Intelligent high-end equipment business scene anomaly detection method based on Bayesian optimization algorithm
By using the combination method of Bayesian optimization algorithm and GRU-BiLSTM network in smart city business scenarios, the shortcomings of traditional anomaly detection methods in processing massive data and complex scenarios are solved, and more efficient, accurate and adaptive anomaly detection is achieved.
Patent Information
- Application Number
- CN202510322848.4
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-03-19
- Publication Date
- 2025-06-13
AI Technical Summary
Traditional anomaly detection methods are difficult to deal with massive data and complex smart city business scenarios, and are prone to high false alarm rates or missed alarm rates in dynamically changing environments.
A smart high-end equipment business scenario anomaly detection method based on Bayesian optimization algorithm is adopted to capture short-term and long-term dependencies in the data through the GRU-BiLSTM network, and the Bayesian algorithm is used to automatically tune hyperparameters to build a BO-GRU-BiLSTM anomaly detection model.
It improves the accuracy and adaptability of abnormal detection, reduces false alarms and missed alarms, ensures the reliability of the system and continuously and efficient operation, and reduces calculation costs and maintenance overhead.
Smart Images
Figure CN120145196A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of abnormal detection in smart city business scenarios, and particularly to an abnormal detection method for smart high-end equipment business scenarios based on the Bayesian optimization algorithm. Background Art
[0002] With the continuous development of Internet technology, the business scenarios of smart cities are becoming increasingly complex, and enterprises and organizations have accumulated a large amount of diverse data during the operation process. Most traditional abnormal detection methods rely on rules and simple statistical analysis, and formulate static rules for specific data sets and business environments. The limitations of these methods are that they usually cannot handle large amounts of data, nor can they adapt to changing business needs and complex smart city business scenarios. In an environment with multiple data sources, multiple dimensions, and multiple business processes, a single data analysis method is often difficult to comprehensively and accurately discover potential anomalies. More importantly, when dealing with dynamically changing abnormal behaviors, traditional methods are prone to high false alarm rates or missed alarm rates, thus affecting the normal operation of business processes.
[0003] In addition, with the advancement of intelligence and automation, enterprises are increasingly relying on real-time monitoring and intelligent decision-making, requiring abnormal detection not only to discover problems in a timely manner, but also to have high adaptability and robustness. In a diverse data type and complex business logic environment, how to use advanced technical means to achieve accurate, efficient, and real-time abnormal detection has become an important topic in the current technical field. Therefore, researching how to combine multiple technologies to solve the abnormal detection problem in complex smart city business scenarios has become a technical problem that the industry urgently needs to overcome. Summary of the Invention
[0004] The technical problem to be solved by the present invention is how to provide a more accurate and intelligent abnormal detection solution.
[0005] To solve the above technical problem, the technical solution adopted by the present invention is: an abnormal detection method for smart high-end equipment business scenarios based on the Bayesian optimization algorithm, which is characterized by including the following steps:
[0006] Collect relevant data from smart city business scenarios and preprocess the data;
[0007] Establish an abnormal detection model for smart city business scenarios;
[0008] Train and evaluate the abnormal detection model;
[0009] Use the optimized model to perform abnormal detection on business data;
[0010] Deploy and maintain the abnormal detection model.
[0011] A further technical solution lies in that the method for collecting relevant data from the smart city business scenario and preprocessing the data is as follows:
[0012] The relevant data of the smart city business scenario is collected from the security data collection and protection module embedded in the controller. The data includes the traffic and logs in the equipment network, as well as the behaviors and events of the analysis equipment system. After collection, a data set is formed, and the data is normalized. The formula for normalization is shown in Equation (1):
[0013]
[0014] In Equation (1), x' k is the normalized data; x k is the data to be normalized; x min is the minimum value of the sample data; x max is the maximum value of the sample data.
