A lightweight method for detecting anomalies in time series data of industrial Internet

Abstract

The present invention relates to a lightweight industrial Internet time series data anomaly detection method, which belongs to the field of network security technology. It includes: performing instance normalization processing on the time series data of each channel of the industrial Internet to obtain normalized multivariate time series data; wherein the multivariate corresponds to multiple channels, and each channel corresponds to each sensor of the industrial Internet; performing segmentation processing on the normalized multivariate time series data, dividing the data of each channel into multiple segments of the same number to obtain multiple time segments; based on the multiple time segments, using a lightweight global segment sharing model to perform time series anomaly detection on the normalized multivariate time series data; the lightweight global segment sharing model is implemented based on the global segment sharing architecture. The present invention significantly reduces the time and space complexity of the industrial Internet time series data anomaly detection algorithm in the prior art, effectively solves the problems of distribution drift and overfitting, and is suitable for promotion in industrial Internet scenarios where resources are limited and detection needs to be performed frequently.

Description

Technical Field

[0001] The present invention relates to the technical field of industrial Internet data analysis, and in particular to a lightweight industrial Internet time series data anomaly detection method. Background Art

[0002] The Industrial Internet integrates communication and sensing technologies to interconnect distributed industrial systems, thereby improving productivity and automation. Due to the inherent sensitivity of industrial processes and the vulnerabilities introduced by the internet, information security has become a significant challenge for Industrial Internet systems to realize their full potential. Anomaly detection, which provides early warning of cyberattacks and system failures, is a key technology in Industrial Internet security. Industrial systems typically deploy a large number of sensors and devices to continuously collect time-series data generated by industrial processes. This data reflects the dynamic state and development trends of the equipment and environment during the industrial process. Therefore, the Industrial Internet security field often uses time-series data anomaly detection technology to identify abnormal patterns and enhance the overall stability and security of Industrial Internet systems.

[0003] Identifying outliers in time series data is a challenging problem due to its temporal nature, volatility, and multidimensionality, as well as the randomness, dynamism, and diversity of anomalies. In recent years, deep learning methods, leveraging their powerful representational learning capabilities, have achieved significantly superior performance compared to traditional statistical and classical machine learning methods. Because outliers in time series data are rare and often masked by a large number of normal points, data labeling is difficult and costly. Unsupervised deep learning-based methods can distinguish outliers by learning normal patterns from all normal data, and therefore have been widely used in anomaly detection in time series data.

[0004] However, existing unsupervised deep learning methods encounter bottlenecks in both computational complexity and detection performance in time series data anomaly detection, which limits their application in industrial Internet scenarios with limited resources and high real-time security requirements.

[0005] On the one hand, the training and inference time of existing models are not enough to adapt to the volatility of the industrial Internet environment and quickly detect anomalies; and due to the privacy issues, time delays and high communication overhead of cloud computing, anomaly detection of industrial Internet time series data should not be carried out through cloud computing centers, but should be implemented on-site or on edge devices. However, the computing resources of on-site or edge devices are limited, and they are unable to cope with the complex calculations required to process the large amount of time series data generated by the industrial Internet system.

[0006] On the other hand, the performance of existing anomaly detection methods is also affected by distribution drift and overfitting. First, distribution drift is very common and significant in Industrial Internet time series data. It refers to the change in data distribution over time. Distribution drift is caused by various factors, such as sensor drift, device fatigue, environmental changes, and other dynamic factors inherent in Industrial Internet systems. Distribution drift can reduce the detection accuracy of deep learning models. Second, Industrial Internet systems typically deploy a large number of sensors and devices, collecting time series data from multiple channels. However, the time series data from all channels originates from the same Industrial Internet system and industrial process, which leads to similar patterns and sharing the same underlying regularities. Furthermore, large amounts of data collected from repetitive industrial processes often have similarities, resulting in data redundancy. These reasons lead traditional methods to use complex models with many parameters to extract temporal information from large-scale, high-dimensional time series data, resulting in overfitting. Therefore, distribution drift and overfitting pose a performance bottleneck for anomaly detection in Industrial Internet time series data. Summary of the Invention

[0007] In view of the above analysis, the present invention aims to disclose a lightweight industrial Internet time series data anomaly detection method, construct a lightweight global fragment sharing model based on the global fragment sharing architecture, and adopt a fine-grained fragment-level global sharing learning method to realize industrial Internet time series data anomaly detection.

