Multivariable time series data anomaly detection method under graph structure learning

Abstract

The invention discloses a multivariable time series data anomaly detection method under graph structure learning, and relates to the technical field of multivariable time series data anomaly detection. Comprising the following steps: constructing a multivariable time series data sample data set; preprocessing the constructed data set to obtain a processed multivariable time series data sample data set; dividing the processed sample data set into a training set and a test set according to a preset proportion; constructing a multivariable time series data anomaly detection model GSL-AD under graph structure learning; training the GSL-AD model by using the training set data to obtain a trained GSL-AD model; on the basis of the trained GSL-AD model, multivariable time series data anomaly detection under graph structure learning is carried out according to test set data; and the multivariable anomaly detection result is visualized. According to the method, the representation capability of the space structure of the multivariable time series data can be improved, the abnormality caused by time series dependence dislocation of the multivariable time series data is effectively overcome, and the robustness and adaptability of a multivariable time series data abnormality detection model are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of multivariate time series data anomaly detection for industrial information systems, and in particular to a multivariate time series data anomaly detection method under graph structure learning. Background Art

[0002] Information systems usually use physical or virtual devices (e.g., temperature sensors, barcodes, embedded points, etc.) to collect data from different components or functional modules of the information system, usually presented in multidimensional data (or multivariate data, multivariate data) to reflect the operating status of the information system. Efficient multivariate data anomaly detection is of great significance for early warning of anomalies in information systems and ensuring stable operation.

[0003] In recent years, multivariate time series data anomaly detection has been widely used in industrial manufacturing, financial transactions, network security and other fields. By identifying and marking abnormal information in various application scenarios, it plays an important role in promoting the development of intelligent operation and maintenance in various fields. However, with the continuous improvement of Internet hardware facilities and the deepening of system applications, the scale of multivariate time series data continues to expand, making multivariate time series data anomaly detection increasingly challenging.

[0004] The operation monitoring data of industrial information systems is affected by the deployment environment, hardware performance, and network stability, which leads to confusion in the time series correlation of the collected data. When processing multivariate time series data, it is difficult to effectively capture the nonlinear relationship between multiple variables due to the complex and diverse relationships between multiple variables. For multivariate time series data anomaly detection, more complex methods are needed to more accurately identify and explain anomalies.

[0005] Therefore, it is an urgent problem for those skilled in the art to propose a multivariate time series data anomaly detection method based on graph structure learning to solve the difficulties existing in the prior art. Summary of the invention

[0006] In view of this, the present invention provides a multivariate time series data anomaly detection method under graph structure learning, which effectively integrates the multivariate coupling network structure and the characterization features, can effectively overcome the anomalies caused by the misalignment of the time dependency of the multivariate time series data, and improve the robustness and adaptability of the multivariate time series data anomaly detection model.

[0007] In order to achieve the above object, the present invention adopts the following technical solution:

[0008] A multivariate time series data anomaly detection method based on graph structure learning, comprising:

[0009] S1. Construct a sample dataset of multivariate time series data;

[0010] S2, preprocessing the constructed multivariate time series data sample data set to obtain a processed multivariate time series data sample data set;

[0011] S3, dividing the processed multivariate time series data sample data set into a training set and a test set according to a preset ratio;

[0012] S4. Construct a multivariate time series data anomaly detection model GSL-AD based on graph structure learning;

[0013] S5. Use the training set data to train the GSL-AD model to obtain a trained GSL-AD model;

[0014] S6. Based on the trained GSL-AD model, perform multivariate time series data anomaly detection under graph structure learning according to the test set data;

[0015] S7. Visualization of multivariate anomaly detection results.

[0016] In the above method, optionally, in S1, data samples of normal and abnormal system operation states are labeled and mixed according to a preset ratio, and data samples of unknown system operation states are combined according to specific rules to construct a multivariate time series data sample data set.

