Abnormal time series data detection method and device based on multi-view space-time interactive attention network

Abstract

The invention belongs to the technical field of nuclear power, and particularly relates to an abnormal time series data detection method and device based on a multi-view space-time interactive attention network. According to the method and the device, complex spatial-temporal correlation dependency in the multi-source time series data of the industrial control system can be fully mined, so that time series data anomaly detection can be more comprehensively modeled. The method focuses on carrying out joint characterization learning on multi-view features such as global level and local level of time series data; constructing a time domain and space domain multi-head self-attention mechanism to perform space-time content interactive aggregation to obtain a content perception representation, and performing space-time association learning by using a plurality of stacked graph attention network layers to obtain an association perception representation; and finally, in a double attention intensified comparison reconstruction module, respectively adopting global and local multi-head cross attention mechanisms to further obtain a reconstruction time sequence, thereby effectively realizing multi-source time sequence data anomaly detection in the industrial control system.

Description

Technical Field

[0001] The present invention belongs to the field of nuclear power technology, and specifically relates to a method and device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network. Background Art

[0002] Industrial control systems are the "core brain" of industrial production. They are used to monitor and manage physical equipment in the industrial production process, ensure the stability and reliability of production, and improve production efficiency. They are widely used in the field of critical information infrastructure. With the integration and development of industrial Internet and automatic control technology, the pace of industrial digitalization has become more and more firm. Production lines and intelligent equipment have achieved real-time perception of operating status and operating environment through sensors, controllers, and intelligent instruments. Sensors on various devices have generated a large amount of industrial time series data. Mining useful information from these data has become an important task for researchers and practitioners.

[0003] At present, anomaly detection of time series data in industrial control systems still faces many challenges. For example, massive time series data has spatiotemporal correlation, that is, there is interaction and interdependence between different time domains and spatial domains in the data set, and a joint general model framework needs to be constructed to fully learn the spatiotemporal correlation of time series data in different dimensions; existing research ignores the mining of spatiotemporal heterogeneity of time series data, showing different characteristics, trends and relationships in different time periods and node areas, that is, the inherent variability and diversity in the time domain and spatial domain of the data set, lacks the learning of the interaction of spatiotemporal characteristics and multivariate correlation dependence of data in industrial control systems; time series data shows a certain degree of complexity, and the characteristics of different perspectives such as globality and locality in the time series are not effectively processed step by step, which affects the overall accuracy and robustness of the model. Therefore, it is urgent to solve the above problems in order to improve the detection accuracy and efficiency. Summary of the invention

[0004] In order to overcome the problems existing in the related art, a method and device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network are provided.

[0005] According to one aspect of an embodiment of the present disclosure, a method for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network is provided, the method comprising:

[0006] Step 1: Data preprocessing: normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data division into training and test sets;

[0007] Step 2: Extract multi-view temporal features, construct temporal global-level feature encoder and temporal local-level feature encoder, use the dilated temporal convolutional network to obtain global-level temporal features, and use the causal temporal convolutional network to obtain local-level temporal features;

[0008] Step 3: Construct a spatiotemporal interaction aggregation module, respectively construct a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the space domain multi-head self-attention mechanism model, and output the space domain representation; perform low-rank bilinear pooling on the time domain representation and the space domain representation to obtain the content-aware representation of the aggregated space-time;

[0009] Step 4: Construct a spatiotemporal association learning module, use multi-source sensors and time series as graph nodes, use graph attention networks to adaptively capture spatiotemporal association relationships, and design stacked spatial domain graph attention network layers and temporal domain graph attention network layers to obtain association perception representations;

[0010] Step 5: Construct a dual attention-enhanced contrast reconstruction module, respectively construct a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model, so as to further decode the global-level reconstruction sequence and the local-level reconstruction sequence, and design a global-local contrast loss function to minimize the difference between the global-level reconstruction sequence and the local-level reconstruction sequence to constrain representation learning;

[0011] Step 6: Design a reconstruction loss function to minimize the reconstruction error of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

[0012] In a possible implementation, in step 1, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0013] In a possible implementation, in step 3, a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model are respectively constructed based on the Transformer self-attention model structure.

[0014] In one possible implementation, in step 5, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are respectively constructed based on the Transformer cross-attention model structure.

[0015] According to another aspect of an embodiment of the present disclosure, a device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network is provided, the device comprising:

[0016] The data preprocessing module is used to normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data division into training sets and test sets;

[0017] Multi-view temporal feature extraction module, used to construct temporal global-level feature encoder and temporal local-level feature encoder, using a dilated temporal convolutional network to obtain global-level temporal features and a causal temporal convolutional network to obtain local-level temporal features;

[0018] The spatiotemporal interaction aggregation module is used to respectively construct a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the space domain multi-head self-attention mechanism model, and output the space domain representation; perform low-rank bilinear pooling on the time domain representation and the space domain representation to obtain the content-aware representation of the aggregated space-time;

[0019] The spatiotemporal association learning module is used to adaptively capture spatiotemporal association relationships using graph attention networks, with multi-source sensors and time series as graph nodes, and to design stacked spatial domain graph attention network layers and temporal domain graph attention network layers, so as to obtain association perception representations.

