Communication device anomaly detection method based on channel attention and frequency domain analysis

Abstract

This invention proposes an anomaly detection method for communication devices based on channel attention and frequency domain analysis. This anomaly detection method is implemented based on a reconstruction model. First, the detection data generated by the network communication device is preprocessed to generate a time-series data dataset. During the model training phase, the time-series data is used to reconstruct the model and capture the features and distribution of normal data. During the anomaly detection phase, the data to be detected is reconstructed, and the reconstructed data is compared with the input data. Based on the reconstruction error, the time points where anomalies exist in the data to be detected are found. This invention does not rely on the statistical properties of the data or make assumptions about the latent models in the time-series data. Instead, it uses a reconstruction anomaly detection method to map the time-series data into a high-dimensional feature map, models the nonlinear relationships between scattered data points in the time-series data in a deep neural network, and reconstructs the data based on the high-dimensional features, capturing the complex characteristics of the time-series data such as long-term dependence, periodic changes, and multi-dimensional correlations.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence time series anomaly detection and analysis, and is particularly applicable to anomaly detection methods for network communication equipment in environments such as the Internet of Things and industrial automation. Background Technology

[0002] Network communication equipment anomaly detection refers to the technology of identifying abnormal behavior or anomalies in devices such as routers and switches by monitoring and recording their performance indicators (e.g., latency, packet loss rate, throughput) and operational status (e.g., port status, connection status). Anomalies in communication equipment can lead to performance degradation, data loss, and connection interruptions. Therefore, monitoring changes in various indicators allows for timely handling of system failures or service disruptions. For communication network access providers, ensuring service availability and performance is crucial, and communication equipment anomaly detection is a key technology for addressing these issues. Therefore, network communication equipment anomaly detection has become an important research direction in the field of information technology. Its main objective is to identify abnormal time points that significantly differ from the normal pattern of time-series data and promptly issue warnings to management personnel.

[0003] Compared to other types of data, time series data are characterized by their continuity. Each point in time only stores some scalar values, so a single point in time often cannot provide sufficient semantic information for analysis. Therefore, research usually focuses on the characteristics of time series changes over time. These changes reflect important attributes of time series, such as continuity, periodicity, and trends, providing richer information. In recent years, researchers have proposed many methods based on statistics and traditional machine learning. Statistical methods identify outliers by analyzing the statistical characteristics of time series data. For example, they analyze the distribution characteristics, mean, standard deviation, and other statistical measures, as well as threshold assumptions related to these statistical measures, to determine whether data points are abnormal. Examples include the Autoregressive Integrated Moving Average (ARIMA) model and the Local Outlier Factor (LOF) method. Traditional machine learning methods, such as K-Nearest Neighbors (KNN), One-Class Support Vector Machines (SVM), and Extreme Learning Machines (ELM), make assumptions about the latent models in the data and detect anomalies by setting data boundaries and anomaly thresholds. However, real-world time series changes often exhibit complex patterns. Their high dimensionality and complexity render algorithms based on mathematical statistical models and traditional machine learning inapplicable. Therefore, new methods are needed to improve the accuracy and efficiency of time series analysis. Furthermore, the scarcity of anomaly data and the high cost and difficulty in obtaining anomaly labels further hinder the effectiveness of traditional supervised methods.

[0004] Deep learning methods benefit from their nonlinear modeling capabilities and network structures for handling high-dimensional data. They can learn complex dynamic changes in data without making assumptions about underlying models, thus achieving better results than traditional methods. For example, models such as LSTM, Gated Recurrent Unit (GRU), Deep Auto-Encoder Gaussian Mixture Model (DAGMM), Variational Auto-Encoder (VAE), and Graph Neural Network (GNN) are key technologies in unsupervised modeling. Generally, these unsupervised time-series anomaly detection models often use prediction or reconstruction to identify anomalies in the data. However, recent research shows that reconstruction-based methods perform better than prediction-based methods in anomaly detection.

[0005] While these deep learning-based models have achieved excellent performance in time series forecasting, they often struggle to capture long-term changes and multi-dimensional correlations in time series data. For example, methods based on graph neural networks (GCNs) are limited to a small number of neighboring nodes to maintain computational complexity, making it difficult to access global information and complete detection tasks at larger time steps. Transformer-based deep models perform poorly in long-sequence analysis scenarios, incurring high computational costs for long-term series and finding it difficult to directly identify reliable dependencies from scattered time points; their performance in common prediction tasks is even inferior to single-layer linear models like DLinear.

[0006] The invention patent with publication number CN117556311A discloses an unsupervised time series anomaly detection method based on multi-dimensional feature fusion, applied to server anomaly detection. It focuses on multi-dimensional feature fusion, including the extraction and fusion of one-dimensional and two-dimensional features; analysis is performed on a single period; feature fusion is achieved using stacked separable convolutional networks and fully connected layers, with fully connected layers and convolutional networks used in parallel, followed by final feature fusion.

[0007] The invention patent with publication number CN117688496A discloses a method, system, and device for anomaly diagnosis of multidimensional time-series satellite telemetry data. It achieves anomaly detection and diagnosis through an improved transfer entropy method and graph neural networks, focusing on identifying the root cause of anomalies. The method employs graph neural networks, combining causal relationships and similarity relationships to construct the graph structure of the neural network for anomaly detection and diagnosis of multidimensional time-series satellite telemetry data.

[0008] Publication number CN117851920A discloses a method and system for anomaly detection in power IoT data. This method utilizes discrete wavelet transform and a spatiotemporal network model to mine temporal features and complex correlations between sequences. By combining graph convolutional layers and a Transformer model, anomaly scores are determined using multivariate Gaussian distribution and Mahalanobis distance. Summary of the Invention

[0009] The core of this invention lies in the design of a time-series data reconstruction model for anomaly detection, which aims to overcome the limitations of existing technologies. In multi-dimensional, long-sequence anomaly detection scenarios, it can find reliable dependencies from scattered time points, capture normal data patterns of communication device monitoring data, improve data reconstruction effects, and thus improve anomaly detection performance.