[0008] The present invention provides a lightweight industrial Internet time series data anomaly detection method, which specifically includes the following steps:

[0009] Performing instance normalization processing on the time series data of each channel of the industrial Internet to obtain normalized multivariate time series data; the multivariate corresponds to the plurality of channels, and each channel corresponds to a signal source of the time series data of the industrial Internet;

[0010] Segmenting the normalized multivariate time series data, dividing the data of each channel into multiple segments of the same number, and obtaining multiple time segment data of each channel;

[0011] Based on the multiple time segment data of each channel, a lightweight global segment sharing model is used to perform anomaly detection on the normalized multivariate time series data; the lightweight global segment sharing model is based on the global segment sharing architecture, learns segment-level time series feature representation through a time series feature extractor, and is trained based on reconstruction loss.

[0012] Furthermore, the global segment sharing architecture uses the time segment data of each channel as input to train the same shared temporal feature extractor to extract segment-level temporal features.

[0013] Furthermore, the performing anomaly detection on the normalized multivariate time series data using a lightweight global segment sharing model based on the multiple time segment data of each channel includes:

[0014] Taking the time segment data of each channel as input of the lightweight global segment sharing model to obtain output reconstructed data; obtaining the reconstructed data of the normalized multivariate time series data based on the reconstructed data of the time segment data of each channel;

[0015] Calculate the point-level anomaly score at each time point based on the normalized multivariate time series data and the corresponding reconstructed data;

[0016] A time series anomaly detection result of the normalized multivariate time series data is obtained based on the point-level anomaly score.

[0017] Furthermore, obtaining the time series anomaly detection result of the normalized multivariate time series data based on the point-level anomaly score includes:

[0018] Compare the point-level anomaly score with the threshold. If the point-level anomaly score is less than the threshold, the data at that time point is normal; otherwise, the data at that time point is abnormal.

[0019] Furthermore, the point-level anomaly score is calculated as follows:

[0020] ;

[0021] in, is the point-level anomaly score at time point t; is the number of channels; and Channel Original and reconstructed data at time point t.

[0022] Furthermore, the method for constructing the lightweight global fragment sharing model is:

[0023] Performing instance normalization processing on multiple multivariate time series data consisting of normal values ​​to obtain multiple normalized multivariate time series normal data, and constructing a training set based on the multiple normalized multivariate time series normal data;

[0024] Each normalized multivariate time series normal data in the training set is segmented to obtain normal data of time segments of multiple channels corresponding to each normalized multivariate time series normal data;

[0025] Taking the normal data of the time segments of the multiple channels as input to a time series feature extractor, respectively extracting time series features of each segment of each channel, and reconstructing each segment of each channel based on the extracted time series features to obtain corresponding reconstructed data;

[0026] The corresponding reconstruction loss is calculated based on the original segment data of each channel and the corresponding reconstructed data. The network parameters of the temporal feature extractor are iteratively trained based on the reconstruction loss to obtain a trained temporal feature extractor, namely a lightweight global shared segment model.

[0027] Furthermore, the training set includes multiple batches, each batch includes multiple normalized multivariate time series normal data, and each normalized multivariate time series normal data is divided into multi-channel time segment data;

[0028] The network parameters of the temporal feature extractor iteratively trained based on the reconstruction loss include:

[0029] Based on the reconstruction losses, corresponding reconstruction losses of normalized multivariate time series normal data are calculated;

[0030] The reconstruction loss of the batch is calculated based on the reconstruction loss of all normalized multivariate time series normal data in the same batch;

[0031] The network parameters of the temporal feature extractor are iteratively updated based on the reconstruction loss of each batch.