[0017] In the above method, optionally, in S2, data preprocessing includes: data standardization and data dimensionality reduction;

[0018] Data specification adopts three methods: data standardization, data normalization and data regularization:

[0019] Data standardization scales the values ​​of a column of numerical features in a data set to a state with a mean of 0 and a standard deviation of 1;

[0020] Data normalization scales the value of a column of numerical features in a data set to the range of 0 to 1;

[0021] Data regularization scales a sample in the data set to the unit standard;

[0022] Data dimensionality reduction PCA, t-SNE, and UMAP are used to reduce the data dimension to 1 to 3 dimensions:

[0023] PCA finds the direction with the largest variance in the data and projects the data onto this direction to achieve dimensionality reduction;

[0024] t-SNE maps high-dimensional data into a low-dimensional space by optimizing the loss function while preserving the local relationship between samples;

[0025] UMAP minimizes the similarity loss between high-dimensional space and low-dimensional space through cross-entropy loss.

[0026] In the above method, optionally, in S4, the GSL-AD model specifically includes:

[0027] S401. Multivariate time series data feature embedding: For input data X∈R M×N , the sampled data S with a sliding window length of W before time i i =[x i-W+1 ,…,x i ] is used as the initial graph construction data, considering the time series dependence dislocation effect of multivariate time series data, and taking W = 1;

[0028] S402, initial graph construction: based on S i Construct the initial graph at different times i;

[0029] Initial graph G = (V, E, X), where V is a set of nodes, V = {v1, v2, ..., v i},i∈R M , M is the number of multivariate; E is the edge set, E={e 11 ,e 12 ,...,e ij},i∈R M ,j∈R M ;e qr =(v q ,v r ) indicates that at node v q and v r There is a coupling relationship between them; X is the embedded feature of the node; the adjacency matrix A∈R of the graph M×N Represents the topological structure of the multivariable coupled network, node v q and v r If there is an edge between them, then the element A in A qr =1, if node v q and v r There is no edge between them, then A qr =0;

[0030] S403, graph structure optimization: based on the multi-channel graph attention layer, the weights of the multi-variable coupling relationship of the initial graph are optimized, and the topological structure features of the multi-variable coupling network are compressed using a multi-channel compressor;

[0031] S404, Single Channel Attention Mechanism: Based on S i Implement a single-channel self-attention mechanism to improve the expression of important variable features;

[0032] S405: Based on the prediction and the anomaly score, determine the abnormal data point according to the anomaly score.

[0033] In the above method, optionally, in S402, based on the sampled data Si , construct the initial graph G i and node embedding feature X i =s i , Embedding features for the initial graph nodes, nodes Embedding features For S i Elements:

[0034]

[0035] pass Construct prior information with other variables as Candidate relationship

[0036]

[0037] node The dependencies with other nodes are:

[0038]

[0039] Among them, ||.||2 represents the 2-norm representation of the Minkowski distance, Represents the node in the i-th sliding window and The correlation degree value of

[0040] Normalization of:

[0041] σ(x)=(1+e -x ) -1 ;

[0042] Based on the recommendation rules Top-K screening and Connect the nodes:

[0043] Compute Node and Candidate edge weights between

[0044] According to the formula:

[0045]

[0046] Select the top K node indexes in descending order, if The first K candidate edges include Then A cj =1, otherwise A cj =0, the desired sparsity level is screened by different K values, and the initial graph of the multivariate time series data at time i is constructed.

[0047] In the above method, optionally, in S403, the weight optimization of the multivariable coupling relationship of the initial graph is specifically as follows:

[0048] At each node, the multi-channel graph attention layer extracts the structural features between multiple variables from the initial graph, aggregates the correlation features between multiple variables, introduces the single-channel attention mechanism, and embeds it into the graph attention layer to form a multi-channel graph attention layer, which fuses the output results of different channels through splicing operations;

[0049] The topological structure characteristics of the multivariable coupled network are compressed, specifically:

[0050] The multi-channel compressor is responsible for compressing different channel characteristics, and the linear channelizer is responsible for compressing single channel characteristics.