[0010] A communication device anomaly detection method based on channel attention and frequency domain analysis includes the following steps:

[0011] Step S1: Obtain the original data from the database, perform normalization processing, and obtain the subsequence;

[0012] Step S2: Perform time-series decomposition on the subsequence from step S1 to obtain trend sequence components and periodic sequence components;

[0013] Step S3: Perform FFT transformation and analysis on the periodic sequence components to obtain the average amplitude set and establish the input feature map;

[0014] Step S4: Compress and excite the input feature map to generate a channel attention map, which is used to adjust the weights of each indicator in the input feature map;

[0015] Step S5: After weighting the feature map, perform a convolution operation to obtain... It is used to simultaneously capture the intra-period and inter-week changes of multiple indicators in time series data, as well as the interdependencies between different indicators;

[0016] Step S6: Reassemble the convolution result output from step S5 into a one-dimensional tensor output to obtain the output sequence of the stacked convolution module;

[0017] Step S7: For the output sequence of the convolutional module in step S6, learn the deep abstract temporal data features of the stacked convolution results under different periods through a multilayer perceptron, and output the result;

[0018] Step S8: Combine the initial trend sequence components with weighted aggregation to output the residual sequence, which will then be used as the input for the next layer;

[0019] Step S9: Use the loss function to update the parameters of each layer layer by layer;

[0020] Step S10: Perform anomaly detection, based on the reconstruction results of the training set and the reconstruction error, and find the anomaly threshold according to the pre-input hyperparameter anomaly rate; calculate the anomaly score and compare it with the anomaly threshold to determine anomalies; if the anomaly score is greater than the anomaly threshold, it is determined that there is an anomaly at that time point.

[0021] Beneficial effects:

[0022] Existing time-series anomaly detection techniques face challenges in processing large-scale data due to its high dimensionality and complexity, as well as the lack of labeled data. This invention proposes an anomaly detection model based on channel attention and frequency domain analysis, which offers the following advantages over existing technologies:

[0023] 1. The time series decomposition blocks enhance the model's performance in mining periodic relationships in long-term series and improve the model's adaptability to frequency domain analysis and feature extraction of long-term series under different seasonal variations.

[0024] 2. By introducing a channel attention mechanism, corresponding weights can be assigned based on the importance of each indicator in the time series data, enabling the model to focus on the important features of the communication equipment monitoring data. This effectively suppresses the impact of noisy sequences on data reconstruction, thereby improving the model's ability to reconstruct key sequences and ultimately significantly enhancing the model's anomaly detection capability.

[0025] 3. This invention does not rely on the statistical properties of the data or make assumptions about the latent models in the time series data. Instead, it uses a reconstructed anomaly detection method to map the time series data into a high-dimensional feature map and model the time series data in a deep neural network.

[0026] The nonlinear relationships between scattered data points are identified and reconstructed based on high-dimensional features, capturing the complex characteristics of time-series data such as long-term dependence, periodic changes, and multi-dimensional correlations. Attached Figure Description

[0027] Figure 1 This is a flowchart illustrating the communication device anomaly detection method of the present invention.

[0028] Figure 2 This is a schematic diagram of the overall architecture of the data reconstruction model of the present invention.

[0029] Figure 3 This is a schematic diagram of the segmentation and stacking of the present invention.

[0030] Figure 4 This is a schematic diagram of the weight allocation of the Convolutional Channel Attention Module (CAM) of the present invention. Detailed Implementation

[0031] This invention proposes an anomaly detection method for communication devices based on channel attention and frequency domain analysis. This anomaly detection method is implemented based on a reconstruction model. First, the detection data generated by the network communication device is preprocessed to generate a time-series data dataset. During the model training phase, the time-series data is used to reconstruct the model and capture the features and distribution of normal data. During the anomaly detection phase, the data to be detected is reconstructed, and the reconstructed data is compared with the input data. Based on the reconstruction error, the time points where anomalies exist in the data to be detected are found. The specific process is as follows: Figure 1 As shown: First, the dataset is divided based on historical data, and a reconstruction model is trained to capture the features of normal data patterns. In the anomaly detection phase, the time series data to be detected is acquired and input into the time series data reconstruction model to obtain the reconstruction sequence. The time series data to be detected and the reconstructed data are compared, and the anomaly score at each time point is calculated. Finally, the anomaly time points are identified by comparing the anomaly scores of the time series data with a preset anomaly threshold.

[0032] This invention addresses anomaly detection in communication devices based on reconstruction. It designs a CNN-based data reconstruction model. By performing trend and periodic decomposition on the original data, segmenting and stacking it based on periodic characteristics, and applying channel attention weights followed by two-dimensional convolution, reliable dependencies based on different periods can be found at dispersed time points. The temporal decomposition block, stacking, and convolution modules form the main components of the reconstruction module, constituting a block. The blocks of the model are connected via residuals, constructing the data reconstruction model for the anomaly detection process. Figure 2 Reconstruct the overall architecture of the data model.

