Abnormal time series data detection method and device based on multi-view spatio-temporal interaction attention network

Abstract

The present disclosure belongs to the technical field of nuclear power and specifically relates to an abnormal time series data detection method and device based on a multi-view spatiotemporal interaction attention network. The present disclosure can fully mine the complex spatiotemporal correlation dependence in the multi-source time series data of an industrial control system, thereby more comprehensively modeling time series data anomaly detection. It focuses on jointly representing learning of multi-view features such as global and local levels of time series data; constructs a multi-head self-attention mechanism in the time domain and the space domain to perform spatiotemporal content interaction aggregation to obtain content perception representation, and simultaneously utilizes multiple stacked graph attention network layers to perform spatiotemporal correlation learning to obtain correlation perception representation; finally, in a double-attention-reinforced comparative reconstruction module, a global and local multi-head cross-attention mechanism is respectively adopted to further obtain reconstructed time series, thereby effectively realizing multi-source time series data anomaly detection in an industrial control system.

Description

TECHNICAL FIELD

[0001] The present disclosure belongs to the technical field of nuclear power, and particularly relates to an abnormal time series data detection method and device based on a multi-view spatio-temporal interaction attention network. BACKGROUND

[0002] Industrial control systems are the "core brain" of industrial production, used to monitor and manage physical devices in industrial production processes, ensure production stability and reliability, and improve production efficiency, and are widely used in the field of critical information infrastructure. With the integration of industrial internet and automatic control technology, the pace of industrial digitization is becoming more and more determined, and production lines and intelligent equipment realize real-time perception of the running state and running environment through sensors, controllers, intelligent instruments, etc. A large amount of industrial time series data is generated by sensors on various devices, and mining useful information from these data has become an important task for researchers and practitioners.

[0003] Current industrial control system time series data anomaly detection still faces many challenges. For example, the massive time series data has spatio-temporal correlation, that is, there is interaction and mutual dependence between different time domains and spatial domains in the data set, and a joint general model framework needs to be constructed to fully learn the spatio-temporal correlation of time series data in different dimensions; existing research ignores the mining of spatio-temporal heterogeneity of time series data, and different characteristics, trends and relationships are shown in different time periods and node regions, that is, inherent variability and diversity on the time domain and spatial domain in the data set, and there is a lack of learning of spatio-temporal feature interaction and multivariate correlation dependence of data in the industrial control system; time series data shows a certain degree of complexity, and different perspectives such as globality and locality in the time series are not effectively processed step by step, thereby affecting the accuracy and robustness of the overall model. Therefore, the above problems need to be solved to improve the detection accuracy and efficiency. SUMMARY

[0004] To overcome the problems in the related art, an abnormal time series data detection method and device based on a multi-view spatio-temporal interaction attention network are provided.

[0005] According to an aspect of an embodiment of the present disclosure, an abnormal time series data detection method based on a multi-view spatio-temporal interaction attention network is provided, and the method comprises:

[0006] Step 1: data preprocessing, normalizing the multi-source time series data of the industrial control system, and converting it into a time series sliding window for data division of the training set and the test set;

[0007] Step 2: multi-view temporal feature extraction, constructing a temporal global level feature encoder and a temporal local level feature encoder, using a hollow time convolution network to obtain a global level temporal feature, and using a causal time convolution network to obtain a local level temporal feature;

[0008] Step 3: constructing a space-time interaction aggregation module, respectively constructing a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model, inputting the global level temporal feature and the local level temporal feature into the time domain multi-head self-attention mechanism model to output a time domain representation, inputting the global level temporal feature and the local level temporal feature into the spatial domain multi-head self-attention mechanism model to output a spatial domain representation, and performing low-rank bilinear pooling on the time domain representation and the spatial domain representation to obtain an aggregated space-time content perception representation;

[0009] Step 4: constructing a space-time correlation learning module, respectively taking a multi-source sensor and a time sequence as a graph node, and using a graph attention network to adaptively capture a space-time correlation relationship, designing a stacked spatial domain graph attention network layer and a time domain graph attention network layer to obtain a correlation perception representation;

[0010] Step 5: constructing a dual attention reinforced contrast reconstruction module, respectively constructing a global level multi-head cross-attention mechanism model and a local level multi-head cross-attention mechanism model to further decode a global level reconstruction sequence and a local level reconstruction sequence, and designing a global-local contrast loss function to minimize the difference between the global level reconstruction sequence and the local level reconstruction sequence to constrain the representation learning;

[0011] Step 6: designing a reconstruction loss function to minimize the reconstruction error of the self-adjusting output of the global level and the local level, training the model, and finally outputting an abnormality detection result of the time series data.

