Real-time anomaly detection method and system for complex time series based on vehicle-road-cloud integration

Abstract

The present invention discloses a real-time anomaly detection method and system for complex time series of vehicle-road-cloud integration, which relates to the field of vehicle networking. The method includes S1, constructing an initial anomaly detection model; S2, obtaining a training data set; S3, importing the training data set into the initial anomaly detection model, training and optimizing it, and obtaining an optimized anomaly detection model; S4, obtaining data to be predicted; S5, using the optimized anomaly detection model to perform anomaly detection on the data to be predicted, and obtaining anomaly detection results; the method introduces time pooling and channel attention mechanisms to extract the complex interactive relationship between feature dimensions and time dimensions; adding a module based on a channel weight adjustment mechanism to reduce the computational complexity of the model by dynamically adjusting the channel weights, thereby improving the model's ability to express key features; integrating an interactive convolution module to capture dependencies in multidimensional space and support simultaneous detection of multiple types of abnormal events.

Description

Technical Field

[0001] The present invention relates to the field of Internet of Vehicles, and in particular to a method and system for real-time anomaly detection of complex time series using integrated vehicle-road-cloud technology. Background Art

[0002] Autonomous driving technology is an important field that has attracted much attention in today's science and technology field. It provides new possibilities for people's travel. With the vigorous development of autonomous driving technology, the global intelligent transportation system is undergoing profound changes. In the intelligent transportation system, the vehicle-mounted terminal, road-side terminal and cloud terminal work together (vehicle-road-cloud integration) to ensure the safety and efficiency of traffic operation. At present, the development path of autonomous driving is mainly divided into two major technical routes: single-vehicle intelligence and vehicle-road collaboration (V2X). Among them, the vehicle-road-cloud integrated architecture is as follows: Figure 1 As shown in the figure, as the core of the V2X model, it has become an important development direction for improving the safety, stability and intelligence level of the autonomous driving system. The vehicle-road-cloud integration closely combines the vehicle-mounted terminal, roadside terminal and cloud terminal. The relationship between the three is as follows: Figure 2 As shown, relying on cloud computing, big data analytics, artificial intelligence, high-precision positioning (such as Beidou navigation), connected vehicles, and the Internet of Things (IoT), it enables real-time data collection, centralized integration, and intelligent decision-making. Within this architecture, vehicle-sensed data, traffic information collected by roadside infrastructure, and cloud computing resources work together to form a holistic intelligent transportation system. Compared to single-vehicle intelligence relying on the computing power of a single vehicle, vehicle-road-cloud integration leverages the cloud's centralized computing and global optimization capabilities to provide more accurate environmental perception, risk prediction, and anomaly detection in complex traffic scenarios, significantly improving the overall performance and safety of the autonomous driving system.

[0003] Vehicles are equipped with numerous sensors that monitor multidimensional conditions such as speed, acceleration, brake pressure, and tire pressure. This multidimensional data, generated in real time by vehicle sensor nodes, is complexly interrelated and exhibits dynamic and non-stationary characteristics. Accurately monitoring these high-dimensional dynamic features is crucial for ensuring traffic safety. Capturing these interdependent features across time and space requires models with strong temporal modeling capabilities and key feature identification capabilities. First, abnormal behavior in connected vehicles (IoV) typically does not occur in isolation within a single time step or dimension; rather, it involves interactions across multiple time steps and dimensions. For example, sudden acceleration accompanied by frequent sharp turns and braking may lead the system to diagnose driver fatigue or vehicle malfunction. Second, while the high-dimensional sensor data collected by IoV devices contains rich information, the large number of redundant features increases the computational burden, especially in resource-constrained in-vehicle terminals, impacting model efficiency and real-time performance. Due to the high dimensionality of the data and the complex coupling between variables, many features contribute little or even nothing to anomaly detection. However, key monitoring indicators (such as emergency braking frequency and abnormal engine status) directly impact safety assessments. If key features cannot be accurately extracted and enhanced, the model may be contaminated by redundant information, resulting in reduced detection performance and an increased false positive rate (FPR). Furthermore, IoV anomalies occur not only infrequently but also in a highly complex variety of situations, encompassing a wide range of scenarios, including hardware failures (temporary sensor failures), sudden behaviors (sudden braking, collisions), and cyberattacks (short delays in V2X communications). Anomalies can exist across scales and resolutions, and existing methods lack the necessary accuracy to handle these short-duration, low-amplitude anomaly patterns, potentially missing opportunities for early warning. Therefore, properly selecting and optimizing features during anomaly detection is crucial for improving detection accuracy and reliability.