[0020] The dual attention-enhanced contrast reconstruction module is used to construct a global multi-head cross-attention mechanism model and a local multi-head cross-attention mechanism model, respectively, so as to further decode the global reconstruction sequence and the local reconstruction sequence. At the same time, a global-local contrast loss function is designed to minimize the difference between the global reconstruction sequence and the local reconstruction sequence to constrain representation learning;

[0021] The reconstruction loss function module is used to minimize the reconstruction errors of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

[0022] In a possible implementation, in the data preprocessing module, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0023] In one possible implementation, in the spatiotemporal interaction aggregation module, a temporal domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model are respectively constructed based on the Transformer self-attention model structure.

[0024] In one possible implementation, in the contrast reconstruction module of dual attention enhancement, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are respectively constructed based on the Transformer cross-attention model structure.

[0025] According to another aspect of an embodiment of the present disclosure, a device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network is provided, the device comprising:

[0026] processor;

[0027] a memory for storing processor-executable instructions;

[0028] Wherein, the processor is configured to execute the above method.

[0029] According to another aspect of an embodiment of the present disclosure, a non-volatile computer-readable storage medium is provided, on which computer program instructions are stored, and the computer program instructions implement the above method when executed by a processor.

[0030] The beneficial effect of the present disclosure is that the abnormal time series data detection method based on the multi-perspective spatiotemporal interactive attention network provided by the present disclosure can fully mine the complex spatiotemporal correlation dependency in the multi-source time series data of the industrial control system, so as to more comprehensively model the time series data anomaly detection. Focus on the joint representation learning of multi-perspective features such as the global level and the local level of the time series data; construct the multi-head self-attention mechanism in the time domain and the space domain to aggregate the spatiotemporal content interaction to obtain the content-aware representation, and use multiple stacked graph attention network layers to learn the spatiotemporal association to obtain the association-aware representation; finally, in the double attention enhanced contrast reconstruction module, the global and local multi-head cross-attention mechanisms are respectively used to further obtain the reconstructed time series sequence, so as to effectively realize the anomaly detection of multi-source time series data in the industrial control system. By mining the multi-perspective feature information of the time domain and the space domain in the global and local multi-source time series data, the spatiotemporal content interaction and spatiotemporal correlation dependency of the multivariate time series data are jointly modeled to further improve the anomaly detection performance of the time series data in the industrial control system. Assist relevant personnel to take corresponding measures to prevent accidents in the industrial control system. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 It is a flowchart of an abnormal time series data detection method based on a multi-view spatiotemporal interactive attention network shown in an embodiment of the present disclosure.

[0032] Figure 2 It is a block diagram of an abnormal time series data detection device based on a multi-view spatiotemporal interactive attention network shown in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The present disclosure is further described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] Unless otherwise defined, the technical and scientific terms used in the present disclosure have the same meanings as those generally understood by those skilled in the art to which the present disclosure belongs; the terms used in the present disclosure are only for the purpose of describing specific embodiments and are not intended to limit the present disclosure; the term "including" and any variations thereof in the present disclosure are intended to cover non-exclusive inclusions. Obviously, the embodiments described in the present disclosure are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making creative efforts are within the scope of protection of the present disclosure.

[0035] Reference to "embodiments" in this disclosure means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0036] Figure 1 is a flow chart of a method for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network according to an embodiment of the present disclosure. The method can be executed by a terminal device, wherein the terminal device can be a server, a desktop computer, etc. The embodiment of the present disclosure does not limit the type of the terminal device. Figure 1 As shown, the method includes:

[0037] Step 1: Data preprocessing. In order to ensure the robustness of the network model, the multi-source time series data of the industrial control system are normalized and converted into time series sliding windows for data division between the training set and the test set. In addition, in order to simulate the actual operation of the industrial control system that is susceptible to noise interference, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0038] Step 2: Extract multi-view temporal features, construct a temporal global-level feature encoder and a temporal local-level feature encoder, use a dilated temporal convolutional network to obtain global-level temporal features, and use a causal temporal convolutional network to obtain local-level temporal features.

[0039] Step 3: Construct a spatiotemporal interaction aggregation module, and construct a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model based on the Transformer self-attention model structure. Input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the spatial domain multi-head self-attention mechanism model, and output the spatial domain representation; in order to realize the fusion of multi-source heterogeneous data, perform low-rank bilinear pooling on the time domain representation and the spatial domain representation to obtain the content-aware representation of aggregated space-time.

