A satellite communication server abnormal data detection method based on a Transformer and a GCN network

Abstract

The application relates to an abnormality detection method for satellite communication server data. Specifically, the problem of poor abnormality detection effect caused by high complexity of server data and variable data flow characteristics in a satellite communication system is solved. The method constructs an adjacency matrix between features through a Spearman correlation coefficient, provides high-quality prior information for a GCN, captures complex dependency relationships between time series features, and generates global feature representation. Subsequently, the global features extracted by the GCN are input into a Transformer model as input, and the dynamic patterns and long-range dependency relationships in the time series are mined through the self-attention mechanism of the Transformer. The Transformer can combine the time sequence characteristics of the sequence data, further optimize the time correlation expression of the global features, and improve the description ability of the features. Finally, the output features of the GCN and the Transformer are combined by using an abnormality detection module to accurately locate and predict abnormal points in the time series. The method provided by the application uses the GCN to capture global dependency relationships and uses the Transformer to model time dynamic patterns, thereby significantly improving the accuracy and robustness of satellite communication server abnormality detection.

Description

Technical Field

[0001] This invention belongs to the field of time series and anomaly detection, specifically relating to a method for detecting abnormal data in satellite communication servers based on Transformer and GCN networks. Background Technology

[0002] Satellite communication servers are crucial infrastructure for data processing and mission management in modern satellite systems and integrated space-air-ground environments. Through efficient allocation of computing resources and communication task scheduling, satellite communication servers support various functions such as satellite link monitoring, data transmission, and mission planning, providing highly reliable, high-throughput, and real-time service capabilities. In satellite communication systems, anomaly detection aims to identify abnormal data points that deviate from normal communication patterns and has become an important means of ensuring system security and communication quality.

[0003] Traditional machine learning methods typically rely on ample labeled data and explicit feature representations, making their performance susceptible to degradation in scenarios involving high-dimensional data, nonlinear relationships, and dynamically changing distributions. Typical techniques include Support Vector Machines (SVMs), K-means clustering, Isolation Forests, and Principal Component Analysis (PCA). Deep learning, through the multi-layered structure of neural networks, can automatically extract deep features from data, making it particularly suitable for processing high-dimensional and unstructured data. In time series anomaly detection, techniques such as Recurrent Neural Networks (RNNs), Long Short-Term Memory (LSTM) networks, and Transformers have been widely applied. However, they suffer from high computational demands for large-scale data, reliance on labeled data, and insufficient model interpretability. Therefore, existing methods still need improvement in balancing model performance and efficiency while enhancing their adaptability to dynamic environments. Summary of the Invention

[0004] The purpose of this invention is to provide a method for detecting abnormal data in satellite communication servers based on Transformer and GCN networks. By combining time series features and multivariate relationship modeling, this method identifies potential data patterns in the satellite communication server data. This method can comprehensively analyze the complex characteristics of system operation data, construct accurate benchmarks for normal behavior, and effectively detect abnormal situations that deviate from the system's expected behavior. This method can improve the anomaly detection accuracy and real-time response capability of satellite communication server systems, thereby ensuring system stability and data security.

[0005] To achieve the above objectives, the technical solution adopted by the present invention includes the following steps:

[0006] Step 1: Preprocess the multivariate time series data from the satellite communication server, segment it into fixed-length time windows, and generate embedded features;

[0007] Step 2: Calculate the Spearman correlation coefficient between each feature pair in the dataset to quantify the rank correlation between features, construct the correlation matrix between features, and provide reliable prior information for subsequent models;

[0008] Step 3: Use Spearman graph neural network to extract complex relationships in multivariate time series, and update the representation of each node through feature aggregation of GCN;

[0009] Step 4: Input the features extracted by GCN into the original Transformer model and process the time series data using the standard self-attention mechanism;

[0010] Step 5: Calculate the reconstruction error for each time window based on the model output. Time windows with anomaly scores higher than the preset threshold are judged as anomalies.

[0011] Optionally, the execution process of step 1 includes the following steps:

[0012] Step 1.1: Normalize each feature in the original time series data, scaling the values ​​to the range of [0, 1] to eliminate the impact of differences in the units of the features on model training.

[0013] Step 1.2: Perform sliding window segmentation on the normalized time series data to generate fixed-length time segments. The length N of the time window and the sliding step size can be adjusted according to the specific application scenario.

[0014] Step 1.3: Embed the data for each time window, mapping the original high-dimensional features to a low-dimensional embedding space through dimensionality reduction or feature encoding techniques, while retaining key feature information for subsequent modeling.