[0004] As a crucial component of intelligent transportation systems, roadside sensors rely on a variety of sensors to monitor road conditions, traffic flow, and vehicle status in real time. Similar to vehicle-mounted sensors, the data collected by roadside sensors exhibits high-dimensional, non-stationary, and complex coupling characteristics, posing significant challenges for anomaly detection. Because abnormal behavior typically involves multiple time steps and different data dimensions, relying solely on a single sensor or local data analysis makes it difficult to accurately identify abnormal patterns. For example, a sudden fluctuation in traffic flow on a particular road section could be a normal phenomenon caused by a surge in traffic, or it could be a data anomaly caused by a roadside unit (RSU) failure, limited edge computing resources, or network latency. If the detection model cannot correctly distinguish between these situations, it can lead to false positives or false negatives, impacting traffic management and safety decisions. Furthermore, while the data collected by roadside sensors is rich, excessive redundant features increase computational overhead, hindering real-time analysis capabilities. Different features contribute differently to anomaly detection, and redundant, irrelevant features can interfere with system judgment. Therefore, detection models must possess efficient feature screening capabilities, accurately extracting and enhancing key monitoring indicators (such as abnormal signal light status, vehicle identification errors, and temporary RSU failures), thereby improving anomaly detection accuracy and reducing false alarm rates. It's important to note that some abnormal behaviors on the vehicle side may actually be normal manifestations of the collaborative operation between the vehicle side and the roadside. For example, in an intelligent traffic signal control system, some vehicles may continuously accelerate at multiple intersections due to receiving green wave traffic signals through V2X communication. This behavior may appear as abnormal acceleration from a single-vehicle perspective, but it is actually a normal result of the system optimizing traffic efficiency. Similarly, in an autonomous driving environment, if the roadside side detects an unexpected accident ahead and promptly sends obstacle avoidance commands to the vehicle side, the vehicle may rapidly brake and change lanes. These sudden changes in speed and trajectory may be misinterpreted as abnormal driving behavior when analyzed in isolation, but are actually a manifestation of the vehicle-road cooperative system proactively ensuring safety. Therefore, during the anomaly detection process, it is necessary to combine the collaborative information of the vehicle-mounted end and the roadside end to avoid false alarms of normal traffic behaviors and ensure that the detection model can not only identify real anomalies but also will not affect the normal operation of vehicle-road collaborative optimization.

[0005] The cloud plays a core role in the integrated vehicle-road-cloud architecture, integrating onboard and roadside data to conduct centralized anomaly detection and intelligent analysis. While onboard and roadside data may have limitations from a local perspective, the cloud can leverage a global perspective to uncover anomaly patterns across time and space. For example, if multiple vehicles in a given area suddenly brake simultaneously, relying solely on onboard monitoring or a single RSU might not be able to distinguish between individual vehicle driving anomalies and road emergencies. However, the cloud can combine multi-source data to analyze overall traffic flow changes in the area and incorporate external factors such as historical data, weather information, and construction conditions to improve anomaly detection accuracy. Furthermore, the cloud's computing power supports more complex deep learning models, enabling integrated analysis of multi-dimensional data and further enhancing the robustness of anomaly detection. Therefore, within the integrated vehicle-road-cloud architecture, an accurate and efficient cloud-based centralized anomaly detection model is essential to ensure the stable operation of intelligent transportation systems.