[0051] In the above method, optionally, in S404, the single-channel self-attention mechanism is used for the input variable S i Query vector weights W respectively Q , the key vector W K and the value vector W V Linear transformation,

[0052] The self-attention output is:

[0053]

[0054] In the formula, represents the scaling factor of the weight vector, d=M;

[0055] The fusion process of the multi-channel graph attention layer and the single-channel attention mechanism is:

[0056]

[0057] Where W F is the weight matrix, B F is the error matrix.

[0058] In the above method, optionally, in S405, the output of S403 is compared with S i Based on the prediction loss measurement, the prediction error Loss between the input data and the predicted data is obtained for :

[0059]

[0060] Connect the output of S404 to S i Perform reconstruction loss measurement and get loss Loss rec :

[0061]

[0062] Lossfor With Loss rec Combined as the model optimization function, the loss function of the GSL-AD model is calculated as:

[0063] Loss = αLoss rec +(1-α)Loss for ;

[0064] Based on the predicted value v for Based on the reconstruction value P rec Take the weighted average as the anomaly score socre:

[0065] P rec =σ(Loss rec )

[0066] v for =σ(Loss for )

[0067] socre=(v for +γP rec ) / (1+γ)

[0068] Where: σ(.) is the Sigmoid function, and γ is the hyperparameter that combines the prediction error and the reconstruction error.

[0069] In the above method, optionally, in S7, the multivariate anomaly detection result is visualized to provide clear anomaly occurrence time and fault location information.

[0070] It can be seen from the above technical solutions that, compared with the prior art, the present invention provides a method for detecting anomalies in multivariate time series data under graph structure learning, which has the following beneficial effects: the present invention reduces the dependence on historical prior information by improving the spatial structure representation capability of multivariate time series data of industrial information systems; the multi-channel graph coding layer and the multi-stage channel compressor realize the efficient extraction, optimization and reconstruction of the coupled network topological structure features of multivariate time series data; by introducing a single-channel attention mechanism, the data feature expression of multivariate time series is enriched, and the structural information is effectively integrated to improve the model representation capability; the structural reconstruction loss of multivariate time series data and the prediction loss of the representation features are comprehensively considered, and a weighted calculation is performed as an anomaly score, which is used as the input of the unsupervised anomaly detection POT, and a threshold is dynamically selected to enhance the model stability; the multivariate coupled network structure is effectively integrated with the representation features, which can effectively improve the robustness and adaptability of the multivariate time series data anomaly detection model of the industrial information system. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0072] Figure 1 A flowchart of a multivariate time series data anomaly detection method under graph structure learning provided by the present invention;

[0073] Figure 2 The overall framework diagram of the GSL-AD model of a multivariate time series data anomaly detection method under graph structure learning provided by the present invention;

[0074] Figure 3 A schematic diagram of constructing the initial graph in the GSL-AD model provided by the present invention;

[0075] Figure 4 A schematic diagram of graph structure learning optimization in the GSL-AD model provided by the present invention;

[0076] Figure 5 Schematic diagram of a multi-channel compressor and a linear compressor in graph structure learning optimization provided by the present invention;

[0077] Figure 6 Schematic diagram of the single-channel attention mechanism in the GSL-AD model provided by the present invention. DETAILED DESCRIPTION

[0078] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0079] In this application, relational terms such as first and second, etc. are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. The terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of more restrictions, the elements defined by the sentence "comprise one..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0080] Reference Figure 1 As shown, the present invention discloses a multivariate time series data anomaly detection method under graph structure learning, comprising:

[0081] S1. Construct a sample dataset of multivariate time series data;

[0082] S2, preprocessing the constructed multivariate time series data sample data set to obtain a processed multivariate time series data sample data set;

[0083] S3, dividing the processed multivariate time series data sample data set into a training set and a test set according to a preset ratio;

[0084] S4. Construct a multivariate time series data anomaly detection model GSL-AD based on graph structure learning;

[0085] S5. Use the training set data to train the GSL-AD model to obtain a trained GSL-AD model;

[0086] S6. Based on the trained GSL-AD model, perform multivariate time series data anomaly detection under graph structure learning according to the test set data;

[0087] S7. Visualization of multivariate anomaly detection results.