[0033] The core of this invention lies in the design of a time-series data reconstruction model for anomaly detection. This model aims to overcome the limitations of existing technologies and, in multi-dimensional, long-sequence anomaly detection scenarios, find reliable dependencies from dispersed time points, capture normal data patterns in communication device monitoring data, improve data reconstruction effectiveness, and thus enhance anomaly detection performance. Its core features are: 1. A stacking and convolution module is proposed in the reconstruction model. Time-series data is segmented and stacked based on periodic characteristics and then convolved to capture the intra-period and inter-weekly variations of multi-indicator time-series data, as well as the interdependencies between different indicators. 2. Based on this, to focus on important indicators of the time-series data, a channel attention mechanism is introduced into the stacking and convolution module to suppress irrelevant noise sequence responses, which is beneficial for feature extraction by the convolution module. 3. To learn complex time patterns in the context of long-term time-series data, a time-series decomposition block is introduced. Using the idea of ​​decomposition, long-term stable trend sequences are extracted, reducing the impact on the reconstruction effect. Compared to existing deep learning models (such as GRU, GNN, DLinear, Transformer series models, TCN, etc.), this model is more likely to capture long-term changes and multi-dimensional correlations in time series data, and can take into account the relative importance of each indicator sequence. Therefore, it has better feature extraction capabilities and time series data reconstruction effects, and can achieve higher accuracy and lower false negative rate in anomaly detection tasks.

[0034] Definitions:

[0035] Time-series data: Time-series data is a series of data indexed by the time dimension, where each data point has a timestamp. This type of data describes the measured values ​​of a subject at each point in time within a time range. This type of data is very common in various fields, such as finance (stock prices), meteorology (daily temperature), and industry (sensor data). Its main characteristic is that its index is time, and there is temporal continuity and correlation between data points.

[0036] Time Domain: The time domain is a representation of how a signal changes over time. In the time domain, a signal is represented as a function of its amplitude or intensity changing with time. Time-domain signals can be continuous or discrete. For continuous time-domain signals, we use a continuous time variable to represent the signal's change over time. For discrete time-domain signals, we use a series of discrete time points to represent the signal's value at a specific moment. Time-domain analysis can reveal some important characteristics of a signal, such as waveform, period, and amplitude. However, analyzing a signal only in the time domain may not fully reveal its frequency characteristics; in such cases, frequency-domain analysis methods, such as the Fourier transform, are needed.

[0037] Fast Fourier Transform (FFT): The Fast Fourier Transform (FFT) is an efficient algorithm for calculating the Discrete Fourier Transform (DFT). It transforms discrete-time signals from the time domain to the frequency domain, significantly reducing the complexity of DFT computation and greatly improving efficiency. Through the FFT, we can quickly understand the intensity of different frequency components in a signal, thus aiding in operations such as filtering, compression, and feature extraction. In practical applications, the FFT is widely used in various scenarios. For example, in audio processing, it can be used to analyze the frequency components of sound, helping to achieve audio compression, noise reduction, and sound effect optimization. In the field of communications, the FFT is used for signal modulation and demodulation, spectrum analysis, and channel estimation.

[0038] ShuffleNet Convolution: ShuffleNet is a computationally efficient convolutional neural network (CNN) architecture that utilizes two novel operations: pointwise grouped convolution and channel shuffling. Grouped convolution ensures that each convolution operates only on its corresponding input channel group, effectively reducing network size and significantly lowering the computational cost of traditional convolution. Channel shuffling disrupts the grouping, allowing information to flow between channel groups and incorporating information from other groups. These two operations enable ShuffleNet convolution to maintain high accuracy while reducing computational cost.

[0039] Multilayer Perceptron (MLP): MLP is a common feedforward artificial neural network model. It consists of an input layer, multiple hidden layers, and an output layer. Each layer contains multiple neurons connected by weights. The input signal is processed by weighted summation and activation functions in each layer, progressively extracting and transforming features, and finally producing a prediction or classification result in the output layer. In terms of applications, MLP can be used to predict stock prices, sales volume, etc.; in pattern classification tasks, it can classify images, text, etc.

[0040] Residual connections: In neural networks, residual connections refer to directly adding the output of a previous layer to the input of a subsequent layer. This is done to address the vanishing gradient and performance degradation that can occur as network depth increases. Through residual connections, information can be transferred more smoothly within the network, making the network easier to train and enabling the construction of deeper and more powerful models.

[0041] Channel attention mechanism: In deep learning, channel attention is a mechanism used to evaluate the importance and assign weights to the channel dimensions of feature maps. It analyzes the importance of the information contained in each channel and assigns different weights to each channel. This allows the model to focus more on channel features that are more valuable to the task and suppress less important channel features, thereby improving the model's performance and expressive power. It is commonly used in computer vision, such as in image recognition tasks, where channel attention helps the model extract key image features more accurately and improves recognition accuracy.

[0042] F1 Score: The F1 score is a comprehensive metric used to evaluate the performance of classification models. It considers both precision and recall. Precision measures the proportion of samples predicted as positive that are actually positive, while recall represents the proportion of samples that were actually positive that were correctly predicted as positive. The F1 score is the harmonic mean of precision and recall, calculated as: F1 = 2 * (Precision * Recall) / (Precision + Recall). In practical applications, such as information retrieval and anomaly detection, when we want the model to accurately identify positive examples while minimizing the number of missed positive examples, the F1 score provides a comprehensive and balanced evaluation, helping us better judge the model's performance.