[0015] A further technical solution lies in that the method for establishing an anomaly detection model for the smart city business scenario is as follows:
[0016] The gating mechanism of the GRU network is used to capture the short-term dependencies in the ballistic data. At the same time, combined with the bidirectional structure of the BiLSTM network, it effectively extracts the long-term dependency information, avoids the limitations of a single model when processing the relevant data of complex smart city business scenarios, improves the adaptability to the dynamic changes of the data, and solves the problems of gradient disappearance and explosion. Then, the Bayesian algorithm is used to automatically tune the hyperparameters of the GRU-BiLSTM network, and an anomaly detection model based on Bayesian optimization of GRU-BiLSTM (BO-GRU-BiLSTM) is constructed. By effectively exploring the hyperparameter space and finding the best combination of hyperparameters, such as the learning rate, the number of hidden layer units, and the regularization parameter, etc., the prediction accuracy and generalization ability of the model are improved.
[0017] A further technical solution lies in that the method for training and evaluating the anomaly detection model is as follows:
[0018] Before using the Bayesian algorithm for hyperparameter selection, it is necessary to define the selection range for each hyperparameter to be determined. At the same time, the following key hyperparameters are selected: the number of neuron nodes, the setting of the initial learning rate, the value of the L2 regularization coefficient, the proportion of the dropout factor, the number of learning rate adjustments, and the setting of the learning rate adjustment factor. After optimization, the GRU-BiLSTM model is retrained using the optimized hyperparameters and evaluated on the test set. Three metrics are used to analyze the algorithm performance, namely: Mean Absolute Error (MAE), Mean Absolute Percentage Error (MAPE), and Root Mean Square Error (RMSE). The smaller these three metrics are, the better the prediction accuracy, thus providing more accurate anomaly detection for practical applications.
[0019] MAE is used to measure the difference between the predicted value and the actual value, which can more realistically reflect the performance of the model. The calculation process of MAE is shown in Equation (2):
[0020]
[0021] MAPE is used to evaluate the prediction accuracy, making it easier to compare the prediction results of different models. The calculation process of MAPE is shown in Equation (3):
[0022]
[0023] RMSE squares the error. Similar to MAE, it is an absolute error. The calculation process of RMSE is shown in Equation (4):
[0024]
[0025] In Equations (2), (3), and (4), x i is the actual value, y i is the predicted value, and N is the number of samples.
[0026] A further technical solution lies in the method of using the optimized model for anomaly detection of business data as follows:
[0027] The core strategy of Bayesian optimization is to use a surrogate model and an acquisition function to work together to efficiently search for the best hyperparameters. First, a surrogate model is constructed based on some randomly selected initial data points, which is an approximate simulation of the true objective function. Second, the acquisition function is used to locate a potential optimal point on the surrogate model. Finally, the surrogate model is iteratively updated by combining this newly found optimal point and the previously existing data points to more accurately approximate the true objective function. The mathematical expression of this process is shown in Equation (5):
[0028]
[0029] In Equation (5), p(A) is the prior distribution, that is, the surrogate model distribution; p(B) is the distribution of the observed data B; p(B|A) is the distribution of the observed data B given the surrogate model; p(A|B) is the posterior distribution, that is, the updated surrogate model distribution.
[0030] The BO-GRU-BiLSTM model is trained using the dataset of the smart city business scenario, and the hyperparameters of the model are tuned through Bayesian optimization to ensure that the model can converge to the optimal state during the training process. After training, the model can be used for prediction to identify potential abnormal behaviors or predict future trends.
[0031] A further technical solution lies in the method of deploying and maintaining the anomaly detection model as follows:
[0032] When deploying the anomaly detection model, in addition to the requirements of processing real-time data streams and batch data, it is also necessary to ensure the stability and security of the system. First, for real-time anomaly detection tasks, the model not only needs to process and analyze data streams in real time, but also needs to ensure low-latency and high-throughput processing capabilities to avoid response delays or data loss caused by insufficient system performance. In this case, using a stream processing platform and an efficient data pipeline can ensure the smooth transmission and processing of data and timely identify potential anomalies.