[0015] Optionally, in step 1, a normalization method is used to scale the feature values ​​to the range of zero to one, in order to reduce the impact of different feature magnitudes on the model. When segmenting the time window, the length of the sliding window is fixed at 100, and the sliding step size is set to 50 to ensure a balance between data coverage and computational efficiency.

[0016] Optionally, the execution process of step 3 includes the following steps:

[0017] Step 3.1: Use the Spearman correlation matrix generated in Step 2 as the adjacency matrix to initialize the topology of the graph neural network, reflecting the correlation between features.

[0018] Step 3.2 Updates the feature representation of each node through feature aggregation operations of the graph neural network layers. The calculation formula is as follows:

[0019] F (l) =σ(A·F (l-1) ·W (l) )

[0020] Where A is the Spearman correlation matrix, F (l-1) F is the node feature matrix of the previous layer. (l) W is the node feature matrix of the current layer. (l) To train an optimizable weight matrix, σ is the activation function. The multi-layer stacking of features extracted by GCN can capture complex relationships between nodes.

[0021] Optionally, when constructing the Spearman correlation matrix, feature pairs with correlation coefficients greater than 0.5 are selected as connection edges to filter out weakly correlated or irrelevant feature relationships. The ReLU activation function is used to enhance non-linear expressive power, and the GCN is set to two layers to balance the depth of feature extraction with computational complexity.

[0022] Optionally, the execution process of step 5 includes the following steps:

[0023] Step 5.1: Compare the reconstruction result output by the Transformer model with the input features, and calculate the reconstruction error for each time window. The formula is as follows:

[0024]

[0025] Where X is the input feature. This is the result of model reconstruction.

[0026] Step 5.2: Set the threshold for anomaly detection based on the reconstruction error distribution of the training data, usually determined by percentiles or fixed values.

[0027] Step 5.3: Calculate the anomaly score for each time window of the test data. If the score is higher than the threshold, the time window is determined to be an abnormal time period.

[0028] Optionally, when calculating the reconstruction error, the mean squared error is used as the evaluation metric to measure the difference between the model output and the input. The threshold for anomaly detection is set to the 95th percentile of the reconstruction error distribution; time windows exceeding this value are considered anomalies to ensure the sensitivity of anomaly detection.

[0029] This invention provides an anomaly detection method for satellite communication server data based on Transformer and GCN networks. Taking multivariate time-series data from satellite communication servers as the research object, and addressing the complex nonlinear correlations and temporal dependencies among multivariate features, the Spearman correlation coefficient method is used to calculate the rank correlation between features, constructing a correlation matrix to extract latent pattern relationships in the multivariate time series. Furthermore, to address the difficulty of traditional methods in effectively capturing complex relationships between multivariates, a graph neural network is used to extract local and global correlations between features, and the self-attention mechanism of the Transformer model is used to further extract deep pattern relationships in the time-series features. In addition, to ensure the accuracy and robustness of anomaly detection, this invention optimizes the feature aggregation mechanism in GCN and reasonably sets model parameters, improving the accuracy and generalization ability of anomaly detection in complex environments. Attached Figure Description

[0030] To more clearly and in detail illustrate the technical solutions in the embodiments of the present invention or the prior art, the accompanying drawings involved in the description of the embodiments or the prior art will be briefly introduced below. These drawings are intended to provide assistance in understanding the technical solutions of the present invention, but are limited to some embodiments of the present invention and do not constitute a limitation on the present invention.

[0031] Figure 1 This is a network topology diagram of abnormal data detection network for satellite communication servers based on Transformer and GCN networks.

[0032] Figure 2 This is a flowchart of a method for detecting abnormal data in satellite communication servers based on Transformer and GCN networks.

[0033] Figure 3 This is a schematic diagram illustrating data correlation in a specific embodiment of the present invention.

[0034] Figure 4 This is a data processing flowchart of the present invention.

[0035] Figure 5 This is a flowchart of the anomaly determination process of the present invention. Detailed Implementation

[0036] The present invention will be described in detail below with reference to specific implementation examples. These examples will help those skilled in the art to further understand the present invention, but do not limit the present invention in any way.