[0043] To illustrate the technical solution of the present invention in more detail, the present invention will be described in detail below with reference to embodiments:

[0044] A communication device anomaly detection method based on channel attention and frequency domain analysis includes the following steps:

[0045] Step S1: Obtain the original data from the database, perform normalization processing, and obtain the subsequence;

[0046] Step S2: Perform time-series decomposition on the subsequence from step S1 to obtain trend sequence components and periodic sequence components;

[0047] Step S3: Perform FFT transformation and analysis on the periodic sequence components to obtain the average amplitude set and establish the input feature map;

[0048] Step S4: Compress and excite the input feature map to generate a channel attention map, which is used to adjust the weights of each indicator in the input feature map;

[0049] Step S5: After weighting the feature map, perform a convolution operation to obtain... It is used to simultaneously capture the intra-period and inter-week changes of multiple indicators in time series data, as well as the interdependencies between different indicators;

[0050] Step S6: Reassemble the convolution result output from step S5 into a one-dimensional tensor output to obtain the output sequence of the stacked convolution module;

[0051] Step S7: For the output sequence of the convolutional module in step S6, learn the deep abstract temporal data features of the stacked convolution results under different periods through a multilayer perceptron, and output the result;

[0052] Step S8: Combine the initial trend sequence components with weighted aggregation to output the residual sequence, which will then be used as the input for the next layer;

[0053] Step S9: Use the loss function to update the parameters of each layer layer by layer;

[0054] Step S10: Perform anomaly detection, based on the reconstruction results of the training set and the reconstruction error, and find the anomaly threshold according to the pre-input hyperparameter anomaly rate; calculate the anomaly score and compare it with the anomaly threshold to determine anomalies; if the anomaly score is greater than the anomaly threshold, it is determined that there is an anomaly at that time point.

[0055] Specifically:

[0056] Step S1.1: Extract multiple monitoring indicators of a network communication device from the time-series data of the continuous access network domain equipment operation of the Jiangsu Telecom data sharing platform as raw data (in this example, extract 8*12 indicator sequences such as packet forwarding rate, packet loss rate, and bandwidth utilization of the first eight ports), and convert them into multi-indicator time-series data sequences to obtain a C×L multi-dimensional time-series dataset S, where C is the number of data indicators and L is the total time step. Use min-max normalization to obtain the normalized dataset S′.

[0057] Step S1.2: Divide the normalized time series S′ into X1, X2, ..., X′ using a sliding window of length T with a step size of T / 2. n There are n subsequences of length T.

[0058] Step S2: Input the subsequences into the temporal decomposition block of the reconstruction model. The temporal decomposition block will input the subsequences X∈{X1,X2,…,X…} n} is decomposed into periodic sequence components X s and trend sequence component X tThese respectively reflect the trend and periodicity of the time series, among which... For multidimensional time series data with a time step of T and a number of indicators of C, equations 1 and 2 describe the specific decomposition process. Padding(·) means padding the original sequence with zeros to an integer multiple of the pooling window size, and AvgPool(·) means performing average pooling in the time dimension.

[0059] X t =AvgPool(Padding(X)) (1)

[0060] X s =XX t (2)

[0061] When the pooling window size is h and the stride is s, the average pooling AvgPool(·) is as follows, where X[i] represents the i-th data point of vector X:

[0062]

[0063] Through the above transformations, the original time series data is decomposed into trend sequence components. and periodic sequence components Use X t ,X s =Decomp(X) summarizes the above process.

[0064] Step S3.1: Convert the periodic sequence X s Input a stacked convolution module. For a periodic sequence X of multi-indicator data. s First, the frequency domain characteristics are analyzed using Fast Fourier Transform to find the top K maximum amplitudes and their corresponding periods. The original input data is then segmented and stacked based on different period lengths, allowing subsequent convolution processing to simultaneously capture the periodic and intra-period correlations of multiple index data. Sequence X s After FFT transformation and analysis, the following results can be obtained:

[0065] A = Avg(Amplitude(FFT(X)) s (4)

[0066] A i =TopK(A),i∈{1,…,k} (5)

[0067]

[0068] Where FFT(·) represents performing Fast Fourier Transform on the time series data of C different indicators, Amplitude(·) represents taking the amplitude part of the transform result, and Avg(·) represents calculating the average amplitude in the C indicator dimensions, finally obtaining the set of average amplitudes of the multidimensional time series data as a function of frequency f.

[0069] To avoid the influence of high-frequency noise, we only select The first K amplitude values ​​and their corresponding frequencies. Here, the frequency corresponding to the j-th amplitude is f. j , representing the number of periods at time T, with the corresponding period length being . TopK(·) means taking the top K largest numbers in the set, A i for The first K largest amplitudes. argTopK(·) represents the index corresponding to the first K largest values ​​in the set. argTopK(A) gives the frequency f corresponding to amplitude A. Ceil(·) is the floor function. i This represents the period length corresponding to the K most significant frequencies.

[0070] Step S3.2: Through the processing in step S3.1, obtain K different period lengths p. i The original time series data, i∈{1,…,k}, is segmented and stacked to obtain K multidimensional tensors of different shapes. The specific process is as follows: Figure 3 As shown. Formula (7) outlines the specific process of this segmentation and stacking, ensuring that the segmented sequence is p. i The length is an integer multiple of the original length, and before splitting and stacking, it is in X. s Tail filler 0 to p i The operation is represented by Padding(·) for integer multiples of x. SplitRecomb(p,x) means dividing x into segments with a period of p along the time dimension and stacking them sequentially. Indicates based on the i-th period p i The multidimensional tensor obtained after splitting and stacking.

[0071]

[0072] by The input feature map is used to capture trend changes in adjacent time periods, long-term dependencies between different periods, and dependencies between multiple indicators.

[0073] Step S4: Input feature map Compressed excitation generates channel attention map S iThis approach focuses on key features of multi-indicator data and suppresses the response of noisy sequences. During training, the model learns a weight allocation method based on the contribution of each indicator to the reconstruction effect, generating a channel attention map S. i Used to adjust the input feature map The weights of each indicator are determined. This adaptive weight adjustment mechanism allows the model to focus more on learning channel information that contributes significantly to the reconstruction task. In the monitoring indicators of communication equipment, important indicators such as throughput, packet loss rate, and bandwidth utilization will be assigned higher weights, while less important indicators such as the status of non-critical links will be assigned lower weights to reduce their impact on the reconstruction of other sequences during the convolution stage. The calculation and allocation of the weights of each indicator sequence are as follows: Figure 4 As shown.

