Equipment anomaly detection method based on deep learning

Abstract

The invention discloses an equipment anomaly detection method based on deep learning, and relates to the field of equipment anomaly detection. The method comprises the following steps: acquiring and preprocessing original sensor data, and generating an equipment data vector; constructing a self-adaptive multi-dimensional time sequence self-error correction convolutional network, and carrying out equipment anomaly detection based on the equipment data vector; in the adaptive multi-dimensional time sequence self-error correction convolutional network, generating a comprehensive state vector by adopting an adaptive time window adjustment mechanism and a time weighted fusion mechanism; performing feature extraction on the comprehensive state vector to obtain a final feature, further calculating an initial abnormal score, and correcting the initial abnormal score by adopting a self-error correction mechanism in a self-adaptive multi-dimensional time sequence self-error correction convolutional network to obtain a final abnormal score; and performing anomaly judgment based on the final anomaly score. The problems that a traditional equipment anomaly detection method cannot effectively cope with the dynamic change of the equipment state and is easily influenced by equipment data fluctuation are solved.

Description

Technical Field

[0001] The present invention relates to the field of device anomaly detection, and particularly to a device anomaly detection method based on deep learning. Background Art

[0002] With the continuous development of industrial automation and intelligent manufacturing, device fault detection technology has become one of the key technologies to ensure production safety, improve device operation efficiency, and extend device lifespan. Traditional device anomaly detection methods mostly rely on rule-based monitoring systems, usually diagnosing faults by setting thresholds or using expert experience methods. These methods are applicable to some simple scenarios, but with the increasing complexity of the device operation environment, the limitations of traditional device anomaly detection methods gradually emerge. In recent years, the rise of deep learning technology has provided new solutions for device anomaly detection. Deep learning models, especially convolutional neural networks (CNNs), long short-term memory networks (LSTMs), etc., can automatically learn more complex feature representations from massive device data, effectively improving the early warning ability of device faults. By processing a large amount of time-series data and extracting high-level features, deep learning methods have shown great potential in anomaly detection and can better adapt to complex change patterns during device operation. With the continuous development and optimization of deep learning technology, its application prospect in device anomaly detection is becoming increasingly wide, and it has become an important part of modern device management and maintenance.

[0003] However, there are multiple problems in the actual application of existing device anomaly detection technologies. For example, they cannot effectively cope with the dynamic changes of device states, lack flexibility in adapting to device state changes, and are prone to false alarms or missed alarms. Therefore, existing device anomaly detection technologies face great challenges in terms of real-time performance, accuracy, and response ability when dealing with anomaly detection in a large-scale device monitoring environment. Summary of the Invention

[0004] The present invention provides a device anomaly detection method based on deep learning to solve the problem that traditional device anomaly detection methods usually use a fixed time window to process device data, resulting in the inability to effectively cope with the dynamic changes of device states; when the device state fluctuates greatly, the fixed time window cannot capture enough historical device data, causing information loss, and when the device state is stable, the computing resources are seriously wasted, affecting the detection efficiency; it also solves the problem that in feature extraction, it often relies on manual design or fixed rules, making it difficult to automatically capture the non-linear changes during device operation and lacking flexibility in adapting to device state changes; and the problem that many deep learning-based anomaly detection methods are easily affected by device data fluctuations, resulting in frequent false alarms or missed alarms, especially when there are local fluctuations during device operation, leading to a decrease in the accuracy of anomaly judgment, thus affecting the robustness and reliability of device anomaly detection.

[0005] A device anomaly detection method based on deep learning according to the present invention includes the following steps:

[0006] S1: Obtain and preprocess the original sensor data to generate device data vectors; construct an adaptive multi-dimensional time series self-correcting convolutional network, and perform device anomaly detection based on the device data vectors; in the adaptive multi-dimensional time series self-correcting convolutional network, adopt an adaptive time window adjustment mechanism and a time-weighted fusion mechanism to generate a comprehensive state vector;

[0007] S2: Extract features from the comprehensive state vector to obtain the final features;

[0008] S3: Calculate the initial anomaly score based on the final features, and use the self-correcting mechanism in the adaptive multi-dimensional time series self-correcting convolutional network to correct the initial anomaly score to obtain the final anomaly score; perform anomaly judgment based on the final anomaly score.

[0009] Preferably, the S1 specifically includes:

[0010] The network structure of the adaptive multi-dimensional time series self-correcting convolutional network consists of an input layer, a feature fusion layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer.