[0088] Furthermore, in the process of multivariate time series data anomaly detection, reasonable data sample construction helps the detection rules to quickly learn abnormal features. In S1, in the process of multivariate time series data anomaly detection, data samples of normal and abnormal system operation states are labeled and mixed according to a preset ratio, and data samples of unknown system operation states are combined according to specific rules to construct a multivariate time series data sample data set to improve the robustness of the multivariate time series data anomaly detection model;

[0089] Specifically, the data sample construction method includes:

[0090] Full batch build: data is split according to the proportion;

[0091] Batch construction: The data is initially divided into training set and test set according to the ratio, and then the divided data set is divided again according to the batch size S;

[0092] Bag-type construction: The data is divided according to the proportion, and the divided data set is divided again according to the batch size S, and the predictability of the data set is analyzed. If the predictability of the data set does not meet the predictability threshold, it is re-extracted from the data set and recombined into a data set of length S. Repeat this process several times until the length of the predictable data set meets the requirements;

[0093] Scenario construction: Select a fixed number of categories in the test samples, and select k+l samples from each class again, where k samples are used as support data sets and l samples are used as query data sets. The whole process is meta-training and meta-testing.

[0094] Graph structure construction: The entire data set is abstracted into a graph, where a node represents a data sample and an edge represents whether the data samples are similar or different, thus generating an edge relationship;

[0095] Sliding window construction: Use a specified sliding window length for multivariate time series data to divide the sequence data into independent yet interrelated data blocks.

[0096] Furthermore, in S2, data preprocessing includes: data normalization and data dimension reduction;

[0097] Data specification adopts three methods: data standardization, data normalization and data regularization:

[0098] Data standardization scales the values ​​of a column of numerical features in a data set to a state with a mean of 0 and a standard deviation of 1. Deviation standardization and Z-score standardization are usually used.

[0099] Data normalization scales the value of a column of numerical features in a data set to the range of 0 to 1, usually using robust normalization and maximum absolute value normalization;

[0100] Data regularization scales a sample in the data set to the unit standard;

[0101] Data dimensionality reduction: The number of data samples is much smaller than the feature dimension of the data, and high-dimensional feature samples carry a lot of noise. Direct model training has low accuracy and poor reliability. PCA, t-SNE, and UMAP are used to reduce the data dimension to 1 to 3 dimensions for easy visualization, and the feature distribution of data samples is analyzed to select a suitable anomaly detection model:

[0102] PCA finds the direction with the largest variance in the data and projects the data onto this direction to achieve dimensionality reduction;

[0103] t-SNE maps high-dimensional data into a low-dimensional space by optimizing the loss function while preserving the local relationship between samples;

[0104] UMAP minimizes the similarity loss between high-dimensional space and low-dimensional space through cross-entropy loss.

[0105] Further, see Figure 2 As shown in S4, the GSL-AD model specifically includes:

[0106] S401. Multivariate time series data feature embedding: For input data X∈R M×N , the sampled data S with a sliding window length of W before time i i =[x i-W+1 ,…,x i ] is used as the initial graph construction data, considering the time series dependence dislocation effect of multivariate time series data, and taking W = 1;

[0107] S402, initial graph construction: based on S i Construct the initial graph at different times i;

[0108] Initial graph G = (V, E, X), where V is a set of nodes, V = {v1, v2, ..., v i},i∈R M , M is the number of multivariate; E is the edge set, E={e 11 ,e 12 ,...,e ij},i∈R M ,j∈R M ;e qr =(v q ,v r ) indicates that at node v q and v r There is a coupling relationship between them; X is the embedded feature of the node; the adjacency matrix A∈R of the graph M×N Represents the topological structure of the multivariable coupled network, node v q and v r If there is an edge between them, then the element A in A qr =1, if node v q and v r There is no edge between them, then A qr =0;