[0006] In recent years, deep learning-based methods have made significant progress in the field of multivariate time series anomaly detection. By constructing neural networks, they can extract information from unstructured data, learn the characteristics and distribution of normal data, and identify outliers in test data through reconstruction errors or prediction errors. Compared with traditional anomaly detection methods, deep learning has demonstrated superior performance in processing high-dimensional, nonlinear, and time-series data. It is particularly advantageous in capturing complex dynamic patterns and abnormal events, and can better meet the real-time and accuracy requirements of intelligent transportation systems.

[0007] Currently, researchers have proposed a number of deep learning algorithms. Among them, unsupervised anomaly detection methods and Transformer-based methods have received widespread attention for their ability to extract time series features:

[0008] 1. In intelligent transportation systems, due to the massive volume and diverse nature of data generated by onboard equipment, roadside infrastructure, and cloud platforms, unsupervised learning methods are widely used for real-time time series anomaly detection, as they do not rely on extensive labeled data. Traditional unsupervised learning methods, such as clustering-based algorithms (e.g., k-means) and density-based algorithms (e.g., DBSCAN), effectively identify potential anomalous behavior in vehicles or transportation systems by identifying deviations from the normal data distribution. In recent years, with the advancement of deep learning technology, new unsupervised learning methods have significantly improved the anomaly detection capabilities of models. For example, models such as autoencoders, variational autoencoders (VAEs), and the long short-term memory (LSTM)-VAE (a variant of a long short-term memory network) identify anomalies by analyzing changes in errors during data reconstruction. These deep learning methods, with their powerful feature extraction capabilities and ability to model nonlinear and complex data patterns, provide more accurate and efficient anomaly detection for connected vehicle systems. Furthermore, the Modern TCN model, by incorporating a convolutional neural network architecture, effectively captures the dependencies between multiple variables, thereby increasing sensitivity to anomalous patterns. The TimesNet method enhances the modeling capabilities of intra-cycle and inter-cycle changes by converting time series data into two-dimensional tensor form, providing a new solution for complex time-related anomaly detection in Internet of Vehicles systems.

[0009] 2. The ability to analyze correlations between time series is crucial for system anomaly detection.

[0010] By incorporating the self-attention mechanism from the Transformer architecture, the AnomalyTransformer model effectively captures long-range dependencies in time series data and introduces a correlation difference metric to enhance the model's detection performance on complex datasets. Furthermore, a squeeze-excitation (SE) module is embedded within the adversarial autoencoder to improve its ability to capture the normal distribution of positive samples. This approach enhances the model's focus on important features, making it more flexible and robust in handling complex patterns. However, existing methods still have limitations, such as difficulty in simultaneously addressing the modeling of long-term temporal dependencies, covariation analysis of multi-dimensional data, selective enhancement of key channel features, and accurate identification of fine-grained anomaly patterns. These shortcomings render current deep learning models incapable of handling the complex traffic scenarios and diverse anomaly patterns found in intelligent transportation environments. Therefore, designing more efficient algorithmic frameworks to meet the stringent real-time and accuracy requirements of intelligent transportation systems remains a challenging research direction.

[0011] Due to the massive scale and diverse data types in intelligent transportation systems, the interplay of different characteristics of multivariate time series and different temporal dimensions can lead to an increased false positive rate. Furthermore, the diversity of anomaly events and the lack of labeled data make system anomaly detection even more challenging. Consequently, existing anomaly detection methods still suffer from the following shortcomings: ① Inadequate temporal dependency modeling leads to complex dynamic anomalies. Sensor data in intelligent transportation systems exhibits strong temporal dependencies and cross-scale dynamic characteristics, making it difficult to identify them. Different anomaly patterns may emerge gradually, either as short-term bursts or over long periods of accumulation. Existing methods are limited in modeling long-range temporal relationships and multi-timescale features, making it difficult to accurately capture complex temporal dynamic patterns and prone to missing potential risk events. ② Feature redundancy reduces model performance and computational efficiency. The high-dimensional data generated by on-board equipment and roadside infrastructure contains numerous irrelevant or low-contribution features, which can easily interfere with anomaly pattern learning. Existing methods lack effective feature screening mechanisms, resulting in reduced model performance in high-dimensional data and unnecessary computational overhead, particularly limiting real-time detection capabilities in resource-constrained on-board terminals. ③ The diversity of anomaly types and their cross-scale presence limit model adaptability. Abnormal events in intelligent transportation systems are complex and involve a variety of scenarios, including hardware failures, abnormal driving behavior, and cyberattacks. Abnormal features can exist across time steps and resolutions. Existing methods have limited ability to identify multi-type and cross-dimensional abnormal patterns, resulting in low accuracy in detecting specific types of anomalies, insufficient generalization capabilities, and difficulty adapting to complex traffic environments. Summary of the Invention