[0011] Preferably, the S1 specifically includes:

[0012] The input layer receives the device data vectors; the feature fusion layer uses the adaptive time window adjustment mechanism and the time-weighted fusion mechanism to perform weighted fusion on the device data vectors to generate a comprehensive state vector.

[0013] Preferably, the S1 specifically includes:

[0014] The adaptive time window adjustment mechanism extracts features by adaptively adjusting the size of the time window; according to the size of the time window at the current moment, select the device data vectors at the current moment and within a period of time in the past, and generate the comprehensive state vector of the device through the time-weighted fusion mechanism; the calculation formula of the comprehensive state vector is as follows:

[0015]

[0016] Among them, f(t) is the comprehensive state vector; t represents the current moment; t′ is the moment index variable; represents the range of the time window; is the size of the time window at the t moment; exp is the exponential function; τ is the decay factor; x(t′) is the device data vector at the t′ moment.

[0017] Preferably, the S2 specifically includes:

[0018] The comprehensive state vector is successively passed through a convolutional layer, a pooling layer, and a fully connected layer for feature extraction to obtain the final features, which are used to calculate the anomaly probability of the device.

[0019] Preferably, the S2 specifically includes:

[0020] The convolutional layer is used to process the comprehensive state vector to extract the feature map of the comprehensive state vector; the pooling layer downsamples the feature map output by the convolutional layer to obtain the pooled feature map; the fully connected layer flattens the pooled feature map into a one-dimensional vector and performs feature learning through two or more neural network layers, and the output of the last fully connected layer is used as the final feature and input to the output layer for processing.

[0021] Preferably, the S3 specifically includes:

[0022] The output layer performs anomaly detection based on the final features, and calculates the initial anomaly score through the sigmoid activation function and logarithmic smoothing operation.

[0023] Preferably, the S3 specifically includes:

[0024] The formula for calculating the final anomaly score is as follows:

[0025]

[0026] Where, is the final anomaly score at time t; y(t) is the initial anomaly score at time t; μ y is the mean of the historical initial anomaly scores; σ y is the standard deviation of the historical initial anomaly scores; λ is the self-correction coefficient; is a constant to prevent zero values in the operation.

[0027] Preferably, the S3 specifically includes:

[0028] Set the anomaly threshold. When the final anomaly score exceeds the anomaly threshold, it is determined that the device is in an abnormal state, the alarm mechanism is triggered, and relevant personnel are notified for fault diagnosis and handling; when the final anomaly score does not exceed the anomaly threshold, it is determined that the device is operating normally, and the device status is continuously monitored.

[0029] The beneficial effects of the technical solution of the present invention are:

[0030] 1. Through the adaptive time window adjustment mechanism and the time-weighted fusion mechanism, the size of the time window and the weight of the time-weighted fusion mechanism are dynamically adjusted, reducing unnecessary consumption of computing resources and optimizing the device response time. It can not only improve the real-time performance of device monitoring, discover potential fault hazards in a timely manner, but also effectively reduce the operating cost, and is especially suitable for application in large-scale device monitoring environments.

[0031] 2. Through multi-level feature extraction of convolutional layers, pooling layers, and fully connected layers, the key information of the device's comprehensive state vector is effectively extracted. In the convolution operation, a time decay factor is introduced to dynamically adjust the influence degree at each moment according to the time difference, enabling the adaptive multi-dimensional time series self-correcting convolutional network to flexibly respond to device state changes, more precisely capture the key change features in the device state, and thus improve the accuracy and timeliness of anomaly detection.

[0032] 3. By introducing a self-correcting mechanism to correct the initial anomaly score, the error in the anomaly judgment process can be effectively reduced. The final anomaly score at the current moment is dynamically adjusted according to the mean and standard deviation of the historical initial anomaly scores, avoiding misjudgment caused by local anomaly fluctuations, making the device anomaly detection more robust and reliable, capable of more accurately identifying device failures, reducing false alarms and missed alarms, and further enhancing the emergency response ability. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 It is a flowchart of a device anomaly detection method based on deep learning according to the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0034] In order to further elaborate on the technical means and effects adopted by the present invention to achieve the predetermined invention purpose, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0035] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present invention belongs.

[0036] The following specifically describes the specific solution of a device anomaly detection method based on deep learning provided by the present invention in conjunction with the accompanying drawings.

[0037] Refer to the attached Figure 1 , which shows a flowchart of a device anomaly detection method based on deep learning provided by an embodiment of the present invention. The method includes the following steps:

[0038] S1: Obtain and preprocess the original sensor data to generate a device data vector; construct an adaptive multi-dimensional time series self-correcting convolutional network, and perform device anomaly detection based on the device data vector; in the adaptive multi-dimensional time series self-correcting convolutional network, an adaptive time window adjustment mechanism and a time-weighted fusion mechanism are used to generate a comprehensive state vector.