[0109] S403, graph structure optimization: based on the multi-channel graph attention layer, the weights of the multi-variable coupling relationship of the initial graph are optimized, and the topological structure features of the multi-variable coupling network are compressed using a multi-channel compressor;

[0110] S404, Single Channel Attention Mechanism: Based on S i Implement a single-channel self-attention mechanism to improve the expression of important variable features;

[0111] S405: Based on the prediction and the anomaly score, determine the abnormal data point according to the anomaly score.

[0112] Further, see Figure 3 As shown, in S402, based on the sampling data S i , construct the initial graph G i and node embedding feature X i =s i , Embedding features for the initial graph nodes, nodes Embedding features For S i Elements:

[0113]

[0114] pass Construct prior information with other variables as Candidate relationship

[0115]

[0116] node The dependencies with other nodes are:

[0117]

[0118] Among them, ‖.‖2 represents the 2-norm representation of the Minkowski distance, Represents the node in the i-th sliding window and The correlation degree value of

[0119] Normalization of:

[0120] σ(x)=(1+e -x ) -1 ;

[0121] Based on the recommendation rules Top-K screening and Connect the nodes:

[0122] Compute Node and Candidate edge weights between

[0123] According to the formula:

[0124]

[0125] Select the top K node indexes in descending order, if The first K candidate edges include Then A cj =1, otherwise A cj =0, the desired sparsity level is screened by different K values, and the initial graph of the multivariate time series data at time i is constructed.

[0126] Further, see Figure 4 As shown, in S403, the weight optimization of the multivariable coupling relationship of the initial graph is specifically as follows:

[0127] At each node, the multi-channel graph attention layer extracts the structural features between multiple variables from the initial graph, aggregates the correlation features between multiple variables, introduces the single-channel attention mechanism, and embeds it into the graph attention layer to form a multi-channel graph attention layer, which fuses the output results of different channels through splicing operations;

[0128] Reference Figure 5 As shown in the figure, the topological structure characteristics of the multivariable coupling network are compressed, specifically:

[0129] The multi-channel compressor is responsible for compressing different channel characteristics, and the linear channelizer is responsible for compressing single channel characteristics.

[0130] Further, see Figure 6 As shown in S404, the use of the single-channel attention mechanism enables GSL-AD to focus on variables with important influences. The single-channel self-attention mechanism has an important effect on the input variable S i Query vector weights W respectively Q , the key vector W K and the value vector W V Linear transformation,

[0131] The single-channel attention output is:

[0132]

[0133] In the formula, represents the scaling factor of the weight vector, d=M;

[0134] The fusion process of the multi-channel graph attention layer and the single-channel attention mechanism is:

[0135]

[0136] Where W F is the weight matrix, B F is the error matrix.

[0137] Furthermore, in S405, the multi-channel graph encoding layer and the single-channel self-attention mechanism are combined to extract multivariate time series data features and multivariate graph structure features for fusion, thereby improving the anomaly detection rate and anomaly interpretability;

[0138] Connect the output of S403 to S i Based on the prediction loss measurement, the prediction error Loss between the input data and the predicted data is obtained for :

[0139]

[0140] Connect the output of S404 to S i Perform reconstruction loss measurement and get loss Loss rec :

[0141]

[0142] Loss for With Loss rec Merge as a model optimization function to improve the anomaly detection performance by taking into account both reconstruction error and prediction error. The loss function of the GSL-AD model is calculated as:

[0143] Loss = αLoss rec +(1-α)Loss for ;

[0144] Based on the predicted value v for Based on the reconstruction value P rec Take the weighted average as the anomaly score socre:

[0145] P rec =σ(Loss rec )

[0146] v for =σ(Loss for )

[0147] score=(v for +γP rec ) / (1+γ)

[0148] Where: σ(.) is the Sigmoid function, γ is the hyperparameter that combines the prediction error and the reconstruction error. By introducing the hyperparameter γ, the advantages of the reconstruction error value and the prediction error value are balanced, thereby improving the overall multivariate time series data anomaly detection performance.