[0032] Furthermore, the reconstruction loss of the normalized multivariate time series normal data obtained by calculating the reconstruction loss based on each of the reconstruction losses includes:

[0033] ;

[0034] in, represents the reconstruction loss of normalized multivariate time series normal data; The number of channels representing normalized multivariate time series normal data; is the number of fragments in each channel; is the number of time points in each segment; and Represents channels respectively No. In the fragment The original fragment data and the corresponding reconstructed data at each time point; Indicates channel No. In the fragment The reconstruction loss at each time point.

[0035] Furthermore, the reconstruction loss of the batch is calculated based on the reconstruction loss of all normalized multivariate time series normal data in the same batch, including:

[0036] ;

[0037] represents the reconstruction loss of the batch; is the number of normalized multivariate time series normal data in this batch.

[0038] Furthermore, the time segment data of each channel is used as input to the lightweight global segment sharing model to obtain the output reconstructed data including:

[0039] ;

[0040] in, For channel No. In the fragment Reconstructed data at each time point; For channel No. In the fragment The original fragment data at each time point; For channel No. The data of the last time point in the segment, For channel No. The number of time points in a segment; and are the weight matrix and bias vector respectively.

[0041] The present invention can achieve at least one of the following beneficial effects:

[0042] By segmenting multivariate time series data and adopting a global segment-sharing architecture that shares network parameters across all channels and time segments, this approach reduces the number of parameters, lowers the model's time and space complexity, significantly reduces computational effort, and avoids overfitting. Model training is performed by calculating the overall loss across all segments across all channels in a fine-grained, segment-level manner, further suppressing distribution drift. This approach enables lightweight anomaly detection for industrial Internet time series data, improving detection efficiency and performance.

[0043] The lightweight global fragment sharing model of the present invention is the first multivariate time series data anomaly detection model that uses only a simple single-layer linear network to extract time features, reconstruct time fragment data and alleviate the overfitting problem.

[0044] Other features and advantages of the present invention will be described in the following description, and some advantages may become apparent from the description or be understood through practice of the present invention. The objectives and other advantages of the present invention can be realized and obtained through the contents particularly pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] The accompanying drawings are only used for the purpose of illustrating specific embodiments and are not to be considered as limiting the present invention. Throughout the drawings, the same reference symbols denote the same components.

[0046] Figure 1 Flow chart of the method of the present invention;

[0047] Figure 2 A diagram comparing the global segment sharing architecture of the present invention with the channel independent architecture and channel hybrid architecture in the prior art;

[0048] Figure 3 FIG. 4 is a comparison diagram of the global segment sharing architecture of the present invention and the channel independent architecture of the prior art. DETAILED DESCRIPTION

[0049] The preferred embodiments of the present invention will be described in detail below in conjunction with the accompanying drawings, wherein the accompanying drawings constitute a part of this application and are used together with the embodiments of the present invention to illustrate the principles of the present invention, and are not used to limit the scope of the present invention.

[0050] An embodiment of the present invention discloses a lightweight industrial Internet time series data anomaly detection method, which specifically includes the following steps:

[0051] S1. Perform instance normalization processing on the time series data of each channel of the Industrial Internet to obtain normalized multivariate time series data; the multivariate corresponds to multiple channels, and each channel corresponds to a signal source of the Industrial Internet, and the signal source includes a sensor or other measurement dimension. It should be noted that all channel data of the Industrial Internet multivariate time series data come from the same industrial process;

[0052] S2. Segmenting the normalized multivariate time series data, dividing the data of each channel into multiple segments of the same number, to obtain time segment data of each channel; wherein the time segment data of each channel includes data of multiple time points;

[0053] S3. Based on the time segment data of each channel, anomaly detection is performed on the normalized multivariate time series data using a lightweight global segment sharing model; the lightweight global segment sharing model is based on a global segment sharing architecture, learns segment-level time series feature representation through a time series feature extractor, and is trained based on reconstruction loss.