[0039] First, collect the original sensor data at the same moment, such as temperature, humidity, vibration, pressure, etc. Preprocess the original sensor data. Through noise removal and normalization, obtain the sensor data and form a device data vector. Each component of the device data vector represents different sensor data.

[0040] Construct an adaptive multi-dimensional time series self-correcting convolutional network and perform device anomaly detection based on the device data vector. The adaptive multi-dimensional time series self-correcting convolutional network adopts an adaptive time window adjustment mechanism, a time-weighted fusion mechanism, and a self-correcting mechanism to enhance the adaptability to device state fluctuations.

[0041] The network structure of the adaptive multi-dimensional time series self-correcting convolutional network consists of an input layer, a feature fusion layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer. The network training process follows the existing deep learning model training process and uses existing technologies, such as the gradient descent algorithm and the backpropagation algorithm, etc., to optimize the optimizable parameters of the adaptive multi-dimensional time series self-correcting convolutional network, such as the weights and bias terms of the convolutional layer, etc.

[0042] Specifically, the input layer receives the device data vector; the feature fusion layer uses the adaptive time window adjustment mechanism and the time-weighted fusion mechanism to perform weighted fusion on the device data vector and generate a comprehensive state vector.

[0043] The adaptive time window adjustment mechanism uses a dynamically adjusted time window size to capture the behavior patterns of the device at different time scales. Based on the volatility of the historical device data vectors taken from the database, the size of the time window is adaptively adjusted, so that a larger time window can be used for feature extraction when the device state fluctuates greatly, and a smaller time window can be used for feature extraction when the device state is relatively stable, in order to avoid information loss while optimizing the calculation efficiency.

[0044] The specific formula for the time window size is as follows:

[0045]

[0046] where is the time window size at time t; t is the time index variable representing the current time; round represents the rounding operation, which is used to make become an integer; is the minimum time window size, representing the lower limit of the time window size, which is set according to the specific implementation scenario; is the adjustment coefficient of the device data vector, which is used to control the influence intensity of volatility on the time window adjustment and is set according to the specific implementation scenario; T is the length of the historical time window, which is used to calculate the number of historical device data vectors selected within the time window and is set according to the specific implementation scenario; d is the dimension of the device data vector, which is set according to the specific implementation scenario; ζ is the dimension index variable of the device data vector; x ζ (t) is the value of the device data vector at the ζ-th dimension at time t; and are the mean and standard deviation of the historical sensor data corresponding to the ζ-th dimension of the historical device data vector at time t, which are calculated based on the length of the historical time window.

[0047] According to the size of the time window at the current moment, the device data vectors at the current moment and in the past period are selected, and through the time-weighted fusion mechanism, the comprehensive state vector of the device is generated. The weight of the time-weighted fusion mechanism is dynamically adjusted according to the time difference between the historical moment and the current moment, and is calculated using an exponential function. The closer the time is, the greater the weight.

[0048] The calculation formula of the comprehensive state vector is as follows:

[0049]

[0050] where f(t) is the comprehensive state vector; t′ is the time index variable; represents the range of the time window, and the time index variable t′ must fall within the range defined by the moment and the current moment t; exp is the exponential function; τ is the decay factor, which is used to control the decay speed of time weighting and is determined by the expert experience method; x(t′) is the device data vector at time t′.

[0051] S2: Feature extraction is performed on the comprehensive state vector to obtain the final features.

[0052] Feature extraction operations are performed on the comprehensive state vector. Specifically, the comprehensive state vector is sequentially passed through the convolutional layer, pooling layer, and fully connected layer for feature extraction to obtain the final features, which are used to calculate the anomaly probability of the device. The specific process is as follows:

[0053] The convolutional layer is used to process the comprehensive state vector to extract the feature map of the comprehensive state vector. The convolution operation formula is:

[0054]

[0055] Among them, h(t) is the output of the convolutional layer, representing the feature map obtained through the convolutional operation at time t; t is the time index variable; k is the size of the convolutional kernel, representing the neighborhood length of the comprehensive state vector considered in the convolutional operation, which is set according to the specific implementation scenario; i is the index variable in the convolutional operation, representing the position where the convolutional kernel is applied; w i is the weight of the i-th convolutional kernel, which is an optimizable parameter; f(t + i - 1) is the comprehensive state vector at time t + i - 1; α is the time decay adjustment coefficient, used to control the intensity of the time decay factor, which is set according to the specific implementation scenario; exp(-α·|t - (t + i - 1)|) is the time decay factor, which dynamically adjusts the influence degree of each moment through the exponential decay function according to the distance between moments; b is the bias term, representing the bias parameter in the convolutional layer, used to adjust the output of the convolutional layer, which is an optimizable parameter.