[0012] In a possible implementation, in step 1, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0013] In a possible implementation, in step 3, the time domain multi-head self-attention mechanism model and the spatial domain multi-head self-attention mechanism model are respectively constructed based on the Transformer self-attention model structure.

[0014] In a possible implementation, in step 5, the global level multi-head cross-attention mechanism model and the local level multi-head cross-attention mechanism model are respectively constructed based on the Transformer cross-attention model structure.

[0015] According to another aspect of the embodiments of the present disclosure, an abnormal time series data detection device based on a multi-view space-time interaction attention network is provided, and the device comprises:

[0016] The data preprocessing module is configured to normalize multi-source time series data of the industrial control system and convert the multi-source time series data into time series sliding windows, and divide data of a training set and a test set.

[0017] The multi-view time series feature extraction module is configured to construct a time series global level feature encoder and a time series local level feature encoder, and obtain global level time series features by using a dilated temporal convolution network and obtain local level time series features by using a causal temporal convolution network.

[0018] The space-time interaction aggregation module is configured to construct a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model, respectively, input the global level time series features and the local level time series features into the time domain multi-head self-attention mechanism model to output time domain representation, input the global level time series features and the local level time series features into the space domain multi-head self-attention mechanism model to output space domain representation, and perform low-rank bilinear pooling on the time domain representation and the space domain representation to obtain aggregated space-time content perception representation.

[0019] The space-time correlation learning module is configured to take multi-source sensors and time series as graph nodes, respectively, and adaptively capture space-time correlation relationships by using a graph attention network, and design a stacked space domain graph attention network layer and a time domain graph attention network layer to obtain correlation perception representation.

[0020] The dual attention reinforced contrast reconstruction module is configured to construct a global level multi-head cross-attention mechanism model and a local level multi-head cross-attention mechanism model, respectively, to further decode global level reconstruction sequences and local level reconstruction sequences, and design a global-local contrast loss function to minimize differences between the global level reconstruction sequences and the local level reconstruction sequences to constrain representation learning.

[0021] The reconstruction loss function module is configured to minimize reconstruction errors of two groups of self-adjusted outputs of the global level and the local level, perform model training, and finally output an anomaly detection result of the time series data.

[0022] In a possible implementation, in the data preprocessing module, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0023] In a possible implementation, in the space-time interaction aggregation module, the time domain multi-head self-attention mechanism model and the space domain multi-head self-attention mechanism model are constructed based on a Transformer self-attention model structure.

[0024] In a possible implementation, in the dual attention reinforced contrast reconstruction module, the global level multi-head cross-attention mechanism model and the local level multi-head cross-attention mechanism model are constructed based on a Transformer cross-attention model structure.

[0025] According to another aspect of the embodiments of the present disclosure, an abnormal time series data detection device based on a multi-view spatio-temporal interaction attention network is provided, and the device comprises:

[0026] a processor;

[0027] a memory for storing processor-executable instructions;

[0028] The processor is configured to execute the above method.

[0029] According to another aspect of the embodiments of the present disclosure, a non-volatile computer-readable storage medium having computer program instructions stored thereon is provided, and the computer program instructions are executed by a processor to implement the above method.

[0030] The present disclosure has the beneficial effect that the abnormal time series data detection method based on a multi-view spatio-temporal interaction attention network provided by the present disclosure can fully mine the complex spatio-temporal correlation dependency in the multi-source time series data of the industrial control system, thereby more comprehensively modeling the time series data anomaly detection. Focusing on joint representation learning of multi-view features such as global and local levels of time series data; constructing a multi-head self-attention mechanism in the time domain and the spatial domain to perform spatio-temporal content interaction aggregation to obtain content perception representation, and simultaneously using multiple stacked graph attention network layers to perform spatio-temporal correlation learning to obtain correlation perception representation; finally, in the double attention reinforced comparative reconstruction module, global and local multi-head cross-attention mechanisms are respectively used to further obtain reconstructed time series, thereby effectively realizing multi-source time series data anomaly detection in the industrial control system. By mining the multi-view feature information of the time domain and the spatial domain in the global and the local of the multi-source time series data, the spatio-temporal content interaction and the spatio-temporal correlation dependency of the multivariate time series data are jointly modeled to further improve the time series data anomaly detection performance in the industrial control system. Assist relevant personnel to take corresponding measures to prevent industrial control system accidents. BRIEF DESCRIPTION OF DRAWINGS

[0031] Figure 1 is a flowchart of an abnormal time series data detection method based on a multi-view spatio-temporal interaction attention network according to an embodiment of the present disclosure.