[0040] Step 4: Construct a spatiotemporal association learning module, use multi-source sensors and time series as graph nodes, use graph attention networks to adaptively capture spatiotemporal association relationships, and design stacked spatial domain graph attention network layers and temporal domain graph attention network layers to obtain association perception representations.

[0041] Step 5: Construct a dual attention-enhanced contrast reconstruction module. Based on the Transformer cross-attention model structure, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are constructed respectively, so as to further decode the global-level and local-level reconstruction sequences. At the same time, a global-local contrast loss function is designed to minimize the difference between the two to constrain representation learning.

[0042] Step 6: Design a reconstruction loss function to minimize the reconstruction error of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

[0043] This paper provides an abnormal time series data detection method based on a multi-view spatiotemporal interactive attention network, which fully exploits the complex spatiotemporal correlation dependencies in multi-source time series data of industrial control systems, thereby more comprehensively modeling time series data anomaly detection. This framework can efficiently process multi-source time series data and has good model robustness and generalization capabilities.

[0044] This paper focuses on the joint representation learning of multi-view features such as global and local time series, which can effectively utilize the rich multi-view feature information in time series data and have more powerful feature extraction and representation capabilities;

[0045] A multi-head self-attention mechanism in the time domain and space domain is constructed to interactively aggregate spatiotemporal content to obtain content-aware representation. At the same time, multiple stacked-level graph attention network layers are used to learn spatiotemporal associations to obtain association-aware representations. This can fully mine the complex spatiotemporal dependencies in multi-source time series data and more accurately capture and model spatiotemporal content and association representations.

[0046] A dual-attention enhanced contrast reconstruction module is designed, which adopts global and local multi-head cross-attention mechanisms to further obtain the reconstructed time series sequence, thereby efficiently realizing the fusion of multi-source heterogeneous data to ensure the accuracy and consistency of time series data.

[0047] In summary, the present invention has obvious advantages in the feature extraction capability of time series data, spatiotemporal correlation representation learning, and multi-source heterogeneous data fusion. This method can not only maintain the stability and robustness of the network model, but also realize fast reasoning analysis and accurate detection.

[0048] According to another aspect of an embodiment of the present disclosure, a device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network is provided, the device comprising:

[0049] The data preprocessing module is used to normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data division into training sets and test sets;

[0050] Multi-view temporal feature extraction module, used to construct temporal global-level feature encoder and temporal local-level feature encoder, using a dilated temporal convolutional network to obtain global-level temporal features and a causal temporal convolutional network to obtain local-level temporal features;

[0051] The spatiotemporal interaction aggregation module is used to respectively construct a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the space domain multi-head self-attention mechanism model, and output the space domain representation; perform low-rank bilinear pooling on the time domain representation and the space domain representation to obtain the content-aware representation of the aggregated space-time;

[0052] The spatiotemporal association learning module is used to adaptively capture spatiotemporal association relationships using graph attention networks, with multi-source sensors and time series as graph nodes, and to design stacked spatial domain graph attention network layers and temporal domain graph attention network layers, so as to obtain association perception representations.

[0053] The dual attention-enhanced contrast reconstruction module is used to construct a global multi-head cross-attention mechanism model and a local multi-head cross-attention mechanism model, respectively, so as to further decode the global reconstruction sequence and the local reconstruction sequence. At the same time, a global-local contrast loss function is designed to minimize the difference between the global reconstruction sequence and the local reconstruction sequence to constrain representation learning;

[0054] The reconstruction loss function module is used to minimize the reconstruction errors of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

[0055] In a possible implementation, in the data preprocessing module, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0056] In one possible implementation, in the spatiotemporal interaction aggregation module, a temporal domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model are respectively constructed based on the Transformer self-attention model structure.

[0057] In one possible implementation, in the contrast reconstruction module of dual attention enhancement, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are respectively constructed based on the Transformer cross-attention model structure.

[0058] The description of the above-mentioned device has been explained in detail in the description of the above-mentioned method, and will not be repeated here.

[0059] Figure 2 1900 is a block diagram of an abnormal time series data detection device based on a multi-view spatiotemporal interactive attention network according to an embodiment of the present disclosure. For example, the device 1900 may be provided as a server. Figure 2 , the apparatus 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932 for storing instructions, such as an application, that can be executed by the processing component 1922. The application stored in the memory 1932 may include one or more modules, each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute instructions to perform the above method.

[0060] The device 1900 may also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 may operate based on an operating system stored in the memory 1932, such as Windows Server™, MacOS X™, Unix™, Linux™, FreeBSD™, or the like.

[0061] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions, which can be executed by the processing component 1922 of the device 1900 to perform the above method.