[0054] The lightweight global patch sharing model adopts the Global Patch-Shared (GPS) architecture, which aims to learn a patch-level representation (denotes the extraction of temporal features from the input P-dimensional time segments, and reconstructs and outputs P-dimensional reconstructed data based on the extracted temporal features). This representation is shared by all segments across all channels. The global segment sharing architecture uses the segment data from all channels as input to train a shared temporal feature extractor to extract segment-level temporal features. The network parameters of the global shared temporal feature extractor can globally integrate the temporal information of the time segment data from all channels, implicitly capturing the correlation between all time segment data and between channels.

[0055] This embodiment utilizes a lightweight global fragment sharing model and, based on a global fragment sharing architecture, adopts fine-grained fragment-level processing to segment multivariate time series data into time segments of each channel for anomaly detection, thereby reducing the computational complexity of detection and thus shortening the inference detection time, achieving lightweight and high-performance anomaly detection for industrial Internet time series data, capable of coping with the volatility of the industrial Internet environment and quickly discovering and preventing emergencies such as network attacks and system failures.

[0056] In a specific embodiment of the present invention, in step S1, the multivariate time series data with C channels and T timestamps in the industrial Internet is represented as It should be noted that when training the lightweight global fragment sharing model in the method of the present invention and when performing time series anomaly detection based on the model, the number of channels of the industrial Internet is consistent.

[0057] Furthermore, the data of each channel is represented as , ; The calculation method of its normalized data is:

[0058] ;

[0059] in, Indicates that channel c is at timestamp Corresponding normalized data; Indicates the mean of all data in this channel; Indicates the standard deviation of all data in this channel;

[0060] ;

[0061] is the stability factor of the variance, which is a small positive number used to prevent division by zero.

[0062] Normalized multivariate time series data is represented as: , .

[0063] In this embodiment, by applying instance normalization technology to the data of each channel, the influence of the value range between different channels is reduced, the distribution drift is alleviated, the generalization ability of the model is improved, and the model convergence is accelerated.

[0064] In a specific embodiment of the present invention, in step S2, the normalized multivariate time series data is segmented, and the time series data of each channel is divided into multiple segments of the same number (that is, the data of each channel is independently segmented). It should be noted that the data segments in each channel do not overlap with each other.

[0065] Specifically, normalizing multivariate time series data Considered as C independent univariate time series data Split each univariate time series data (i.e., each channel time series data) into N non-overlapping segments , where T=N×P is length, P is the segment size (i.e. the number of time points in the segment), N is the number of segments, express The i-th segment of . Then the normalized multivariate time series data Expressed as .

[0066] In this embodiment, by performing a segmented design on the normalized multivariate time series data, the time series patterns in the normalized multivariate time series data can be locally analyzed and finer details can be extracted. On the one hand, compared with the point-by-point model, this embodiment enhances locality and captures more comprehensive semantic information by aggregating time points into subsequence-level segments. On the other hand, compared with the sequence-level model, the segmented design reduces the input length from T to the segment size P=T / N, thereby reducing the computational complexity quadratically in multiples of N. Therefore, this embodiment adopts a segmented design and utilizes segment analysis to not only retain local time information and achieve finer-grained analysis, but also significantly reduce computational complexity, thereby improving the accuracy and efficiency of sequence data analysis.

[0067] In a specific embodiment of the present invention, step S3 further includes steps S31-S33.

[0068] S31. Use the time segment data of each channel as the input of a lightweight global segment sharing model to obtain output reconstructed data; and obtain the reconstructed data of the normalized multivariate time series data based on the reconstructed data of the time segment data of each channel.

[0069] Specifically, the lightweight global fragment sharing model aims to learn a fragment-level representation f: → , which means that the lightweight global segment sharing model extracts the temporal features of the input P-dimensional time segment data, and reconstructs and outputs P-dimensional reconstructed data based on the extracted temporal features. That is, the time segment data is used as the input of the lightweight global segment sharing model, and the output obtained is the reconstructed data of the original time segment data of each channel. Figure 2 The "Global Segment Sharing Architecture" (network parameters shared across all channels) in the upper left center diagram illustrates the architecture of the lightweight global segment sharing model of our invention. In this architecture, each segment (N segments per channel) in each channel (C channels total) is taken as input, mapped into a shared embedding space, and then reconstructed into a single segment. It should be noted that the computational complexity of the lightweight global segment sharing model is independent of the number of channels and sequence length.