[0074] For the input feature map Average pooling and max pooling are performed on each indicator sequence to aggregate time and periodicity information, resulting in two C-dimensional pooled feature maps, thus compressing the feature maps. These two feature maps are then fed into a shared multilayer perceptron containing one hidden layer, yielding two 1x1xC channel attention maps for feature map activation and weight generation. Finally, the two channel attention maps obtained from the multilayer perceptron are summed and activated to generate the final input feature map. Channel attention map S i S i This serves as the weight information for each channel, i.e., the weight information for each indicator. To reduce the number of parameters, the number of neurons in the hidden layer is C / r, where r is the dimensionality reduction coefficient. Input feature map Corresponding channel attention map S i The generation is shown in formula (8).

[0075]

[0076] Here, AvgPool(·) and MaxPool(·) represent average pooling and max pooling, respectively, and MLP(·) represents a multilayer perceptron. Abstract features of each channel of the input feature map are extracted through compression and activation of the convolutional attention module. σ(·) represents the ReLU activation function, mapping the summation result to the output through a nonlinear transformation. Channel attention maps S are generated. i As a weight matrix, it serves as the input. Each channel is assigned a different weight.

[0077]

[0078] Where F scale (u,s) represents element-wise multiplication of u and s.

[0079] Step S5: Process the feature map After weighting, we input the data into the efficient computer vision network ShuffleNet to perform convolutional operations, capturing the intra-period and inter-weekly variations of multi-indicator time-series data, as well as the interdependencies between different indicators. ShuffleNet employs a grouped convolution strategy, ensuring that each convolutional operation focuses only on its corresponding input channel group, resulting in sparse channel connectivity and significantly reducing computational costs. Furthermore, ShuffleNet rearranges channels, allowing convolutional layers to receive feature information from different groups, maintaining high accuracy while reducing computational costs. Thanks to ShuffleNet's efficient architecture and optimized utilization of computational resources, our model is suitable for inputs with larger time steps and larger hyperparameters K, thus better suited for capturing long-term features of time series data.

[0080]

[0081] Step S6.1: [The text appears to be incomplete and contains several grammatical errors. A more accurate translation would require the full context.] The output of the two-dimensional convolution is recombined into one dimension and the original length L is restored, resulting in K one-dimensional tensor outputs.

[0082]

[0083] SplitRecomb -1 (·) represents the inverse transformation of the splitting and recombination, splitting and recombinating the original two-dimensional output into a one-dimensional output. SubSeq(·) represents the transformation of p... i Time series data of an integer multiple of its length can be recovered to its original time step L.

[0084] Step S6.2: The amplitude A obtained in step S3.1 can reflect the relative importance of the selected frequency and period, thus corresponding to the importance of each transformed two-dimensional tensor. The amplitude calculated based on frequency domain analysis is normalized to obtain... Use this as the output sequence The weights are used to obtain the output S of the stacked convolutional module. i Where Softmax(A1,…,A) k ) indicates the normalization operation.

[0085]

[0086] Step S7: For the output sequence S of the convolutional module considering K different periodic features i For i∈{1,…,k}, a deep abstract temporal data feature of stacked convolution results at different periods is learned through a multilayer perceptron, and the result is output. i∈{1,…,k}, has the same shape as the original input. The multilayer perceptron considers the convolution results under K different periods and reconstructs the depth of the results based on the abstract data features learned from the hidden layers.

[0087]

[0088] Step S8: Finally, the initial trend sequence components X s Weighted aggregation is performed, outputting a residual sequence O, which is then used as input to the next layer. Multiple layers are connected via residual connections, where... i∈{1,2} is a learnable parameter.

[0089]

[0090] Step S9: During the training phase, the loss function used is the mean squared error (MSE), which is calculated using the following formula:

[0091]

[0092] Where Y ij It is a predicted value. This is the baseline value. Following the chain rule, the gradient of the loss function L with respect to each parameter in each layer is calculated layer by layer, and the parameters are updated in the reverse direction of the gradient. To update the parameters W of a linear layer in an MLP, the gradient of the loss function L with respect to Y (i.e., the partial derivative) is first calculated. Then, through backpropagation, the gradient of Y with respect to the MLP output S is calculated. i gradient Calculate S i gradient with respect to W Finally, based on the preset learning rate α, W is updated in the opposite direction of the gradient. Through this backpropagation method, the parameters of each layer are updated layer by layer.

[0093] Step S10.1: In the anomaly detection stage, firstly, based on the reconstruction results of the training set and the reconstruction error, the anomaly threshold is found according to the pre-input hyperparameter anomaly rate.

[0094]

[0095] Where E is the set of reconstruction errors at each time point for all samples, n is the number of samples, L is the time step of the samples, and Y is the reconstruction result. E′ is the result after sorting E, a is the pre-input anomaly rate, |E′| represents the number of elements in the E′ set, and THR represents the calculated anomaly threshold.

[0096] Step S10.2: Anomaly judgment is made by calculating the anomaly score and comparing it with the threshold. Since this time series data reconstruction model captures features such as weekly changes and trend changes in the time series dataset through training, it can infer the reconstruction result of the normal pattern from the input data. The actual time series data to be detected is reconstructed using the model. Based on the comparison between the reconstruction result and the actual data, the anomaly score at each time point is calculated. The anomaly score is compared with the anomaly threshold to determine whether there is an anomaly at a specific time point.

[0097]

[0098] Where E t The abnormal score of the data to be detected at time t is compared with the threshold THR. If the abnormal score is greater than the threshold THR, it is determined that there is an abnormality at that time point.