[0062] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0063] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0064] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0065] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0066] Various aspects of the present disclosure are described herein with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present disclosure. It should be understood that each box in the flowchart and / or block diagram and the combination of each box in the flowchart and / or block diagram can be implemented by computer-readable program instructions.

[0067] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine, so that when these instructions are executed by the processor of the computer or other programmable data processing device, a device that implements the functions / actions specified in one or more boxes in the flowchart and / or block diagram is generated. These computer-readable program instructions can also be stored in a computer-readable storage medium, and these instructions cause the computer, programmable data processing device, and / or other equipment to work in a specific manner, so that the computer-readable medium storing the instructions includes a manufactured product, which includes instructions for implementing various aspects of the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0068] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operating steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more boxes in the flowchart and / or block diagram.

[0069] The flow chart and block diagram in the accompanying drawings show the possible architecture, function and operation of the system, method and computer program product according to multiple embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and a part of the module, program segment or instruction includes one or more executable instructions for realizing the specified logical function. In some alternative implementations, the function marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two continuous square boxes can actually be executed substantially in parallel, and they can sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs the specified function or action, or can be implemented with a combination of special hardware and computer instructions.

[0070] The embodiments of the present disclosure have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and changes will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network, characterized in that: The method comprises: Step 1: Data preprocessing: normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data division into training and test sets; Step 2: Extract multi-view temporal features, construct temporal global-level feature encoder and temporal local-level feature encoder, use the dilated temporal convolutional network to obtain global-level temporal features, and use the causal temporal convolutional network to obtain local-level temporal features; Step 3: Construct a spatiotemporal interaction aggregation module, respectively construct a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the space domain multi-head self-attention mechanism model, and output the space domain representation; perform low-rank bilinear pooling on the time domain representation and the space domain representation to obtain the content-aware representation of the aggregated space-time; Step 4: Construct a spatiotemporal association learning module, use multi-source sensors and time series as graph nodes, use graph attention networks to adaptively capture spatiotemporal association relationships, and design stacked spatial domain graph attention network layers and temporal domain graph attention network layers to obtain association perception representations; Step 5: Construct a dual attention-enhanced contrast reconstruction module, respectively construct a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model, so as to further decode the global-level reconstruction sequence and the local-level reconstruction sequence, and design a global-local contrast loss function to minimize the difference between the global-level reconstruction sequence and the local-level reconstruction sequence to constrain representation learning; Step 6: Design a reconstruction loss function to minimize the reconstruction error of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

2. The method according to claim 1, characterized in that In step 1, white noise with a signal-to-noise ratio of 50d is added as basic data augmentation.

3. The method according to claim 1, characterized in that In step 3, based on the Transformer self-attention model structure, a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model are constructed respectively.

4. The method according to claim 1, characterized in that: In step 5, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are constructed based on the Transformer cross-attention model structure.

5. An abnormal time series data detection device based on a multi-view spatiotemporal interactive attention network, characterized in that: The device comprises: The data preprocessing module is used to normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data division into training sets and test sets; Multi-view temporal feature extraction module, used to construct temporal global-level feature encoder and temporal local-level feature encoder, using a dilated temporal convolutional network to obtain global-level temporal features and a causal temporal convolutional network to obtain local-level temporal features; The spatiotemporal interaction aggregation module is used to respectively construct a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the space domain multi-head self-attention mechanism model, and output the space domain representation; perform low-rank bilinear pooling on the time domain representation and the space domain representation to obtain the content-aware representation of the aggregated space-time; The spatiotemporal association learning module is used to adaptively capture spatiotemporal association relationships using graph attention networks, with multi-source sensors and time series as graph nodes, and to design stacked spatial domain graph attention network layers and temporal domain graph attention network layers, so as to obtain association perception representations. The dual attention-enhanced contrast reconstruction module is used to construct a global multi-head cross-attention mechanism model and a local multi-head cross-attention mechanism model, respectively, so as to further decode the global reconstruction sequence and the local reconstruction sequence. At the same time, a global-local contrast loss function is designed to minimize the difference between the global reconstruction sequence and the local reconstruction sequence to constrain representation learning; The reconstruction loss function module is used to minimize the reconstruction errors of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

6. The device according to claim 1, characterized in that In the data preprocessing module, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

7. The device according to claim 1, characterized in that In the spatiotemporal interaction aggregation module, the temporal domain multi-head self-attention mechanism model and the spatial domain multi-head self-attention mechanism model are constructed based on the Transformer self-attention model structure.

8. The device according to claim 1, characterized in that In the contrast reconstruction module of dual attention enhancement, the global-level multi-head cross-attention mechanism model and the local-level multi-head cross-attention mechanism model are constructed based on the Transformer cross-attention model structure.

9. An abnormal time series data detection device based on a multi-view spatiotemporal interactive attention network, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 4.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images