[0070] Specifically, the lightweight global fragment sharing model adopts the strategy of subtracting the value of the last time point from the value of each time point in the original fragment, and applies it locally to each fragment, that is, in the fragment Subtract the last data of the segment from each time point , expressed as:

[0071] ;

[0072] in, express the i-th fragment of ; For channel No. In the fragment Data at a point in time, For channel No. The number of time points in a segment.

[0073] Further, fragment ) is passed through a linear layer to learn the shared representation of the fragments, expressed as:

[0074] ;

[0075] in, and denote the weight matrix and bias vector of the linear layer respectively.

[0076] Furthermore, the part to be subtracted Add back To reconstruct the original fragment, channel No. In the fragment The reconstructed data at each time point is expressed as:

[0077] ;

[0078] Channel No. fragments The reconstructed data is .

[0079] Furthermore, the reconstructed data of the normalized multivariate time series data is obtained based on the reconstructed data of the original segment data of each channel.

[0080] Specifically, each channel of the reconstructed data Z of the normalized multivariate time series data is the concatenation of all fragments in the cth channel, so the reconstructed data of this channel can be expressed as ,Right now .

[0081] S32. Calculate the point-level anomaly score for each time point based on the normalized multivariate time series data and the corresponding reconstructed data.

[0082] The point-level anomaly score is calculated as follows:

[0083] ;

[0084] in, is the point-level anomaly score at time point t; is the number of channels; and Channel Original and reconstructed data at time point t.

[0085] S33: Obtaining a time series anomaly detection result of the normalized multivariate time series data based on the point-level anomaly score. Specifically comprising:

[0086] The point-level anomaly score is compared with a threshold δ. If the point-level anomaly score is less than the threshold δ, the data at that time point is normal; otherwise, the data at that time point is abnormal. The threshold δ is determined based on empirical rules.

[0087] In step S3, by filtering out local fluctuations in each segment based on a lightweight global segment sharing model, it helps to alleviate the distribution drift in each segment and effectively extract the intrinsic timing pattern of the time series data.

[0088] The lightweight global fragment sharing model described in this embodiment significantly reduces the time and space complexity of lightweight time series anomaly detection in the industrial Internet, by adopting a "global fragment sharing architecture" (such as Figure 2(As shown in the upper left of the figure), although the correlation between the time segments of each channel is not explicitly expressed, the time series information from all time segments can be globally integrated. This global processing implicitly captures the correlation between time segments and channels, reducing the number of parameters and model complexity. Because all channels of multivariate time series data for the Industrial Internet come from the same industrial process, the univariate time series data of each channel exhibits potential consistency. This makes the channel-independent strategy adopted in this embodiment reasonable for anomaly detection in Industrial Internet time series data, and achieves low time and space complexity.

[0089] In a specific embodiment of the present invention, the method for constructing the lightweight global fragment sharing model is:

[0090] Performing instance normalization processing on multiple multivariate time series data consisting of normal values ​​to obtain multiple normalized multivariate time series normal data, and constructing a training set based on the multiple normalized multivariate time series normal data;

[0091] Each normalized multivariate time series normal data in the training set is segmented to obtain multiple segment-level multivariate time series normal data corresponding to each normalized multivariate time series normal data;

[0092] Using the segment-level multivariate time series normal data as the input of the NLinear network, respectively extracting the time series features of the segment data of each channel, and reconstructing the segment data of each channel based on the extracted time series features to obtain corresponding reconstructed data;

[0093] The corresponding reconstruction loss is calculated based on the original segment data of each channel and the corresponding reconstructed data. The NLinear network parameters are iteratively trained based on the reconstruction loss to obtain a trained NLinear network, i.e., a lightweight global shared segment model.

[0094] Furthermore, the training set includes multiple batches, each batch includes multiple normalized multivariate time series normal data, and each normalized multivariate time series normal data corresponds to multiple segment-level multivariate time series normal data.