[0012] The purpose of the present invention is to design a real-time anomaly detection method and system for complex time series of vehicle-road-cloud integration in order to solve the above problems.

[0013] The present invention achieves the above-mentioned purpose through the following technical solutions:

[0014] The vehicle-road-cloud integrated complex time series real-time anomaly detection method includes:

[0015] S1. Construct an initial anomaly detection model. The anomaly detection model includes an embedded coding module, multiple encoders, a reconstruction module, and an anomaly analysis module. The output of the embedded coding module is used as the input of multiple encoders, the output of multiple encoders is used as the input of the reconstruction module, and the output of the reconstruction module is used as the input of the anomaly analysis module. The embedded coding module is used to reduce the dimension of the input multidimensional time series data and add position encoding. The encoder is used to extract features and generate a coding sequence. The reconstruction module is used to reconstruct the input sequence from the coding sequence. The anomaly analysis module is used to calculate the anomaly score of each time step and compare it with the threshold δ to obtain the anomaly detection result.

[0016] S2, obtain training data set;

[0017] S3. Import the training data set into the initial anomaly detection model, train and optimize it, and obtain the optimized anomaly detection model;

[0018] S4. Obtain data to be predicted;

[0019] S5. Use the optimized anomaly detection model to perform anomaly detection on the data to be predicted to obtain anomaly detection results.

[0020] The vehicle-road-cloud integrated complex time series real-time anomaly detection system includes:

[0021] Memory; Memory is used to store computer programs;

[0022] Executor; The executor is used to execute the computer program in the memory. When executing the computer program, the above-mentioned vehicle-road-cloud integrated complex time series real-time anomaly detection method is implemented.

[0023] The vehicle-road-cloud integrated system includes:

[0024] Vehicle-mounted terminal: The vehicle-mounted terminal is used to obtain vehicle sensor data in real time;

[0025] Roadside terminal: The roadside terminal is used to sense traffic data in real time, and the signal terminal of the vehicle terminal is connected to the signal terminal of the roadside terminal;

[0026] The cloud includes the above-mentioned vehicle-road-cloud integrated complex time series real-time anomaly detection system, and the signal end of the cloud is connected to the signal end of the vehicle end and the signal end of the roadside end respectively.

[0027] The beneficial effects of the present invention are: (1) Improving detection accuracy: By introducing the Temporal Context-Aware Module (TCAM), the model can more accurately capture abnormal features in complex traffic environments, thereby improving the accuracy of anomaly detection. (2) Improving computational efficiency: The channel adaptive enhancement module (Squeeze-and-Excitation, SE) based on the channel weight adjustment mechanism effectively reduces the computational complexity of the model, enabling it to run efficiently on resource-constrained devices, meeting the actual deployment requirements in the Internet of Vehicles scenario. (3) Enhancing robustness: The introduction of the Interactive Convolution Block (ICB) gives the model stronger adaptability, can cope with changing traffic scenarios, and simultaneously support the detection of multiple types of abnormal events, significantly improving the stability and reliability of the system. (4) Meeting real-time requirements: Through time pooling technology, the model can quickly process and make decisions on real-time data streams, ensuring timely response in the high-speed movement of vehicles and dynamic changes in the traffic environment, fully meeting the real-time requirements in the Internet of Vehicles scenario. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Schematic diagram of the vehicle-road-cloud integrated system Figure 1 ;