[0037] This invention provides a method for detecting abnormal data in satellite communication servers based on Transformer and GCN networks, comprising the following steps:

[0038] S1: Preprocess the multivariate time series data of the satellite communication server, segment it into fixed-length time windows, and generate embedded features;

[0039] S2: Calculate the Spearman correlation coefficient between each feature pair in the dataset to quantify the rank correlation between features, construct the correlation matrix between features, and provide reliable prior information for subsequent models;

[0040] S3: Use Spearman graph neural network to extract complex relationships in multivariate time series, and update the representation of each node through feature aggregation of GCN;

[0041] S4: Input the features extracted by GCN into the original Transformer model and process the time series data using the standard self-attention mechanism;

[0042] S5: Calculate the reconstruction error for each time window based on the model output. Time windows with anomaly scores higher than the preset threshold are judged as anomalies.

[0043] The specific execution steps and procedures are as follows: Figure 1 As shown, the following description, in conjunction with specific embodiments and execution steps, will provide further details:

[0044] The execution process of step S1 can be broken down into the following steps:

[0045] (1.1) Collect various performance metrics data from the satellite communication server. Performance metrics include CPU utilization, memory usage, network traffic, disk I / O, etc. The dataset is recorded in time series format, with a time step of one minute. Each time point record contains multiple feature data, forming a multidimensional vector. If there are M performance metrics, then the data at each time point contains M values. The data structure is a two-dimensional matrix, where each row represents the data at a time point, and each column represents the value of a performance metric.

[0046] (1.2) To eliminate the impact of differences in the dimensions of different features on subsequent model training, data normalization is required. After normalization, the value of each feature will be mapped to the same range, allowing each feature to be compared and calculated on the same scale. The normalization formula for each feature is as follows:

[0047]

[0048] Where X represents the original feature value, and X′ represents the normalized feature value. The normalization operation maps the minimum value of each feature to 0 and the maximum value to 1, ensuring that the values ​​of all features are within the range of 0 to 1.

[0049] For each feature, find the minimum and maximum values ​​of that feature across all sample data, and use this formula to scale the original data to the [0, 1] interval.

[0050] (1.3) The normalized time series data is segmented using a sliding window of fixed length. Each time window contains data from N consecutive time steps. The window length N is set to 100, and the sliding step size is set to 50, meaning that the window moves forward 50 time steps each time it slides, generating multiple time windows. Then, the feature matrix of each time window is calculated, forming an N×M matrix, where N is the time window length and M is the number of features. PCA is applied to reduce the dimensionality of the standardized data, selecting the variance retained to be more than 90% as the principal components.

[0051] The execution process of step S2 can be broken down into the following steps:

[0052] (2.1) Extract each feature (e.g., CPU utilization, memory usage, network traffic, etc.) from the multivariate time series data of the satellite communication server. Assume there are N samples, each containing M features. For each pair of features, first sort their values ​​across all samples. For example, sort each sample value of feature A and feature B to obtain the rank. Assume the sample values ​​of feature A and feature B are A1, A2, ..., A... N And B1, B2..., B N Sort them separately to obtain the ordered column R. A and R B For each pair of samples i, calculate its rank difference d on features A and B. i ,Right now:

[0053]

[0054] in, and Let A and B represent the ranks of features A and B on sample i, respectively. If two sample values ​​are equal, they are given the same rank, and the average of those ranks is calculated.

[0055] (2.2) Calculate the Spearman correlation coefficient ρ using the following formula:

[0056]

[0057] Where n is the number of samples, d iLet ρ be the rank difference between each pair of samples on features A and B. The denominator in the formula is a standardization factor to ensure that the correlation coefficient value is in the range [-1, 1]. Finally, ρ represents the rank correlation between features A and B. Repeat the above process for all feature pairs in the dataset to calculate the Spearman correlation coefficient between each pair of features. The final result is a symmetric correlation coefficient matrix, where each element of the matrix represents the rank correlation between the corresponding two features.

[0058] (2.3) Construct an M×M symmetric matrix. Each element C in the matrix... ij ρ represents the Spearman correlation coefficient between feature i and feature j. ij The calculated Spearman correlation coefficients for each pair of features are then filled into the correlation matrix. The diagonal elements C of the matrix... ii A value of 1 indicates that the correlation between each feature and itself is at its maximum. Elements C at other positions... ij Let be the correlation coefficient between feature i and feature j. Based on the correlation matrix, select the feature pairs most relevant to the target variable. Feature pairs with a correlation coefficient greater than 0.5 can be selected, as these feature pairs play an important role in the model.

[0059] The execution process of step S3 can be broken down into the following steps:

[0060] (3.1) The adjacency matrix is ​​normalized using the degree matrix normalization method. Each diagonal element D in the degree matrix... ii The degree of feature i represents the sum of the correlations between feature i and other features. The normalization formula for the adjacency matrix is:

[0061] A′=D- 1 / 2 AD- 1 / 2

[0062] Where A is the original adjacency matrix, D is the degree matrix, and A′ is the normalized adjacency matrix. This normalization process helps balance the influence of different nodes in a graph neural network, avoiding bias caused by excessively high node degrees.