[0095] Furthermore, the iterative training of NLinear network parameters based on the reconstruction loss includes:

[0096] Based on the above reconstruction losses, the corresponding reconstruction loss of normalized multivariate time series normal data is calculated as follows: ;

[0097] in, represents the reconstruction loss of normalized multivariate time series normal data; The number of channels representing normalized multivariate time series normal data; is the number of fragments in each channel; is the number of time points in each segment; and Represents channels respectively No. In the fragment The original fragment data and the corresponding reconstructed data at each time point; Indicates channel No. In the fragment The reconstruction loss at each time point;

[0098] The reconstruction loss of the batch is calculated based on the reconstruction loss of all normalized multivariate time series normal data in the same batch. ,in represents the reconstruction loss of the batch; is the number of normalized multivariate time series normal data in this batch;

[0099] With the goal of smaller reconstruction loss, the NLinear network parameters are iteratively updated based on the reconstruction loss of each batch until the convergence condition (preset convergence value or maximum number of iterations) is reached, and a trained NLinear network is obtained.

[0100] This embodiment addresses the problem of unsupervised anomaly detection in time series data by using a training set consisting solely of normal points. This addresses the difficulty of data labeling in time series data, which is often caused by the scarcity of anomalies and their masking by a large number of normal points. By employing a global fragment sharing architecture where network parameters are shared across all channels, this approach avoids the overfitting problem that often occurs when traditional methods use complex models with many parameters to extract temporal information from large-scale, high-dimensional time series data. By subtracting the last value from each fragment, local fluctuations within each fragment are filtered out, effectively mitigating the impact of distribution drift.

[0101] This embodiment reduces the complexity of the model by adopting a global patch-shared architecture (GPS) in which each channel's data shares network parameters. As mentioned above, the "global patch-shared architecture" is an architecture in which each channel's data shares network parameters.

[0102] The following compares the lightweight global fragment sharing model (LGPAD) of the present invention with the channel-mixing architecture (CM) and channel-independent architecture (CI) in the prior art to further illustrate the beneficial effects of the present invention.

[0103] Specifically, in the channel hybrid architecture, all channels are treated as a whole. The features of all channels are taken as input and projected into a hybrid embedding space to capture the relationship between all channels. The method based on the channel hybrid architecture aims to learn a mapping , which typically leads to high dimensionality and complexity. The computational complexity of methods based on channel mixing architectures increases with the number of channels C and the time length T of the multivariate time series data. This inherent complexity can pose significant challenges to real-time and resource-constrained application scenarios.

[0104] Specifically, the channel-independent architecture transforms multivariate time series data Each channel is considered as a separate univariate time series data , and independently project each channel into a shared channel-specific embedding space. The temporal feature extractors of all channels share the same weights, which enables the channel-independent architecture to reduce the complexity of the model. Studies have shown that channel-independent architectures exhibit higher robustness than channel-mixed architectures when dealing with distribution shifts in real-world non-stationary time series data. Channel-independent methods aim to learn a mapping function The complexity of the channel-independent approach increases with the length T of the multivariate time series data, but remains constant regardless of the number of channels.

[0105] Specifically, the global fragment sharing architecture adopted by the lightweight global fragment sharing model of the present invention significantly reduces the model complexity compared with the channel hybrid architecture and channel independent architecture. The input of the lightweight global fragment sharing model is the fragment , which has lower input dimensions than models based on channel-mixed and channel-independent architectures. This reduction in input dimensionality enables the lightweight global fragment sharing model based on global fragment sharing to use a simpler network as a temporal feature extractor, while increasing the number of learning samples to avoid overfitting. Furthermore, the global fragment sharing architecture leverages fragment-level representations to enhance local semantic information in fragments and improves model robustness by mitigating distribution drift.