[0032] Figure 2 is a block diagram of an abnormal time series data detection device based on a multi-view spatio-temporal interaction attention network according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0033] The present disclosure will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0034] Unless otherwise defined, technical and scientific terms used in the present disclosure have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure belongs; the terminology used in the present disclosure is for the purpose of describing particular embodiments only and is not intended to be limiting of the present disclosure; the use of the term "including," as well as other forms such as "include," "includes," and "includes," is intended to cover a non-exclusive inclusion such that items listed are included when present and not excluded when not present. It will be obvious to a person skilled in the art that the embodiments described in the present disclosure are merely some of the embodiments of the present disclosure, and not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of the present disclosure.

[0035] Reference to "an embodiment" in this disclosure means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the disclosure. The appearance of the phrase in various places in the specification does not necessarily all refer to the same embodiment, nor does it necessarily exclude other embodiments. It is explicitly and implicitly understood that the embodiments described herein can be combined with other embodiments.

[0036] Figure 1 is a flowchart of an abnormal time series data detection method based on a multi-view spatio-temporal interaction attention network according to an embodiment of the present disclosure. The method can be executed by a terminal device, where the terminal device can be a server, a desktop computer, etc., and the type of the terminal device is not limited by the embodiments of the present disclosure. As shown in Figure 1 the method comprises:

[0037] Step 1: data preprocessing, in order to ensure the robustness of the network model, the multi-source time series data of the industrial control system is normalized, and is converted into a time series sliding window, which is used for data division of the training set and the test set, in addition, in order to simulate the actual running of the industrial control system which is easy to be affected by noise interference, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0038] Step 2: multi-view time series feature extraction, a time series global level feature encoder and a time series local level feature encoder are constructed, a global level time series feature is obtained by using a hollow time convolution network, and a local level time series feature is obtained by using a causal time convolution network.

[0039] Step 3: constructing a spatio-temporal interaction aggregation module, respectively constructing a time domain multi-head self-attention mechanism model and a space domain multi-head self-attention mechanism model based on a Transformer self-attention model structure, inputting the global level time sequence feature and the local level time sequence feature into the time domain multi-head self-attention mechanism model to output a time domain representation; inputting the global level time sequence feature and the local level time sequence feature into the space domain multi-head self-attention mechanism model to output a space domain representation; to realize the fusion of multi-source heterogeneous data, performing low-rank bilinear pooling on the time domain representation and the space domain representation to obtain an aggregated spatio-temporal content perception representation.

[0040] Step 4: constructing a spatio-temporal correlation learning module, respectively taking multi-source sensors and time sequences as graph nodes, and adaptively capturing spatio-temporal correlation relationships by using a graph attention network, designing a stacked space domain graph attention network layer and a time domain graph attention network layer to obtain a correlation perception representation.

[0041] Step 5: constructing a dual attention reinforced contrast reconstruction module, respectively constructing a global level multi-head cross-attention mechanism model and a local level multi-head cross-attention mechanism model based on a Transformer cross-attention model structure, to further decode global level and local level reconstruction sequences, and simultaneously designing a global-local contrast loss function to minimize the difference between the two to constrain the representation learning.

[0042] Step 6: designing a reconstruction loss function to minimize the reconstruction error of the self-adjusting outputs of the global level and the local level, performing model training, and finally outputting an abnormal time sequence data detection result.

[0043] The present disclosure provides an abnormal time sequence data detection method based on a multi-view spatio-temporal interaction attention network, which fully excavates the complex spatio-temporal correlation dependence in multi-source time sequence data of an industrial control system, thereby more comprehensively modeling time sequence data anomaly detection. The framework can efficiently process multi-source time sequence data and has good model robustness and generalization ability.

[0044] The present disclosure focuses on joint representation learning of multi-view features such as global level and local level time sequences, which can effectively utilize the rich multi-view feature information in time sequence data and has stronger feature extraction and representation capabilities.

[0045] The time domain and space domain multi-head self-attention mechanisms are constructed to perform spatio-temporal content interaction aggregation to obtain content perception representation, and multiple stacked graph attention network layers are used for spatio-temporal correlation learning to obtain correlation perception representation, which can fully excavate the complex spatio-temporal dependence correlation in multi-source time sequence data and more accurately capture and model spatio-temporal content and correlation representation.

[0046] A double attention reinforced contrast reconstruction module is designed, which adopts global and local level multi-head cross attention mechanisms to further obtain reconstruction time series, thereby efficiently realizing fusion of multi-source heterogeneous data to ensure accuracy and consistency of time series data.

[0047] In summary, the present disclosure has obvious advantages in feature extraction capability of time series data, spatiotemporal correlation representation learning, and multi-source heterogeneous data fusion. The method not only maintains the stability and robustness of the network model, but also realizes fast reasoning analysis and accurate detection.