[0056] The pooling layer downsamples the feature map output by the convolutional layer. Using max pooling, the feature map output by the convolutional layer is divided into multiple regions, such as 2×2 or 3×3 regions, and the region size is set according to the specific implementation scenario. The maximum value in each region is selected as the output feature of the region, and finally a pooled feature map is formed.

[0057] The fully connected layer flattens the pooled feature map into a one-dimensional vector and performs feature learning through multiple neural network layers. Each neural network layer uses an activation function for non-linear transformation to learn the global device state, thereby making accurate anomaly judgments.

[0058] The formula of the fully connected layer is as follows:

[0059]

[0060] Among them, a [l] is the output of the l-th layer of the fully connected layer, and the initial value a [0] is the pooled feature map; l is the layer index of the fully connected layer, representing the number of a certain layer in the fully connected layer, and the value range is from 1 to L, where L is the total number of layers of the fully connected layer, which is set according to the specific implementation scenario; is the activation function, used to introduce non-linear factors. Common activation functions include ReLU, Sigmoid, Tanh, etc., which are set according to the specific implementation scenario; W [l] is the weight matrix of the l-th layer of the fully connected layer, which is an optimizable parameter; a [l-1] is the output of the (l - 1)-th layer of the fully connected layer; is the matrix addition operation; ⊙ is the element-wise multiplication operation; ||·|| is used to calculate the L2 norm; is the bias term of the l-th layer of the fully connected layer, which is an optimizable parameter; ∈ is a constant. To prevent the denominator from being 0, it can take 10 -6 .

[0061] The output of the last fully connected layer is used as the final feature and input to the output layer for processing.

[0062] S3: Calculate the initial anomaly score based on the final feature, and use the self-correction mechanism in the adaptive multi-dimensional time series self-correcting convolutional network to correct the initial anomaly score to obtain the final anomaly score; perform anomaly judgment based on the final anomaly score.

[0063] The output layer performs anomaly detection based on the final feature and calculates the initial anomaly score. The initial anomaly score is calculated based on the features output by the last fully connected layer through a sigmoid activation function and logarithmic smoothing operation, and is a probability value used to measure whether the current state of the device is abnormal. The specific calculation formula for the initial anomaly score is:

[0064]

[0065] where y(t) is the initial anomaly score at time t, which is a probability value in the range [0, 1]; Sigmoid is the activation function used to transform the initial anomaly score into the range [0, 1]; a [L] is the output of the last fully connected layer, that is, the final feature; the logarithmic term is used to smooth the output of the last fully connected layer; ||·|| is used to calculate the L2 norm; is a constant to prevent zero values in the operation and is set according to the specific implementation scenario.

[0066] To achieve more accurate anomaly detection, a self-correction mechanism is introduced to correct the initial anomaly score to obtain the final anomaly score. The time range for the self-correction mechanism is set according to the specific implementation scenario. Within this time range, the mean and standard deviation of the historical initial anomaly scores are calculated according to the calculation formula of the initial anomaly score. The self-correction mechanism corrects the initial anomaly score by dynamically adjusting the current initial anomaly score and the deviation adjustment term, thereby improving the accuracy of device anomaly detection.

[0067] The formula for calculating the final anomaly score is as follows:

[0068]

[0069] where is the corrected anomaly score, which is the final anomaly score at time t; y(t) is the initial anomaly score at time t; μ y is the mean of the historical initial anomaly scores; σ yis the standard deviation of the historical initial anomaly scores, representing the degree of fluctuation of the historical initial anomaly scores; λ is the self-correction coefficient, used to control the influence degree of the deviation adjustment term on the adjustment of the current anomaly score, and is set according to the expert experience method; is the deviation adjustment term; is a constant to prevent zero values in the operation and is set according to the specific implementation scenario.

[0070] Set the anomaly threshold according to the specific implementation scenario. The anomaly threshold is adjusted according to the characteristics of different devices and monitoring environments to ensure the accuracy of anomaly detection. When the final anomaly score exceeds the anomaly threshold, it is determined that the device is in an abnormal state, the alarm mechanism is triggered, and relevant personnel are notified for further fault diagnosis and handling. At the same time, according to the specific application scenario, emergency response measures are initiated, such as adjusting the device operation mode, automatically shutting down or starting the standby device, etc. If the final anomaly score does not exceed the anomaly threshold, it is determined that the device is operating normally, and the device status is continuously monitored.