[0099] This invention uses monitoring data of multiple network devices from February to April 2024, obtained from the time-series data of continuous access to the operation of all professional equipment in the network domain from the Jiangsu Telecom data sharing platform. Data is collected every 20 minutes, for 24 hours per day. Thirteen dimensions of indicators, totaling 13,104 data points, from April 1st to April 14th, 2024, are selected as validation data for the model. To compare the performance of this model with other baseline methods, the same data preprocessing methods and evaluation metrics as previous time-series anomaly detection work are used, including:

[0100]

[0101] Where F1 represents the F1 score, P represents precision, R represents recall, TP represents the number of true positives, FP represents the number of false positives, and FN represents the number of false negatives. The selection strategy for the anomaly threshold is not considered. If a model does not provide a specific threshold selection strategy, a brute-force search for the threshold based on a 2% anomaly rate is used to obtain the F1 score for each model. This is done to ensure a consistent threshold search strategy. Furthermore, to maintain consistency in the experimental setup, the output adjustment strategy used in previous models, point-adjustment, is adopted: for a segment anomaly, it is acceptable if the model triggers any subset of anomalies. Therefore, if any observation in a true anomaly segment is detected as an anomaly by the model, the anomaly detection for that segment can be considered correct. No adjustment is made for general point anomalies.

[0102] For comparison models, we selected the single-layer linear model DLinear and the CNN-based TCN, as well as Transformer, TimesNet, and Autoformer as benchmarks. The parameters of each model are shown in Table 1. In the table, d_model represents the dimension of the neural network in the model, and d_ff represents the dimension of the feedforward neural network in the model. seq_len represents the length of the input data in the model, num_kernels represents the number of convolutional kernels, and top_k represents the size of the hyperparameter K in the frequency domain analysis. moving_avg is the window size of the moving average algorithm, and moving_step is the step size of the moving average algorithm. anomaly_ratio represents the anomaly rate of the pre-input. Most of the existing parameters of the original model remain the same as those in the previous TimesNet architecture model paper. For the Transform series models, label_len represents the length of the initial token, enc_in represents the encoder input size, and e_layers represents the number of encoder layers. Our model uses the ADAM optimizer and employs an Early Stop mechanism, allowing us to stop model training based on the validation set, preventing overfitting and enhancing generalization performance. When pat ≥ ence = 3, meaning that if performance does not improve within three consecutive cycles, the training process will stop. All experimental results are expressed as the average of eight consecutive repeated experiments.

[0103] Table 1 Baseline Model and Corresponding Parameters

[0104]

[0105] In the experiment, this model was compared with five advanced baseline methods: DLinea, TCN, Transformer, TimesNet, and Autoformer. Table 2 shows the detailed performance comparison results of multivariate time series data extracted from real telecommunications network equipment traffic data as the experimental dataset.

[0106] Table 2 shows the performance of this model and the baseline model on the telecommunications dataset.

[0107]

[0108]

[0109] In the primary benchmark evaluation metric for anomaly detection, the F1 score, our model achieved the best performance, exceeding the best baseline score by 2.23%. Among these models, TCN yielded the worst results. TCN constructs long-term dependencies through one-dimensional convolutions and extended convolutions, but one-dimensional convolutions suffer from a limited receptive field, restricting their long-term predictive power. Furthermore, for complex multidimensional variables, TCN struggles to capture the complex interactions and dependencies between multiple indicators. In contrast, when modeling complex data distributions, our two-dimensional convolutions significantly outperformed the model.

[0110] The Transformer employs an attention mechanism to adaptively capture long-term temporal dependencies and has good global modeling capabilities. However, in long-series analysis, its performance degrades significantly when the time step size is increased to 192 or higher. This is because the Transformer has high computational costs for long-term series and struggles to directly find reliable dependencies from scattered time points. In contrast, DLinear achieves better results. DLinear models the trend and residual sequences using two single-layer linear networks, enabling simple yet effective extraction of temporal relationships in time series. This direct multi-step prediction strategy avoids the error accumulation effect in autoregressive prediction. However, the DLinear model is based on linear assumptions. For real-world time series data containing complex nonlinear relationships, DLinear cannot effectively capture its inherent nonlinear characteristics, thus affecting prediction accuracy. Furthermore, DLinear fails to consider the interactions between variables, leading to inaccurate reconstruction results. The Autoformer, building upon the Transformer, employs a staged prediction strategy. It first generates a coarse global trend prediction and then gradually refines it to each time point. This strategy can more accurately capture short-term and long-term dependencies, thereby improving prediction accuracy and reducing error accumulation effects to some extent. Therefore, a higher F1 score can be achieved in anomaly detection tasks.

[0111] Based on the above discussion, compared to the prior art published by CN117556311A, this invention is mainly applied to communication equipment; in terms of technical means, this invention focuses on frequency domain analysis and channel attention mechanisms; in the stacked convolution part, this invention analyzes based on K different periods. Furthermore, in terms of model architecture: this invention uses a ShuffleNet convolutional network and a channel attention mechanism for sequential processing. Compared to the prior art published by CN117688496A, this invention focuses on frequency domain analysis and channel attention mechanisms to improve the accuracy of anomaly detection; in terms of technical means, this invention uses a CNN-based method to extract data changes within and between periods. Compared to the prior art published by CN117851920A, this invention focuses on frequency domain analysis and channel attention mechanisms to improve the accuracy of anomaly detection; in terms of technical architecture: this invention uses a ShuffleNet convolutional network and a channel attention mechanism; in terms of anomaly detection strategy: this invention judges anomalies through reconstruction errors. Therefore, the technical solution of this invention differs significantly from the prior art in both technical architecture and technical solution.