[0048] According to another aspect of the embodiments of the present disclosure, an abnormal time series data detection device based on a multi-view spatiotemporal interaction attention network is provided, which comprises:

[0049] A data preprocessing module is configured to normalize multi-source time series data of an industrial control system and convert the data into time series sliding windows for data division of training sets and test sets;

[0050] A multi-view time series feature extraction module is configured to construct a time series global level feature encoder and a time series local level feature encoder, adopt a dilated temporal convolution network to obtain global level time series features, and adopt a causal temporal convolution network to obtain local level time series features;

[0051] A spatiotemporal interaction aggregation module is configured to construct a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model, input the global level time series features and the local level time series features into the time domain multi-head self-attention mechanism model to output time domain representations, input the global level time series features and the local level time series features into the spatial domain multi-head self-attention mechanism model to output spatial domain representations, and perform low-rank bilinear pooling on the time domain representations and the spatial domain representations to obtain aggregated spatiotemporal content perception representations;

[0052] A spatiotemporal correlation learning module is configured to take multi-source sensors and time series as graph nodes, adopt a graph attention network to adaptively capture spatiotemporal correlation, design a stacked spatial domain graph attention network layer and a time domain graph attention network layer, and thereby obtain correlation perception representations;

[0053] A double attention reinforced contrast reconstruction module is configured to construct a global level multi-head cross attention mechanism model and a local level multi-head cross attention mechanism model, thereby further decoding global level reconstruction sequences and local level reconstruction sequences, and designing a global-local contrast loss function to minimize differences between the global level reconstruction sequences and the local level reconstruction sequences to constrain representation learning;

[0054] The reconstruction loss function module is configured to minimize the reconstruction errors of the two sets of self-adjusted outputs at the global level and the local level, and perform model training, and finally output the anomaly detection result of the time series data.

[0055] In a possible implementation, in the data preprocessing module, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

[0056] In a possible implementation, in the spatiotemporal interaction aggregation module, a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model are respectively constructed based on a Transformer self-attention model structure.

[0057] In a possible implementation, in the dual attention reinforced contrast reconstruction module, a global level multi-head cross-attention mechanism model and a local level multi-head cross-attention mechanism model are respectively constructed based on a Transformer cross-attention model structure.

[0058] The description of the above device has been described in detail in the description of the above method, and will not be repeated here.

[0059] Figure 2 is a block diagram of an abnormal time series data detection device based on a multi-view spatiotemporal interaction attention network according to an embodiment of the present disclosure. For example, the device 1900 can be provided as a server. Referring to Figure 2 , the device 1900 includes a processing component 1922, which further includes one or more processors, and a memory resource represented by a memory 1932, for storing instructions executable by the processing component 1922, such as an application program. The application program stored in the memory 1932 can include one or more than one module each corresponding to a set of instructions. In addition, the processing component 1922 is configured to execute the instructions to perform the above method.

[0060] The device 1900 can also include a power supply component 1926 configured to perform power management of the device 1900, a wired or wireless network interface 1950 configured to connect the device 1900 to a network, and an input / output (I / O) interface 1958. The device 1900 can operate based on an operating system stored in the memory 1932, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM or the like.

[0061] In an exemplary embodiment, a non-volatile computer readable storage medium, such as a memory 1932 including computer program instructions executable by the processing component 1922 of the device 1900 to perform the above method, is also provided.

[0062] The present disclosure can be a system, a method, and / or a computer program product. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present disclosure.

[0063] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or punched tape, a

[0064] The computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium within the respective computing / processing device.

[0065] Computer readable program instructions for carrying out operations of the present disclosure can be assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine dependent instructions, microcode, firmware instructions, state-setting data, or either source code or object code written in any combination of one or more programming languages, including an object oriented programming language such as Smalltalk, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate array (FPGA), or programmable logic array (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present disclosure.

[0066] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0067] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can include random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other data storage device. When the computer readable program instructions are loaded into the computer and other programmable data processing apparatus, a series of operational steps are implemented that provide processes such that the computer or other programmable apparatus provide processes for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0068] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable data processing apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0069] The flow diagrams and the block diagrams in the drawings are presented to illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow diagrams and the block diagrams can represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logic functions. In some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks can sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flow diagrams, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and

[0070] Embodiments of the present disclosure have been described above, and the description is intended to be illustrative of the embodiments and not restrictive. Many modifications and variations of the described embodiments are possible and are within the scope of the disclosure. The selection of the terms to be used in the description is not intended to limit the scope of the embodiments described herein, but rather to best describe the principles of the embodiments in the context of the specific applications of the technology.

