anomaly score is proportional to the reconstruction error. The larger the reconstruction error, the higher the anomaly score. For each time window i, the anomaly score calculation formula is:

[0083] AnomalyScore i =Error i

[0084] Compare the anomaly score of each time window with the threshold set in step 5.2. If the anomaly score is higher than the threshold, the time window is considered anomaly data. i >Threshold, the time window i is determined to be an abnormal time window. Otherwise, the time window is determined to be a normal time window.

[0085] Compared with the prior art solutions, the present invention has the following beneficial effects:

[0086] The present invention combines graph neural network and Transformer model to propose a new method for detecting abnormal data of satellite communication server. The method accurately identifies abnormal behavior by extracting time series features and nonlinear relationships in multivariate time series. The correlation matrix between features is constructed by calculating the Spearman correlation coefficient, which effectively captures the rank correlation between performance indicators and provides reliable prior information for the model. Unlike traditional methods, nonlinear correlation is considered and complex data dependencies can be processed. Graph neural network is used for feature aggregation, information of adjacent nodes is integrated, and complex relationships between features are learned through multi-layer stacking to improve the expression ability of the model. The self-attention mechanism of Transformer enhances the ability to capture global correlation by weighted processing of each time window, which helps to identify abnormal patterns. Combining reconstruction error and threshold judgment method, the detection threshold is set based on training data, abnormal data is accurately identified, and the adaptability of the model is improved. By stacking GCN and Transformer, the model can effectively extract deep time series features to ensure accuracy and stability.

[0087] It should be noted that the above embodiments are only examples of the technical solutions of the present invention and do not constitute a limitation thereto. Those skilled in the art may modify or replace the technical solutions in the embodiments without departing from the essence of the present invention, and such modifications or replacements still fall within the protection scope of the present invention.

Claims

1. A satellite communication server abnormal data detection method based on Transformer and GCN network, characterized in that: The following steps are involved: Step 1: Preprocess the multivariate time series data of the satellite communication server, split it into fixed-length time windows, and generate embedded features; Step 2: Calculate the Spearman correlation coefficient between each feature pair in the data set to quantify the rank correlation between features, construct a correlation matrix between features, and provide reliable prior information for subsequent models; Step 3: Use the Spearman graph neural network to extract complex relationships in multivariate time series and update the representation of each node through feature aggregation of GCN; Step 4: Input the features extracted by GCN into the original Transformer model and use the standard self-attention mechanism to process the time series data; Step 5: Calculate the reconstruction error of each time window based on the model output, and the time window with anomaly score higher than the preset threshold is judged as abnormal.

2. The method for detecting abnormal data of a satellite communication server based on Transformer and GCN network as claimed in claim 1, characterized in that: The execution process of step 1 includes the following operations: Step 1.1: Normalize each feature in the original time series data and scale the value to the range of [0, 1] to eliminate the impact of dimensional differences between features on model training. Step 1.2: Perform sliding window segmentation on the normalized time series data to generate fixed-length time segments. The length N of the time window and the sliding step size can be adjusted according to the specific application scenario. Step 1.3: Embed the data of each time window, map the original high-dimensional features to the low-dimensional embedding space through dimensionality reduction or feature encoding technology, and retain the key feature information for subsequent modeling.

3. The method for detecting abnormal data of a satellite communication server based on Transformer and GCN network as claimed in claim 2, characterized in that: The execution process of step 2 includes the following operations: Step 2.1: The Spearman correlation coefficient measures the rank correlation between two features and reflects the monotonic relationship between them. The calculation result is expressed in matrix form and used as the adjacency matrix input of the graph neural network. Step 2.2: Sort the data of each feature by value and assign a rank value. If there are duplicates in the feature value, assign the average rank value to the duplicate values ​​to ensure the accuracy of the correlation coefficient calculation. Step 2.3: The Spearman correlation coefficient is calculated for all the features in the multivariate time series in pairs. The formula is: Among them, ρ ij represents the Spearman correlation coefficient between i and j, d k is the rank difference on sample k, and n is the number of samples. The correlation matrix obtained by this method is used to construct the adjacency matrix of GCN.

4. The method for detecting abnormal data of a satellite communication server based on Transformer and GCN network as claimed in claim 3, characterized in that: The execution process of step 3 includes the following operations: Step 3.1: Use the Spearman correlation matrix generated in step 2 as the adjacency matrix to initialize the topological structure of the graph neural network to reflect the correlation between features. Step 3.2 updates the feature representation of each node through the feature aggregation operation of the graph neural network layer. The calculation formula is: F (l) =σ(A·F (l-1) .W (l) ) Where A is the Spearman correlation matrix, F (l-1) is the node feature matrix of the previous layer, F (l) is the node feature matrix of the current layer, W(l) is the weight matrix that can be optimized for training, and σ is the activation function. The multi-layer stacking of GCN extracted features can capture the complex relationship between nodes.

5. The method for detecting abnormal data of a satellite communication server based on Transformer and GCN network as claimed in claim 4, characterized in that: The execution process of step 4 includes the following operations: Step 4.1: Calculate the feature importance of each time step in the sequence through the Transformer's multi-head self-attention mechanism. The formula is: Where Q, K, and V are query, key, and value vectors respectively, and d k is the dimension of the key vector. The self-attention mechanism is used to improve the model’s ability to capture global correlations in the input sequence. Step 4.2: Extract deep temporal features by stacking multiple layers of Transformer modules to generate feature representations useful for anomaly detection tasks.

6. The method for detecting abnormal data of a satellite communication server based on Transformer and GCN network as claimed in claim 5, characterized in that: The execution process of step 5 includes the following operations: Step 5.1: Compare the reconstruction result output by the Transformer model with the input features and calculate the reconstruction error for each time window. The formula is: Among them, X is the input feature, The result of model reconstruction. Step 5.2: Set the threshold for anomaly detection based on the reconstructed error distribution of the training data, usually determined by percentile or fixed value. Step 5.3: Calculate the anomaly score for each time window of the test data. If the score is higher than the threshold, the time window is determined to be an abnormal time period.

Images