[0149] Furthermore, in S7, the multivariate anomaly detection results are visualized to provide clear information on the anomaly occurrence time and fault location.

[0150] In a specific embodiment, the adopted data sets are shown in Table 1, including server monitoring data sets SMD and ASD, SMAP and MSL of the Mars exploration mission, and monitoring data SWaT and ADI of the water treatment plant;

[0151] Table 1 Dataset overview

[0152] Dataset Training set Test Set Feature Dimension Abnormality rate (%) SMD 708405 708420 38 4.16 ASD 102331 51840 19 4.61 SMAP 135183 427617 25 13.13 MSL 58317 73729 55 10.72 SWaT 496800 449919 51 11.98 ADI 1048571 172801 123 5.99

[0153] In order to verify the performance of GSL-AD in the task of anomaly detection of multivariate time series data, comparative experiments, ablation experiments, convergence stability analysis, hyperparameter experiments, and anomaly cause visualization experiments were conducted. At the same time, the time series of each data was processed in a disordered order to address the anomaly problem caused by the misalignment of time series dependencies.

[0154] Select the following comparison models for comparative experiments:

[0155] (1) Based on subsequence matching: MERLIN is an anomaly detection method based on subsequence matching, which detects anomalies by comparing the subsequence similarity between new data points and training data;

[0156] (2) Based on graph neural network model: GDN uses graph neural network to detect anomalies by comparing the differences between graph structures to identify anomalies. GAE uses graph attention mechanism to learn graph representation model, which can be used for anomaly detection tasks.

[0157] (3) Reconstruction model based on encoding-decoding: USAD is an unsupervised anomaly detection method that detects anomalies by reconstructing data. OmniAnomaly is an anomaly detection method that combines autoencoders and graph neural networks to process multivariate time series data. DAGMM is a method that combines Gaussian mixture models and deep learning to detect anomalies by learning the potential representation of data.

[0158] (4) Based on time series prediction models: MAD-GAN is a method that uses GAN for multivariate anomaly detection, LSTM-NDT is a model that uses long short-term memory networks for time series analysis for anomaly detection, and CAE_M is a model that combines convolutional autoencoders and memory mechanisms to learn the complex structure of multivariate time series data and detect anomalies;

[0159] Evaluation index selection:

[0160] Precision (Pre) refers to the ratio of the positive examples correctly predicted by the model to the total number of positive examples, which reflects the accuracy of the anomaly detection model for the existing prediction results.

[0161] Recall (Rec), the ratio of the positive examples correctly predicted by the model to the actual positive examples, reflects the accuracy of the anomaly detection model in predicting true anomalies;

[0162] F1 (FScore, FScore), since Pre and Rec are negatively correlated, FScore is the harmonic mean of the two. In the anomaly detection task, it is expected that Pre and Rec are equally important, that is, F1;

[0163] AUC (Area Under the ROC Curve) is the area under the ROC curve. The higher the AUC value, the better the performance of the anomaly detection model.

[0164] Through comparative experiments, it is concluded that both OmniAnomaly and MAD-GAN have better AUC performance on the SMD dataset, but worse performance on the SMAP dataset, indicating that the anomaly detection strategy based on time series reconstruction lacks in capturing low-dimensional feature relationships. The model of the present invention overcomes the constraints of multivariate dimensions on anomaly detection performance by explicitly modeling multivariate relationships through a multivariate coupling network. It has better AUC and F1 performance on the SMD and SMAP datasets, and has stronger generalization performance, indicating that the fusion graph structure features are relatively effective in improving anomaly detection performance.