[0071] In summary, a device anomaly detection method based on deep learning is completed.

[0072] The order of the invention embodiments is only for description and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0073] Each embodiment in this specification is described in a progressive manner. The same or similar parts between each embodiment can be referred to each other, and the key point of each embodiment is to illustrate the differences from other embodiments.

[0074] The above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements for some of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of each embodiment of the present invention, and should all be included in the protection scope of the present invention.

Claims

1. A device anomaly detection method based on deep learning, characterized in that, It includes the following steps: S1: Obtain and preprocess the original sensor data to generate a device data vector; construct an adaptive multi-dimensional time series self-correcting convolutional network, and perform device anomaly detection based on the device data vector; in the adaptive multi-dimensional time series self-correcting convolutional network, adopt an adaptive time window adjustment mechanism and a time-weighted fusion mechanism to generate a comprehensive state vector; S2: Extract features from the comprehensive state vector to obtain the final features; S3: Calculate the initial anomaly score based on the final features, and use the self-correcting mechanism in the adaptive multi-dimensional time series self-correcting convolutional network to correct the initial anomaly score to obtain the final anomaly score; Perform anomaly judgment based on the final anomaly score.

2. The device anomaly detection method based on deep learning according to claim 1, wherein The specific content of S1 includes: The network structure of the adaptive multi-dimensional time series self-correcting convolutional network consists of an input layer, a feature fusion layer, a convolutional layer, a pooling layer, a fully connected layer, and an output layer.

3. The method for device anomaly detection based on deep learning according to claim 2, wherein The specific content of S1 includes: The input layer receives the device data vector; the feature fusion layer uses the adaptive time window adjustment mechanism and the time-weighted fusion mechanism to perform weighted fusion on the device data vector to generate a comprehensive state vector.

4. The method for device anomaly detection based on deep learning according to claim 3, wherein The specific content of S1 includes: The adaptive time window adjustment mechanism extracts features by adaptively adjusting the size of the time window; according to the size of the time window at the current moment, select the device data vectors at the current moment and in the past period of time, and generate the comprehensive state vector of the device through the time-weighted fusion mechanism; the calculation formula of the comprehensive state vector is as follows: Among them, f(t) is the comprehensive state vector; t represents the current moment; t′ is the moment index variable; represents the range of the time window; is the time window size at the moment t; exp is the exponential function; τ is the decay factor; x(t′) is the device data vector at the moment t′.

5. The device anomaly detection method based on deep learning according to claim 4, characterized in that, The specific content of S2 includes: Pass the comprehensive state vector through the convolutional layer, pooling layer, and fully connected layer in sequence to extract features to obtain the final features, which are used to calculate the anomaly probability of the device.

6. The method for device anomaly detection based on deep learning according to claim 5, wherein, The specific content of S2 includes: Use the convolutional layer to process the comprehensive state vector to extract the feature map of the comprehensive state vector; perform downsampling on the feature map output by the convolutional layer through the pooling layer to obtain the pooled feature map; the fully connected layer flattens the pooled feature map into a one-dimensional vector, and performs feature learning through two or more neural network layers, and takes the output of the last fully connected layer as the final feature and inputs it to the output layer for processing.

7. The method for detecting device anomalies based on deep learning according to claim 6, characterized in that, The specific content of S3 includes: The output layer performs anomaly detection based on the final features, and calculates the initial anomaly score through the S-shaped activation function and logarithmic smoothing operation.

8. The method for device anomaly detection based on deep learning according to claim 7, wherein The specific content of S3 includes: The calculation formula of the final anomaly score is as follows: Among them, is the final anomaly score at time t; y(t) is the initial anomaly score at time t; μ y is the mean of the historical initial anomaly scores; σ y is the standard deviation of the historical initial anomaly scores; λ is the self-correction coefficient; is a constant to prevent zero values in the operation.

9. The method for device anomaly detection based on deep learning according to claim 8, characterized in that, The specific content of S3 includes: Set an anomaly threshold. When the final anomaly score exceeds the anomaly threshold, it is judged that the device is in an abnormal state, trigger the alarm mechanism, and notify relevant personnel for fault diagnosis and processing; when the final anomaly score does not exceed the anomaly threshold, it is judged that the device is operating normally, and continue to monitor the device status.

Images