[0033] The beneficial effects of adopting the above technical solution are as follows: The Bayesian optimization algorithm avoids manual intervention by automatically adjusting model parameters, can quickly find the optimal parameter configuration, thereby improving the performance of the model, reducing false alarms and missed detections, and ensuring the reliability of the system. At the same time, the algorithm has strong adaptability and can adjust in real time to cope with changes in data distribution or business environment to ensure the continuous and efficient operation of the detection system. In addition, Bayesian optimization avoids a large number of invalid calculations and parameter searches, reducing the computational cost and maintenance overhead. By improving the detection accuracy and response speed, this technical solution can help enterprises quickly identify abnormal behaviors in various smart city business scenarios, give early warnings in a timely manner, thereby improving the overall operation efficiency, reducing risks, and can be widely applied in fields such as network security and smart cities. Brief Description of the Drawings
[0034] The present invention will be further described in detail below in conjunction with the drawings and specific embodiments.
[0035] Figure 1 is a flowchart of the method described in the embodiments of the present invention;
[0036] Figure 2 is a flowchart of network model training and prediction in the method described in the embodiments of the present invention;
[0037] Figure 3 is a flowchart of the optimization of the Bayesian algorithm in the method described in the embodiments of the present invention. Specific Embodiments
[0038] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention.
[0039] Many specific details are set forth in the following description in order to provide a thorough understanding of the present invention, but the present invention may be practiced in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the connotation of the present invention, so the present invention is not limited by the specific embodiments disclosed below.
[0040] As Figure 1 shown, the embodiments of the present invention disclose an abnormal detection method for the intelligent high-end equipment business scenario based on the Bayesian optimization algorithm. The method includes the following steps:
[0041] Step 1): Collect relevant data from the smart city business scenario and preprocess the data;
[0042] Step 2): Establish an abnormal detection model for the smart city business scenario;
[0043] Step 3): Train and evaluate the abnormal detection model;
[0044] Step 4): Use the optimized model to perform abnormal detection on business data;
[0045] Step 5): Deploy and maintain the abnormal detection model.
[0046] The above steps will be described below in conjunction with specific methods:
[0047] The method for the above step 1) of collecting relevant data from the smart city business scenario and preprocessing the data is as follows:
[0048] The relevant data of the smart city business scenario is collected from the security data collection and protection module embedded in the controller. The data includes the traffic and logs in the equipment network, as well as the behaviors and events of the analyzed equipment system. After collection, a data set is formed, and the data is normalized. The normalization formula is shown in Equation (1):
[0049]
[0050] In Equation (1), x' k is the normalized data; x k is the data to be normalized; x min is the minimum value of the sample data; x max is the maximum value of the sample data.
[0051] The method for establishing the anomaly detection model for the smart city business scenario in step 2) is as follows:
[0052] The gating mechanism of the GRU network is used to capture the short-term dependencies in the ballistic data. At the same time, combined with the bidirectional structure of the BiLSTM network, it effectively extracts the long-term dependency information, avoids the limitations of a single model when dealing with the relevant data of complex smart city business scenarios, improves the adaptability to the dynamic changes of the data, and solves the problems of gradient vanishing and explosion. Then, the Bayesian algorithm is used to automatically tune the hyperparameters of the GRU-BiLSTM network, and an anomaly detection model based on Bayesian optimization GRU-BiLSTM (BO-GRU-BiLSTM) is constructed. By effectively exploring the hyperparameter space and finding the best combination of hyperparameters, such as the learning rate, the number of hidden layer units, and the regularization parameter, etc., the prediction accuracy and generalization ability of the model are improved.
[0053] As Figure 2 shown, the method for training and evaluating the anomaly detection model in step 3) is as follows:
[0054] Before using the Bayesian algorithm for hyperparameter selection, it is necessary to clarify the selection range for each hyperparameter to be determined. At the same time, the following key hyperparameters were selected: the number of neuron nodes, the setting of the initial learning rate, the value of the L2 regularization coefficient, the proportion of the dropout factor, the number of learning rate adjustments, and the setting of the learning rate adjustment factor. After optimization, the GRU-BiLSTM model was retrained using the optimized hyperparameters and evaluated on the test set. Three metrics were used to analyze the algorithm performance, namely: Mean Absolute Error (MAE), Mean Absolute Percentage Error (MAPE), and Root Mean Square Error (RMSE). The smaller these three metrics are, the better the prediction accuracy, thus providing more accurate anomaly detection for practical applications.