[0063] (3.2) The input features of each node come from the data in steps S1 and S2. Each node represents a feature within a time window, and the initial node feature matrix consists of the feature vectors of each time window, i.e., the features obtained after preprocessing the data of each time window. For each layer of the graph neural network, the node features are updated using the following formula:

[0064] F( l )=σ(AF( l -1).W( l ))

[0065] Among them, F (l-1) Let be the feature matrix of the previous layer, representing the feature representation of each node in the previous layer. A is the adjacency matrix, used to describe the relationships and dependencies between features. W(l) is the optimizable weight matrix of the current layer, used to learn the transformation of node features. σ is the activation function using ReLU, used to introduce non-linearity, enabling the model to learn complex feature relationships.

[0066] The execution process of step S4 can be broken down into the following steps:

[0067] (4.1) The features extracted by the graph neural network in step 3 are used as input to the Transformer model. The feature matrix F output by the GCN has dimensions T×D, where T is the number of time steps and D is the feature dimension of each time step. The features of each input time step are mapped to the query vector Q, key vector K, and value vector V through linear transformation. This operation can be accomplished by the following matrix multiplication:

[0068] Q = F·W Q K = F·W K V = F·W V

[0069] Among them, W Q W K and W V This is a training-optimizable weight matrix used to generate query, key, and value vectors, respectively. The inner product of the query vector Q and the key vector K is used to calculate the attention weights, as shown in the following formula:

[0070]

[0071] Where, d k It is the dimension of the key vector, Q·K T The dot product of the query and key vectors represents their similarity. The importance at each time step is obtained by scaling the dot product and calculating normalized weights using the softmax function. The final feature representation for each time step is obtained by weighted summation of the calculated attention weights over the value vector V.

[0072] (4.2) Each Transformer layer first calculates the feature importance of each time step in the sequence through a self-attention mechanism, and then performs a nonlinear transformation on the features of each time step through a feedforward neural network. The feedforward neural network typically consists of two fully connected layers and an activation function:

[0073] FFN(x)=ReLU(xW1+b1)W2+b2

[0074] Where W1 and W2 are weight matrices, and b1 and b2 are bias terms. In each Transformer layer, the input and output are added together through a residual connection to ensure effective information transfer and avoid the vanishing gradient problem. The formula is:

[0075] Output l =LayerNorm(F (l) +AttentionOutput)

[0076] Where AttentionOutput is the output of the self-attention layer, F (l) This is the input to the current layer. LayerNorm is a layer normalization operation that ensures that the output of each layer has a consistent scale. By stacking multiple Transformer layers, the output of each layer will serve as the input to the next layer, ultimately resulting in a deep feature representation.

[0077] The execution process of step S5 can be broken down into the following steps:

[0078] (5.1) The model's ability to reconstruct the input data is evaluated by calculating the reconstruction error for each time window. For each time window i, the reconstruction error is calculated using the following formula:

[0079]

[0080] Among them, X i Let i be the input feature for time window i. The reconstruction result output by the model, ||·|| 2 This represents the square of the Euclidean distance, which calculates the difference between the original data and the reconstructed data. A large reconstruction error indicates that the input data for that time window was not well reconstructed by the model, and there may be anomalies. Conversely, a smaller error indicates that the data for that time window conforms to the normal pattern learned by the model.

[0081] (5.2) Calculate the reconstruction error for each time window based on the training data. By calculating the reconstruction error distribution of all time windows in the training data, time windows with reconstruction errors greater than the 95th percentile are selected as outliers. For each time window i, calculate its reconstruction error Error. i And collect reconstruction error values ​​from all training sets.

[0082] (5.3) Calculate the anomaly score for each time window in the test data. The anomaly score is proportional to the reconstruction error; the larger the reconstruction error, the higher the anomaly score. For each time window i, the anomaly score calculation formula is:

[0083] AnomalyScore i =Error i

[0084] The anomaly score for each time window is compared to the threshold set in step 5.2. If the anomaly score is higher than the threshold, the time window is considered anomalous data. If the AnomalyScore... i If the value is greater than Threshold, then the time window i is determined to be an abnormal time window. Otherwise, the time window is determined to be a normal time window.