[0112] This invention employs a decomposition approach to learn complex time patterns in long-term scenarios, decomposing the time series into trend and periodic components. By analyzing the deep abstract features of the periodic component, it improves the ability to discover periodic-based dependencies in frequency domain analysis. Results from DLinear and Autoformer demonstrate that decomposing the original sequence into trend and periodic components for separate processing effectively improves the prediction performance of long-term time series. To capture the complex interactions and dependencies among multiple indicators and to model multidimensional complex data distributions, we use a segmented, stacked, fast processing followed by two-dimensional convolution to capture its periodic characteristics. We also introduce a channel attention mechanism to focus on important features of the time series data and suppress irrelevant noise responses, enabling more stable and accurate capture of global key information and effectively reducing the false alarm rate. This further improves the F1 score.

[0113] This invention proposes an anomaly detection method for communication devices based on channel attention and frequency domain analysis. The specific steps include: in the training phase, using time-series data to reconstruct a model to capture normal data patterns; in the anomaly detection phase, reconstructing the data to be detected, comparing the reconstructed data with the input data, and finding the time points where anomalies exist in the data to be detected based on the reconstruction error.

[0114] Compared to existing technologies, the key advantages include:

[0115] 1. A communication device anomaly detection model based on channel attention and frequency domain analysis is proposed, wherein the reconstruction module includes a temporal decomposition block and a stacked convolution module, and residual connections are used between the layers.

[0116] 2. A design was proposed to decompose the periodic components from the original sequence before processing by the stacked convolution module, and use these components as the input of the stacked convolution module, in order to mine the potential patterns of time series data from the perspective of frequency.

[0117] 3. By embedding a channel attention mechanism in the stacking and convolution processing, a stacked convolution module was designed, which can focus on important sequences of multi-indicator data to improve reconstruction accuracy.

Claims

1. A communication equipment anomaly detection method based on channel attention and frequency domain analysis, characterized in that... Includes the following steps: Step S1: Obtain the original data from the database, perform normalization processing, and obtain the subsequence; Step S2: Perform time-series decomposition on the subsequence from step S1 to obtain trend sequence components and periodic sequence components; Step S3: Perform FFT transformation and analysis on the periodic sequence components to obtain the average amplitude set and establish the input feature map; the specific process is as follows: Step S3.1: Componentize the periodic sequence Input stacked convolution module; for periodic sequence components of multi-indicator data. First, the frequency domain characteristics are analyzed using Fast Fourier Transform to find the top K maximum amplitudes and their corresponding periods. These are then used to segment and stack the original input data based on different period lengths, enabling subsequent convolution processing to simultaneously capture the periodic and intra-period correlations of multiple index data. After FFT transformation and analysis, the following results were obtained: （4） （5） （6） in This indicates that a Fast Fourier Transform is performed on time series data for C different data indicators. This indicates that the amplitude portion of the transformation result is taken. This involves calculating the average amplitude across C data index dimensions, ultimately obtaining the set of average amplitudes of multidimensional time-series data as a function of frequency f. ; To avoid the effects of high-frequency noise, select The first K amplitude values ​​and their corresponding frequencies; here, the frequency corresponding to the j-th amplitude is... , representing the number of periods at time step T, with the corresponding period length being ; This means taking the top K largest numbers from the set. for The first K largest amplitudes; This represents the indices corresponding to the K largest values ​​in the set, obtained by... To obtain the frequency f corresponding to amplitude A, It is the floor function. This represents the period length corresponding to the K most significant frequencies; Step S3.2: Through the processing in step S3.1, K different period lengths are obtained. Based on this, the original time series data is segmented and stacked to obtain K multidimensional tensors with different shapes; （7） Formula (7) outlines the specific process of this segmentation and stacking, so that the segmented sequence is The length is an integer multiple of the original length, before splitting and stacking. Tail filler 0 to Multiples of integers, this operation uses express; Indicates will by The cycle is divided along the time dimension and stacked sequentially. Indicates based on the i-th period The multidimensional tensor obtained after splitting and stacking; by The input feature map is used to capture trend changes in adjacent time periods, long-term dependence in different periods, and the dependence between multiple indicators. Step S4: Compress and excite the input feature map to generate a channel attention map, which is used to adjust the weights of each indicator in the input feature map; The specific process is as follows: S4: Input feature map Compressed excitations generate channel attention maps It focuses on the key features of multi-indicator data and suppresses the response of noisy sequences. During training, the reconstruction model learns the weight allocation method based on the contribution of each indicator to the reconstruction effect, and generates a channel attention map. Used to adjust the input feature map The weights of each indicator are determined; in the monitoring indicators of communication equipment, important indicators will be given higher weights, while indicators with relatively lower importance will be given lower weights, so as to reduce their impact on the reconstruction of other sequences during the convolution stage. The calculation and allocation of the weights for each indicator sequence are as follows: For the input feature map The system performs average pooling and max pooling on each index sequence to aggregate time and period dimension information, resulting in two C-dimensional pooled feature maps, thus compressing the feature maps. Then, the two feature maps are fed into a shared multilayer perceptron containing a hidden layer to obtain two 1x1xC channel attention maps, thus activating the feature maps and generating weight information. The two channel attention maps obtained from the multilayer perceptron are added and activated to generate the final input feature map. Channel attention map ;Will As the weights of each channel, i.e., each index weight; to reduce the number of parameters, the number of neurons in the hidden layer is C / r, where r is the dimensionality reduction coefficient; input feature map Corresponding channel attention map The generation is shown in formula (8): （8） in, and These represent average pooling and max pooling, respectively. This represents a multilayer perceptron; through compression and activation of the convolutional attention module, abstract features of each channel of the input feature map are extracted. Represents the ReLU activation function, which maps the summation result to the output through a nonlinear transformation; it generates a channel attention map. As a weight matrix, it serves as the input. Each channel is assigned a different weight; （9） in , indicating to Element-wise multiplication of s; Step S5: After weighting the feature map, perform a convolution operation to obtain... It is used to simultaneously capture the intra-period and inter-week changes of multiple indicator time series data, as well as the interdependencies between different indicators; Step S6: Reassemble the convolution result output from step S5 into a one-dimensional tensor output to obtain the output sequence of the stacked convolution module; Step S7: For the output sequence of the convolutional module in step S6, learn the deep abstract temporal data features of the stacked convolution results under different periods through a multilayer perceptron, and output the result; Step S8: Combine the initial trend sequence components with weighted aggregation to output the residual sequence, which will then be used as the input for the next layer; Step S9: Use the loss function to update the parameters of each layer layer by layer; Step S10: Perform anomaly detection, based on the reconstruction results of the training set and the reconstruction error, and find the anomaly threshold according to the pre-input hyperparameter anomaly rate; calculate the anomaly score and compare it with the anomaly threshold to determine anomalies; if the anomaly score is greater than the anomaly threshold, it is determined that there is an anomaly at that time point.

2. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 1, characterized in that... The specific process of step S1 above is as follows: Step S1.1: Extract multiple monitoring indicators of a network communication device from the database as raw data, and convert them into a multi-indicator time-series data sequence to obtain... Multidimensional time series dataset Where C is the number of data indicators and L is the total time step, the dataset is normalized using min-max normalization. ; Step S1.2: Using a time step of... sliding window with The step size is used to slide the data, and the above-normalized data is then processed. Divided into There are a total of n time steps with a time step size of n. subsequence.

3. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 2, characterized in that... The specific process of step S2 above is as follows: The subsequences are input into the temporal decomposition block of the reconstructed model; the temporal decomposition block will input the subsequences... Decomposed into periodic sequence components that reflect the periodicity of the time series. and trend series components that reflect the trend of this time series ,in For multidimensional time-series data with a time step of T and the number of indicators C, the specific decomposition process is as follows: （1） （2） in This means padding the original sequence with zeros to an integer multiple of the pooling window size. This represents average pooling over time; when the pooling window size is h and the stride is s, average pooling... As shown in the following formula, This represents the i-th data point in vector X: （3） Through the above transformations, the original time series data is decomposed into trend sequence components. and periodic sequence components ;use The above process can be summarized in detail.

4. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 3, characterized in that... The specific process of step S6 above is as follows: S6.1: will The convolution result is reassembled into one dimension, and the original time step L is restored, resulting in K one-dimensional tensor outputs. ; （11） in This represents the inverse transform of segmentation and recombination, which segments and recombines the original two-dimensional output into a one-dimensional output. Indicates will Time series data of an integer multiple of its length can be recovered to its original time step L; S6.2: The amplitude A obtained in step S3.1 is normalized to obtain... This is used as the output sequence. The weights are used to obtain the output of the stacked convolutional module. ; （12） （13） in This indicates a normalization operation.

5. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 4, characterized in that... The specific process of step S7 above is as follows: For the output sequence of a convolutional module that considers K different periodic features By learning deep abstract temporal data features from stacked convolution results at different periods using a multilayer perceptron, the output is obtained. The shape is the same as the original input shape; （14） The multilayer perceptron considers the convolution results under K different periods and reconstructs the results in depth based on the abstract data features learned from the hidden layers.

6. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 5, characterized in that... The specific process of step S8 above is as follows: Finally, the initial trend sequence components are... Combined with weighted aggregation, the output residual sequence is obtained. And serve as the input for the next layer; residual connections are used between multiple layers; （15） in As a learnable parameter.

7. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 6, characterized in that... The specific process of step S9 above is as follows: During the training phase, the loss function used is the mean squared error, calculated using the following formula: （16） in It is a predicted value. This is the baseline value. Following the chain rule, the gradient of the loss function L with respect to each parameter in each layer is calculated layer by layer, and the parameters are updated in the opposite direction of the gradient. To update the parameters W of a linear layer in the MLP, first, the gradient of the loss function L with respect to Y, i.e., the partial derivative, is calculated. Then, through backpropagation, Y with respect to the MLP output is calculated. gradient calculate gradient with respect to W Finally, based on the preset learning rate Update W in the opposite direction of the gradient. Through this backpropagation method, the parameters of each layer are updated layer by layer.

8. The communication device anomaly detection method based on channel attention and frequency domain analysis according to claim 7, characterized in that... The specific process of step S10 above is as follows: S10.1: In the anomaly detection phase, firstly, based on the reconstruction results of the training set and the reconstruction error, the anomaly threshold is found according to the pre-input hyperparameter anomaly rate. （17） （18） in The set of reconstruction errors at each time point for all samples, where n is the number of samples, L is the time step of the samples, and Y is the reconstruction result; for The sorted results, where 'a' represents the pre-input anomaly rate. express The number of elements in the set. This represents the calculated anomaly threshold; S10.2: Anomaly judgment is made by calculating the anomaly score and comparing it with the threshold. Since this time series data reconstruction model captures the features of the changes and trends of the time series dataset during the week through training, it can infer the reconstruction result of the normal pattern through the input data. The actual time series data to be detected is reconstructed using the model. Based on the comparison of the reconstruction result with the actual data, the anomaly score at each time point is calculated. The anomaly score is compared with the anomaly threshold to determine whether there is an anomaly at a specific time point. （19） in The anomaly score of the data to be detected at time t is calculated by comparing this anomaly score with a threshold. Comparison: If the anomaly score is greater than the threshold If so, then it is determined that there is an anomaly at that point in time.

Images