[0055] MAE is used to measure the difference between the predicted value and the actual value, which can more truly reflect the performance of the model. The calculation process of MAE is shown in Equation (2):
[0056]
[0057] MAPE is used to evaluate the prediction accuracy, making it easier to compare the prediction results of different models. The calculation process of MAPE is shown in Equation (3):
[0058]
[0059] RMSE squares the error. Similar to MAE, it is an absolute error. The calculation process of RMSE is shown in Equation (4):
[0060]
[0061] In Equations (2), (3), and (4), x i is the actual value, y i is the predicted value, and N is the number of samples.
[0062] As Figure 3 shown, the method for using the optimized model to perform anomaly detection on business data in step 4) is as follows:
[0063] The core strategy of Bayesian optimization is to use a surrogate model and an acquisition function to work together to efficiently search for the best hyperparameters. First, a surrogate model is constructed based on some randomly selected initial data points, which is an approximate simulation of the true objective function. Second, the acquisition function is used to locate a potential optimal point on the surrogate model. Finally, the surrogate model is iteratively updated by combining this newly found optimal point and the previously existing data points to more accurately approximate the true objective function. The mathematical expression of this process is shown in Equation (5):
[0064]
[0065] In Equation (5), p(A) is the prior distribution, i.e., the surrogate model distribution; p(B) is the distribution of the observed data B; p(B|A) is the distribution of the observed data B given the surrogate model; p(A|B) is the posterior distribution, i.e., the updated surrogate model distribution.
[0066] The BO-GRU-BiLSTM model is trained using the dataset of the smart city business scenario, and the hyperparameters of the model are tuned through Bayesian optimization to ensure that the model can converge to the optimal state during the training process. After training, the model can be used for prediction to identify potential abnormal behaviors or predict future trends.
[0067] The method for deploying and maintaining the anomaly detection model in step 5) is as follows:
[0068] When deploying the anomaly detection model, in addition to the requirements for processing real-time data streams and batch data, it is also necessary to ensure the stability and security of the system. First, for real-time anomaly detection tasks, the model not only needs to process and analyze data streams in real time, but also needs to ensure low-latency and high-throughput processing capabilities to avoid response delays or data loss caused by insufficient system performance. In this case, using a stream processing platform and an efficient data pipeline can ensure the smooth transmission and processing of data and timely identify potential anomalies.
Claims
1. A method for detecting anomalies in business scenarios of intelligent high-end equipment based on Bayesian optimization algorithm, characterized in that The steps include: Collect relevant data from smart city business scenarios and pre-process the data; Build anomaly detection models for smart city business scenarios; Train and evaluate anomaly detection models; Use the optimized model to detect anomalies in business data; Deploy and maintain anomaly detection models.
2. The method for detecting anomalies in business scenarios of intelligent high-end equipment based on Bayesian optimization algorithm according to claim 1, characterized in that: The method of collecting relevant data from smart city business scenarios and preprocessing the data is as follows: The relevant data of smart city business scenarios are collected from the security data collection and protection module embedded in the controller. The data includes the traffic and logs in the equipment network, as well as the behavior and events of the equipment system. After collection, the data is formed into a data set and the data is normalized. The normalization formula is shown in formula (1): In formula (1), x' k is the normalized data; x k is the data to be normalized; x min is the minimum value of the sample data; x max is the maximum value of the sample data.