Claims

1. A method for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network, characterized in that: The method comprises: Step 1: Data preprocessing: normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data partitioning into training and test sets; Step 2: Extract multi-view temporal features, construct a temporal global-level feature encoder and a temporal local-level feature encoder, use a dilated temporal convolutional network to obtain global-level temporal features, and use a causal temporal convolutional network to obtain local-level temporal features; Step 3: Construct a spatiotemporal interaction aggregation module, respectively construct a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output the time domain representation; input the global-level temporal features and the local-level temporal features into the spatial domain multi-head self-attention mechanism model, and output the spatial domain representation; perform low-rank bilinear pooling on the time domain representation and the spatial domain representation to obtain the content-aware representation of the aggregated spatiotemporal space; Step 4: Construct a spatiotemporal correlation learning module. Use multi-source sensors and time series as graph nodes, respectively. Adopt a graph attention network to adaptively capture spatiotemporal correlations. Design stacked spatial and temporal graph attention network layers to obtain correlation perception representations. Step 5: Construct a dual-attention-enhanced contrast reconstruction module, constructing a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model respectively, so as to further decode the global-level reconstruction sequence and the local-level reconstruction sequence. At the same time, a global-local contrast loss function is designed to minimize the difference between the global-level reconstruction sequence and the local-level reconstruction sequence to constrain representation learning; Step 6: Design a reconstruction loss function to minimize the reconstruction error of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of the time series data.

2. The method according to claim 1, characterized in that In step 1, white noise with a signal-to-noise ratio of 50d is added as basic data augmentation.

3. The method according to claim 1, characterized in that In step 3, based on the Transformer self-attention model structure, a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model are constructed respectively.

4. The method according to claim 1, wherein In step 5, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are constructed based on the Transformer cross-attention model structure.

5. A device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network, characterized in that: The device comprises: The data preprocessing module is used to normalize the multi-source time series data of the industrial control system and convert it into a time series sliding window for data division into training and test sets; Multi-view temporal feature extraction module, used to construct temporal global-level feature encoder and temporal local-level feature encoder, using a dilated temporal convolutional network to obtain global-level temporal features and a causal temporal convolutional network to obtain local-level temporal features; The spatiotemporal interaction aggregation module is used to construct a time domain multi-head self-attention mechanism model and a spatial domain multi-head self-attention mechanism model respectively, input the global-level temporal features and the local-level temporal features into the time domain multi-head self-attention mechanism model, and output a time domain representation; input the global-level temporal features and the local-level temporal features into the spatial domain multi-head self-attention mechanism model, and output a spatial domain representation; perform low-rank bilinear pooling on the time domain representation and the spatial domain representation to obtain a content-aware representation of the aggregated spatiotemporal content; The spatiotemporal association learning module uses multi-source sensors and time series as graph nodes, adopts a graph attention network to adaptively capture spatiotemporal associations, and designs stacked spatial and temporal graph attention network layers to obtain association perception representations. The dual-attention-enhanced contrastive reconstruction module is used to construct global-level multi-head cross-attention mechanism models and local-level multi-head cross-attention mechanism models, respectively, to further decode the global-level reconstruction sequence and the local-level reconstruction sequence. At the same time, a global-local contrastive loss function is designed to minimize the difference between the global-level reconstruction sequence and the local-level reconstruction sequence to constrain representation learning; The reconstruction loss function module is used to minimize the reconstruction error of the two sets of self-adjusting outputs at the global level and the local level, perform model training, and finally output the anomaly detection results of time series data.

6. The device according to claim 5, characterized in that In the data preprocessing module, white noise with a signal-to-noise ratio of 50d is added as basic data enhancement.

7. The device according to claim 5, characterized in that In the spatiotemporal interaction aggregation module, the temporal domain multi-head self-attention mechanism model and the spatial domain multi-head self-attention mechanism model are constructed based on the Transformer self-attention model structure.

8. The device according to claim 5, characterized in that In the contrast reconstruction module of dual attention enhancement, a global-level multi-head cross-attention mechanism model and a local-level multi-head cross-attention mechanism model are constructed based on the Transformer cross-attention model structure.

9. A device for detecting abnormal time series data based on a multi-view spatiotemporal interactive attention network, characterized in that: The device comprises: processor; a memory for storing processor-executable instructions; The processor is configured to execute the method according to any one of claims 1 to 4.

10. A non-volatile computer-readable storage medium having computer program instructions stored thereon, characterized in that: When the computer program instructions are executed by a processor, the method according to any one of claims 1 to 4 is implemented.

Images