[0029] Figure 2 Schematic diagram of the vehicle-road-cloud integrated system Figure 2 ;

[0030] Figure 3 This is the architecture diagram of the interactive convolution module in the anomaly detection model of this method;

[0031] Figure 4 This is the overall architecture diagram of the anomaly detection model of this method;

[0032] Figure 5 This is the architecture diagram of the time context awareness module in the anomaly detection model of this method;

[0033] Figure 6 This is the architecture diagram of the channel adaptive enhancement module in the anomaly detection model of this method;

[0034] Figure 7 is the overall average P, R, and F1 scores of our method and all baselines on the five datasets;

[0035] Figure 8 The F1 score comparison chart of this method and all baseline methods on the SMD dataset;

[0036] Figure 9 The F1 score comparison chart of this method and all baseline methods on the PSM dataset;

[0037] Figure 10 The F1 score comparison chart of this method and all baseline methods on the MSL dataset;

[0038] Figure 11 This is a comparison of the F1 scores of the proposed method and all baseline methods on the SMAP dataset;

[0039] Figure 12 The following is a comparison of the F1 scores of our method and all baseline methods on the SWAT dataset. DETAILED DESCRIPTION

[0040] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more apparent, the technical solutions of the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings of the embodiments of the present invention. It should be understood that the described embodiments are only a portion of the embodiments of the present invention, not all of them. Generally, the components of the embodiments of the present invention described and illustrated in the drawings herein may be arranged and designed in a variety of different configurations.

[0041] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort shall fall within the scope of protection of the present invention.

[0042] It should be noted that similar reference numerals and letters denote similar items in the following drawings, and therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings.

[0043] Furthermore, the terms “first”, “second”, etc. are merely used for distinguishing descriptions and should not be understood as indicating or implying relative importance.

[0044] In the description of the present invention, it should also be noted that, unless otherwise expressly specified or limited, terms such as "disposed" and "connected" should be understood in a broad sense. For example, "connected" can mean a fixed connection, a detachable connection, or an integral connection; it can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium; it can also mean internal communication between two components. Those skilled in the art will be able to understand the specific meanings of the above terms in the present invention based on specific circumstances.

[0045] The specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0046] The vehicle-road-cloud integrated complex time series real-time anomaly detection method includes:

[0047] S1. Build an initial anomaly detection model, such as Figure 4 As shown in the figure, the anomaly detection model includes an embedded coding module, multiple encoders, a reconstruction module and an anomaly analysis module. The output of the embedded coding module is used as the input of L encoders, the output of multiple encoders is used as the input of the reconstruction module, and the output of the reconstruction module is used as the input of the anomaly analysis module. The embedded coding module is used to reduce the dimension of the input multi-dimensional time series data and add position coding. The encoder is used to extract features and generate a coding sequence. The reconstruction module is used to reconstruct the input sequence from the coding sequence. The anomaly analysis module is used to calculate the anomaly score of each time step and compare it with the threshold δ to obtain the anomaly detection result.

[0048] Each encoder includes an abnormal attention module, a temporal context perception module, a first residual connection and layer normalization module, a channel adaptive enhancement module, a second residual connection and layer normalization module, an interactive convolution module, a third residual connection and layer normalization module, a forward propagation module and a fourth residual connection and layer normalization module. The output of the abnormal attention module is used as the input of the temporal context perception module and the reconstruction module respectively, the output of the embedded coding module is used as the input of the abnormal attention module and the first residual connection and layer normalization module, the output of the temporal context perception module is used as the input of the first residual connection and layer normalization module, the output of the first residual connection and layer normalization module is used as the input of the channel adaptive enhancement module and the second residual connection and layer normalization module respectively, and the output of the second residual connection and layer normalization module is used as the input of the interactive convolution module respectively. The output of the interactive convolution module is used as the input of the third residual connection and layer normalization module, and the output of the third residual connection and layer normalization module is used as the input of the forward propagation module and the fourth residual connection and layer normalization module respectively. The output of the forward propagation module is used as the input of the fourth residual connection and layer normalization module, and the output of the fourth residual connection and layer normalization module is used as the input of the reconstruction module; the abnormal attention module adopts the abnormal attention mechanism to quantify the correlation difference to effectively distinguish normal points from abnormal points, and amplify the abnormal point features; the temporal context perception module is used to extract global features and local features, and generate a temporal feature matrix; the channel adaptive enhancement module is used to strengthen key features; the interactive convolution module is used to capture short-term anomalies and long-term trends, and splice short-term anomalies and long-term trends.