3. The method for detecting anomalies in business scenarios of intelligent high-end equipment based on Bayesian optimization algorithm according to claim 2, characterized in that: The method to build an anomaly detection model for smart city business scenarios is as follows: The gating mechanism of the GRU network is used to capture short-term dependencies in the trajectory data. At the same time, the bidirectional structure of the BiLSTM network is combined to effectively extract long-term dependency information, avoiding the limitations of a single model in processing relevant data in complex smart city business scenarios, improving the adaptability to dynamic changes in data, and solving the problems of gradient disappearance and explosion. Afterwards, the Bayesian algorithm is used to automatically tune the hyperparameters of the GRU-BiLSTM network, and a GRU-BiLSTM (BO-GRU-BiLSTM) anomaly detection model based on Bayesian optimization is constructed. By effectively exploring the hyperparameter space and finding the best hyperparameter combination, such as learning rate, number of hidden layer units, and regularization parameters, the prediction accuracy and generalization ability of the model are improved.
4. The method for detecting anomalies in business scenarios of intelligent high-end equipment based on Bayesian optimization algorithm according to claim 3 is characterized in that: The method for training and evaluating anomaly detection models is as follows: Before using the Bayesian algorithm for hyperparameter selection, it is necessary to clarify the selection range for each hyperparameter to be determined. At the same time, the following key hyperparameters are selected: the number of neuron nodes, the setting of the initial learning rate, the value of the L2 regularization coefficient, the ratio of the random inactivation factor, the number of learning rate adjustments, and the setting of the learning rate adjustment factor. After the optimization is completed, the GRU-BiLSTM model is retrained with the optimized hyperparameters and evaluated on the test set. Three indicators are used to analyze the algorithm performance, namely: Mean Absolute Error (MAE), Mean Absolute Percentage Error (MAPE), and Root Mean Square Error (RMSE). The smaller these three indicators are, the better the prediction accuracy is, thus providing more accurate anomaly detection for practical applications. MAE is used to measure the difference between the predicted value and the actual value, which can more truly reflect the performance of the model. The MAE calculation process is shown in formula (2): MAPE is used to evaluate the prediction accuracy, making the prediction results of different models easier to compare. The MAPE calculation process is shown in formula (3): RMSE squares the error and is similar to MAE, which is an absolute error. The RMSE calculation process is shown in formula (4): In formula (2), formula (3) and formula (4), x i is the actual value, y i is the predicted value and N is the number of samples.
5. The method for detecting anomalies in business scenarios of intelligent high-end equipment based on Bayesian optimization algorithm according to claim 4, characterized in that: The method of using the optimized model to detect anomalies in business data is as follows: The core strategy of Bayesian optimization is to use the surrogate model and the acquisition function to work together to efficiently search for the best hyperparameters. First, a surrogate model is constructed based on some randomly selected initial data points. This model is an approximate simulation of the true objective function. Second, a potential optimal point is located on the surrogate model using the acquisition function. Finally, the surrogate model is iteratively updated based on this newly found optimal point and the previously available data points to more accurately approximate the true objective function. The mathematical expression of this process is shown in formula (5): In formula (5), p(A) is the prior distribution, that is, the distribution of the proxy model; p(B) is the distribution of the observed data B; p(B|A) is the distribution of the observed data B given the proxy model; p(A|B) is the posterior distribution, that is, the updated proxy model distribution. The BO-GRU-BiLSTM model is trained using a data set of smart city business scenarios, and the model's hyperparameters are tuned through Bayesian optimization to ensure that the model can converge to the optimal state during the training process. After training, the model can be used for prediction, identification of potential abnormal behaviors, or future trend prediction.
6. The method for detecting anomalies in business scenarios of intelligent high-end equipment based on Bayesian optimization algorithm according to claim 5, characterized in that: The methods for deploying and maintaining anomaly detection models are as follows: When deploying anomaly detection models, in addition to processing real-time data streams and batch data requirements, it is also necessary to ensure the stability and security of the system. First, for real-time anomaly detection tasks, the model not only needs to process and analyze data streams in real time, but also needs to ensure low-latency, high-throughput processing capabilities to avoid response delays or data loss due to insufficient system performance. In this case, the use of a stream processing platform and an efficient data pipeline can ensure smooth data transmission and processing, and identify potential anomalies in a timely manner.