[0106] Table 1 shows a comparison of the computational complexity of using NLinear to extract timing features under the channel hybrid architecture, channel independent architecture, and global fragment sharing architecture:

[0107] Table 1 Computational complexity analysis of linear models under channel hybrid architecture, channel independent architecture, and global fragment sharing architecture

[0108]

[0109] As can be seen from Table 1, when using NLinear to extract time series features, for input :

[0110] The NLinear weights based on the global fragment sharing architecture are and , whose parameters are , FLOPs is ;

[0111] The network weights of NLinear based on channel-independent architecture are and , the parameter is , FLOPs is ;

[0112] The NLinear network weights based on the channel hybrid architecture are and , the parameter is , FLOPs is .

[0113] Our lightweight global fragment sharing model reduces time complexity by 3 to 5 orders of magnitude and space complexity by 3 to 6 orders of magnitude compared to other architectures. Compared to baseline methods with millions of parameters, the lightweight global fragment sharing model with only 20 parameters improves the average F1 score by at least 2.80%.

[0114] like Figure 2 , is a comparison chart of the computational complexity of the global fragment sharing architecture, channel independent architecture, and channel hybrid architecture. The diagram below each architecture in the figure corresponds to the data input dimension of the corresponding architecture. The diagram more intuitively shows the computational complexity comparison analyzed in Table 1. Figure 3 Comparison between the lightweight global fragment sharing model of the global fragment sharing architecture of the present invention and the linear model of the channel independent architecture (the reversible feature normalization part is omitted).

[0115] In the global fragment sharing architecture, data blocks across all channels share the same model weights and are embedded independently. Experimental results demonstrate that this architecture further reduces the number of parameters compared to the channel-independent architecture. By treating each data block as an independent input, the global fragment sharing architecture constructs a simpler time series feature extraction network. This not only reduces model complexity but also increases the number of effective learning samples. Combined with the simplicity of NLinear, it effectively mitigates the overfitting problem in time series anomaly detection in the Industrial Internet of Things.

[0116] To address distribution drift, the loss function of the channel-mixing architecture model calculates the overall loss across all channels. The summation operation used in the channel-independent architecture mitigates distribution drift. The global fragment sharing architecture, on the other hand, calculates the overall loss across all data blocks in all channels at a more granular level, further suppressing distribution drift.

[0117] Compared to models based on hybrid channel architecture and independent channel architecture, the lightweight global fragment sharing model of this invention significantly reduces the time and space complexity of lightweight time series anomaly detection for the Industrial Internet. Through the synergy between the global fragment sharing architecture and the NLinear network, the lightweight global fragment sharing model of this invention performs well in addressing distribution drift and overfitting problems. It is particularly suitable for Industrial Internet scenarios with limited resources and the need for frequent real-time detection, and can provide fast and accurate responses for time series anomaly detection.

[0118] It should be noted that the above embodiments are based on the same inventive concept, and parts not described repeatedly can be used as reference for each other.

[0119] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by any technician familiar with this technical field within the technical scope disclosed by the present invention should be covered by the scope of protection of the present invention.

Claims

1. A lightweight industrial Internet time series data anomaly detection method, characterized by: The steps include: Performing instance normalization processing on the time series data of each channel of the industrial Internet to obtain normalized multivariate time series data; the multivariate corresponds to the plurality of channels, and each channel corresponds to a signal source of the industrial Internet time series data; The normalized multivariate time series data is segmented and the data of each channel is divided into multiple segments of the same number to obtain multiple time segment data of each channel; including: Considered as C independent univariate time series data ; Split each of the univariate time series data into N non-overlapping segments , where T=N×P is length, P is the fragment size, N is the number of fragments, express The ith segment of ; each of the single variable time series data is the time series data of each channel; Based on the multiple time segment data of each channel, a lightweight global segment sharing model is used to perform anomaly detection on the normalized multivariate time series data; the lightweight global segment sharing model is based on a global segment sharing architecture, learns segment-level time series feature representation through a time series feature extractor, and is trained based on reconstruction loss; the global segment sharing architecture uses the time segment data of each channel to As input, we train the same shared temporal feature extractor to extract segment-level temporal features. express The i-th fragment of ; For channel No. In the fragment Data at a point in time, For channel No. The number of time points in a segment.