[0085] Compared with existing technical solutions, the present invention has the following beneficial effects:

[0086] This invention proposes a novel method for detecting anomalous data in satellite communication servers, combining graph neural networks (GCNs) and the Transformer model. This method accurately identifies anomalous behavior by extracting temporal features and nonlinear relationships from multivariate time series data. A correlation matrix between features is constructed by calculating the Spearman correlation coefficient, effectively capturing the rank correlation between performance indicators and providing reliable prior information for the model. Unlike traditional methods, this method considers nonlinear correlations, enabling it to handle complex data dependencies. A graph neural network is used for feature aggregation, fusing information from neighboring nodes, and learning complex relationships between features through multi-layer stacking, enhancing the model's expressive power. The Transformer's self-attention mechanism enhances the ability to capture global correlations by weighting each time window, aiding in the identification of anomalous patterns. Combining reconstruction error and threshold determination methods, a detection threshold is set based on training data to accurately identify anomalous data and improve the model's adaptability. Through GCN and Transformer stacking, the model can effectively extract deep-level temporal features, ensuring accuracy and stability.

[0087] It should be noted that the above embodiments are merely examples of the technical solutions of the present invention and do not constitute a limitation thereof. Those skilled in the art can modify or make equivalent substitutions to the technical solutions in the embodiments without departing from the essence of the present invention, and such modifications or substitutions still fall within the protection scope of the present invention.

Claims

1. A method for detecting abnormal data in a satellite communication server based on Transformer and graph neural networks, characterized in that, Includes the following steps: Step 1: Preprocess the multivariate time series data from the satellite communication server, segment it into fixed-length time windows, and generate embedded features; Step 2: For the normalized multivariate time series data, sort the values ​​in each feature dimension by rank, and assign an average rank value to cases with duplicate values; calculate the Spearman correlation coefficient for all feature pairs in turn, using the following formula: in, express and Spearman correlation coefficient, For the sample rank difference on Given the sample size; construct a symmetric correlation matrix from the correlation coefficients of all feature pairs; Step 3: Input the correlation matrix as an adjacency matrix into the graph neural network to extract complex feature relationships in the multivariate time series, and update the representation of each node through the feature aggregation mechanism of the graph neural network; Step 4: Input the features extracted by the graph neural network into the Transformer model and process the time series data using the standard self-attention mechanism; Step 5: Calculate the reconstruction error for each time window based on the model output, and use the error as a score. If the score exceeds the preset threshold, the time window is judged as abnormal.

2. The method for detecting abnormal data in a satellite communication server based on Transformer and graph neural networks as described in claim 1, characterized in that, The execution process of step 1 includes the following operations: Step 1.1: Normalize each feature in the original time series data, scaling the values ​​to the range of [0,1] to eliminate the impact of differences in the units between features on model training; Step 1.2: Perform sliding window segmentation on the normalized time series data to generate time segments of fixed length; Step 1.3: Embed the data for each time window, mapping the original high-dimensional features to a low-dimensional embedding space through dimensionality reduction or feature encoding techniques.

3. The method for detecting abnormal data in a satellite communication server based on Transformer and graph neural networks as described in claim 1, characterized in that, The execution process of step 3 includes the following operations: Step 3.1: Use the correlation matrix generated in Step 2 as the adjacency matrix to initialize the topology of the graph neural network. The topology reflects the correlation between features. Step 3.2 Update the feature representation of each node through the feature aggregation operation of the graph neural network layer, using the following formula: in, The Spearman correlation matrix, This is the node feature matrix of the previous layer. This is the node feature matrix of the current layer. To train an optimizable weight matrix, This is the activation function.

4. The method for detecting abnormal data in a satellite communication server based on Transformer and graph neural networks as described in claim 1, characterized in that, The execution process of step 4 includes the following operations: Step 4.1: Calculate the feature importance at each time step in the sequence using the multi-head self-attention mechanism of the Transformer model. The formula is: in, These are query, key, and value vectors, respectively. The dimension of the key vector; Step 4.2: Extract deep temporal features by stacking multiple Transformer models to generate feature representations useful for anomaly detection tasks.

5. The method for detecting abnormal data in a satellite communication server based on Transformer and graph neural networks as described in claim 1, characterized in that, The execution process of step 5 includes the following operations: Step 5.1: Compare the reconstruction result output by the Transformer model with the input features, and calculate the reconstruction error for each time window. The formula is as follows: in, For input features, The result of model reconstruction; Step 5.2: Set the anomaly detection threshold based on the reconstruction error distribution of the training data; Step 5.3: Calculate the score for each time window of the test data. If the score is higher than the threshold, the time window is determined to be an abnormal time period.

Images