[0165] OmniAnomaly and LSTM-NDT both performed well in AUC and F1 on the MSL dataset, indicating that time series features have a greater impact on datasets with strong time series dependencies. GDN performed well in F1 on the ASD dataset, further verifying the effectiveness of graph structure learning for anomaly detection. At the same time, CAE_M performed well in AUC, indicating that convolution can reduce the causal relationship of time series anomalies and effectively overcome anomalies caused by time-lag causal effects. The model of the present invention has the best performance in F1 and AUC on the ASD dataset by fusing multi-level multi-channel features and multi-variable structural features.

[0166] The Pre performance of GDN on the high-dimensional WADI dataset is poor, indicating that GDN is insufficient in embedding graph structure features of high-dimensional features. The model of the present invention performs better in ACU and F1 on the SWaT and WADI datasets based on graph structure learning, indicating that the graph structure learning strategy plays an important role in improving the anomaly detection performance;

[0167] The average AUC, Rec, Pre and F1 comprehensive performances of the model of the present invention are all the best, indicating that through the effective fusion of the complex coupling characteristics between multiple variables and the multivariate coupling network topology structure under graph structure learning, it is possible to effectively reduce the missed detection caused by time series dependency misalignment and improve the robustness and adaptability of the multivariate time series data anomaly detection model.

[0168] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can refer to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system or system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can refer to the partial description of the method embodiment. The system and system embodiments described above are merely schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without creative work.

[0169] The above description of the disclosed embodiments enables one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A multivariate time series data anomaly detection method based on graph structure learning, characterized in that: include: S1. Obtain multivariate time series data collected by sensors in the industrial information system and construct a multivariate time series data sample dataset; S2, preprocessing the constructed multivariate time series data sample data set to obtain a processed multivariate time series data sample data set; S3, dividing the processed multivariate time series data sample data set into a training set and a test set according to a preset ratio; S4. Construct a multivariate time series data anomaly detection model GSL-AD based on graph structure learning; S5. Use the training set data to train the GSL-AD model to obtain a trained GSL-AD model; S6. Based on the trained GSL-AD model, perform multivariate time series data anomaly detection under graph structure learning according to the test set data; S7. Visualization of multivariate anomaly detection results.

2. According to the method for detecting anomalies of multivariate time series data under graph structure learning according to claim 1, it is characterized in that: In S1, data samples of normal and abnormal system operation states are labeled and mixed according to a preset ratio, and data samples of unknown system operation states are combined according to specific rules to construct a multivariate time series data sample dataset.

3. According to the method for detecting anomalies of multivariate time series data under graph structure learning according to claim 1, it is characterized in that: In S2, data preprocessing includes: data normalization and data dimension reduction; Data specification adopts three methods: data standardization, data normalization and data regularization: Data standardization scales the values ​​of a column of numerical features in a data set to a state with a mean of 0 and a standard deviation of 1; Data normalization scales the value of a column of numerical features in a data set to the range of 0 to 1; Data regularization scales a sample in the data set to the unit standard; Data dimensionality reduction PCA, t-SNE, and UMAP are used to reduce the data dimension to 1 to 3 dimensions: PCA finds the direction with the largest variance in the data and projects the data onto this direction to achieve dimensionality reduction; t-SNE maps high-dimensional data into a low-dimensional space by optimizing the loss function while preserving the local relationship between samples; UMAP minimizes the similarity loss between high-dimensional space and low-dimensional space through cross-entropy loss.