2. The lightweight industrial Internet time series data anomaly detection method according to claim 1 is characterized in that: The performing anomaly detection on the normalized multivariate time series data using a lightweight global segment sharing model based on the multiple time segment data of each channel includes: Taking the time segment data of each channel as input of the lightweight global segment sharing model to obtain output reconstructed data; obtaining reconstructed data of the normalized multivariate time series data based on the reconstructed data of the time segment data of each channel; Calculate the point-level anomaly score at each time point based on the normalized multivariate time series data and the corresponding reconstructed data; A time series anomaly detection result of the normalized multivariate time series data is obtained based on the point-level anomaly score.

3. The lightweight industrial Internet time series data anomaly detection method according to claim 2 is characterized in that: The step of obtaining the time series anomaly detection result of the normalized multivariate time series data based on the point-level anomaly score includes: The point-level anomaly score of each time point is compared with the threshold. If the point-level anomaly score is less than the threshold, the data at the corresponding time point is normal; otherwise, the data at the time point is abnormal.

4. The lightweight industrial Internet time series data anomaly detection method according to claim 3 is characterized in that: The point-level anomaly score is calculated as follows: ； in, is the point-level anomaly score at time point t; is the number of channels; and Channel Original and reconstructed data at time point t.

5. The lightweight industrial Internet time series data anomaly detection method according to any one of claims 2 to 4, characterized in that: The method for constructing the lightweight global fragment sharing model is: Performing instance normalization processing on multiple multivariate time series data consisting of normal values ​​to obtain multiple normalized multivariate time series normal data, and constructing a training set based on the multiple normalized multivariate time series normal data; Each normalized multivariate time series normal data in the training set is segmented to obtain normal data of time segments of multiple channels corresponding to each normalized multivariate time series normal data; Taking the normal data of the time segments of the multiple channels as input to a time series feature extractor, respectively extracting time series features of each segment of each channel, and reconstructing each segment of each channel based on the extracted time series features to obtain corresponding reconstructed data; The corresponding reconstruction loss is calculated based on the original segment data of each channel and the corresponding reconstructed data. The network parameters of the temporal feature extractor are iteratively trained based on the reconstruction loss to obtain a trained temporal feature extractor, namely a lightweight global shared segment model.

6. The lightweight industrial Internet time series data anomaly detection method according to claim 5 is characterized in that: The training set includes multiple batches, each batch includes multiple normalized multivariate time series normal data, and each normalized multivariate time series normal data is divided into multi-channel time segment data; The network parameters of the temporal feature extractor iteratively trained based on the reconstruction loss include: Based on the reconstruction losses, corresponding reconstruction losses of normalized multivariate time series normal data are calculated; The reconstruction loss of the batch is calculated based on the reconstruction loss of all normalized multivariate time series normal data in the same batch; The network parameters of the temporal feature extractor are iteratively updated based on the reconstruction loss of each batch.

7. The lightweight industrial Internet time series data anomaly detection method according to claim 6 is characterized in that: The corresponding normalized multivariate time series normal data reconstruction loss calculated based on each reconstruction loss includes: ； in, represents the reconstruction loss of normalized multivariate time series normal data; The number of channels representing normalized multivariate time series normal data; is the number of fragments in each channel; is the number of time points in each segment; and Represents channels No. In the fragment The original fragment data and the corresponding reconstructed data at each time point; Indicates channel No. In the fragment The reconstruction loss at each time point.

8. The lightweight industrial Internet time series data anomaly detection method according to claim 7 is characterized in that: The reconstruction loss of the batch is calculated based on the reconstruction loss of all normalized multivariate time series normal data in the same batch, including: ； represents the reconstruction loss of the batch; is the number of normalized multivariate time series normal data in this batch.

9. The lightweight industrial Internet time series data anomaly detection method according to claim 3 is characterized in that: The time segment data of each channel is used as the input of the lightweight global segment sharing model to obtain the output reconstructed data including: ； in, For channel No. In the fragment Reconstructed data at each time point; For channel No. In the fragment The original fragment data at each time point; For channel No. The data of the last time point in the segment, For channel No. The number of time points in a segment; and are the weight matrix and bias vector respectively.

Images