4. According to the method for detecting anomalies of multivariate time series data under graph structure learning according to claim 1, it is characterized in that: In S4, the GSL-AD model specifically includes: S401. Multivariate time series data feature embedding: For input data X∈R M×N , the sampled data S with a sliding window length of W before time i i =[x i-W+1 ,…,x i ] is used as the initial graph construction data, considering the time series dependence dislocation effect of multivariate time series data, and taking W = 1; S402, initial graph construction: based on S i Construct the initial graph at different times i; Initial graph G = (V, E, X), where V is a set of nodes, V = {v1, v2, ..., v i },i∈R M , M is the number of multivariate; E is the edge set, E={e 11 ,e 12 ,...,e ij },i∈R M ,j∈R M ;e qr =(v q ,v r ) indicates that at node v q and v r There is a coupling relationship between them; X is the embedded feature of the node; the adjacency matrix A∈R of the graph M×N Represents the topological structure of the multivariable coupled network, node v q and v r If there is an edge between them, then the element A in A qr =1, if node v q and v r There is no edge between them, then A qr =0; S403, graph structure optimization: based on the multi-channel graph attention layer, the weights of the multi-variable coupling relationship of the initial graph are optimized, and the topological structure features of the multi-variable coupling network are compressed using a multi-channel compressor; S404, Single Channel Attention Mechanism: Based on S i Implement a single-channel self-attention mechanism to improve the expression of important variable features; S405: Based on the prediction and the anomaly score, determine the abnormal data point according to the anomaly score.

5. According to the method for detecting anomalies of multivariate time series data under graph structure learning according to claim 4, it is characterized in that: In S402, based on the sampled data S i , construct the initial graph G i and node embedding feature X i =s i , Embedding features for the initial graph nodes, nodes Embedding features For S i Elements: pass Construct prior information with other variables as Candidate relationship node The dependencies with other nodes are: Among them, ||.||2 represents the 2-norm representation of the Minkowski distance, Represents the node in the i-th sliding window and The correlation degree value of Normalization of: σ(x)=(1+e -x ) -1 ; Based on the recommendation rules Top-K screening and Connect the nodes: Compute Node and Candidate edge weights between According to the formula: Select the top K node indexes in descending order, if The first K candidate edges include Then A cj =1, otherwise A cj =0, the desired sparsity level is screened by different K values, and the initial graph of the multivariate time series data at time i is constructed.

6. The method for detecting anomalies in multivariate time series data under graph structure learning according to claim 4, characterized in that: In S403, the weights of the multivariable coupling relationship of the initial graph are optimized, specifically: At each node, the multi-channel graph attention layer extracts the structural features between multiple variables from the initial graph, aggregates the correlation features between multiple variables, introduces the single-channel attention mechanism, and embeds it into the graph attention layer to form a multi-channel graph attention layer, which fuses the output results of different channels through splicing operations; The topological structure characteristics of the multivariable coupled network are compressed, specifically: The multi-channel compressor is responsible for compressing different channel characteristics, and the linear channelizer is responsible for compressing single channel characteristics.

7. The method for detecting anomalies in multivariate time series data under graph structure learning according to claim 4, characterized in that: In S404, the single-channel self-attention mechanism is used for the input variable S i Query vector weights W respectively Q , the key vector W K and the value vector W V Linear transformation, The self-attention output is: In the formula, represents the scaling factor of the weight vector, d=M; The fusion process of the multi-channel graph attention layer and the single-channel attention mechanism is: Where W F is the weight matrix, B F is the error matrix.

8. The method for detecting anomalies in multivariate time series data under graph structure learning according to claim 4, characterized in that: In S405, the output of S403 is combined with S i Based on the prediction loss measurement, the prediction error Loss between the input data and the predicted data is obtained for : Connect the output of S404 to S i Perform reconstruction loss measurement and get loss Loss rec : Loss for With Loss rec Combined as the model optimization function, the loss function of the GSL-AD model is calculated as: Loss=αLoss rec +(1-α)Loss for ; Based on the predicted value v for Based on the reconstruction value P rec Take the weighted average as the anomaly score socre: P rec =σ(Loss rec ) v for =σ(Loss for ) socre=(v for +γP rec ) / (1+c) Where: σ(.) is the Sigmoid function, and γ is the hyperparameter that combines the prediction error and the reconstruction error.

9. The method for detecting anomalies in multivariate time series data under graph structure learning according to claim 1, characterized in that: In S7, the multivariate anomaly detection results are visualized, providing clear information on the anomaly occurrence time and fault location.

Images