[0049] like Figure 5 As shown, the temporal context perception module includes an attention pooling layer, an average pooling layer, a shared fully connected layer, two convolutional activation layers and a first fusion layer. The outputs of the abnormal attention module are respectively used as the inputs of the attention pooling layer and the average pooling layer. The attention pooling layer is used to extract local features, and the average pooling layer is used to extract global features. After weighted summation, the local features are input together with the global features into the shared fully connected layer for feature storage and fusion. The two convolutional activation layers calculate the interaction relationship between channels, dynamically adjust the importance of each channel, and enhance temporal dynamic information. The outputs of the shared fully connected layer are respectively used as the inputs of the two convolutional activation layers, and the outputs of the two convolutional activation layers are used as the inputs of the first fusion layer. The first fusion layer uses an additive fusion strategy to fuse the enhanced features of the two convolutional activation layers and the output of the abnormal attention module to generate an enhanced temporal feature matrix. .

[0050] like Figure 6As shown, the channel adaptive enhancement module includes a global attention pooling layer, two fully connected layers, an activation layer, and an adjustment layer from input to output. The global attention pooling layer is used to perform global average pooling on the feature vector of each time step and compress the channel dimension. The two fully connected layers are used to generate channel weights. The activation layer is activated by the sigmoid function. The adjustment layer is used to adjust the original features according to the weights, which is expressed as .

[0051] like Figure 3 As shown, the interactive convolution module includes multi-scale convolution blocks and splicing layers. The multi-scale convolution blocks capture short-term anomalies and long-term trends, and the splicing layers are used to splice short-term anomalies and long-term trends to form a complete representation. ,The multi-scale convolution block consists of multiple one-dimensional convolution layers with different ,convolution kernel sizes.

[0052] The reconstruction module includes a linear mapping layer and a normalization layer from input to output. The linear mapping layer is used to reconstruct the input sequence to obtain the reconstruction result. ,The output of the abnormal attention module and the output of the fourth residual connection and layer normalization module are both used as the input of the linear mapping layer.

[0053] S2, obtain training data set;

[0054] S3. Import the training data set into the initial anomaly detection model, train and optimize it, and obtain the optimized anomaly detection model; use the reconstruction error to train the anomaly detection model, and the loss function is expressed as ;

[0055] S4. Obtain data to be predicted;

[0056] S5. Use the optimized anomaly detection model to perform anomaly detection on the predicted data to obtain anomaly detection results; the anomaly score is expressed as ; When the anomaly score exceeds the threshold δ, the anomaly detection result is an anomaly point; otherwise, the anomaly detection result is a normal point.

[0057] Improved detection accuracy: By introducing the Temporal Context-Aware Module (TCAM), the model can more accurately capture abnormal features in complex traffic environments, thereby improving the accuracy of anomaly detection.

[0058] Improved computational efficiency: The channel adaptive enhancement module, based on the channel weight adjustment mechanism (Squeeze-and-Excitation, SE), effectively reduces the computational complexity of the model, enabling it to run efficiently on resource-constrained devices and meet the actual deployment requirements in the Internet of Vehicles scenario.

[0059] Enhanced robustness: The introduction of the Interactive Convolution Block (ICB) makes the model more adaptable, enabling it to cope with changing traffic scenarios and simultaneously support the detection of multiple types of abnormal events, significantly improving the stability and reliability of the system.

[0060] Meeting real-time requirements: Through time pooling technology, the model can quickly process and make decisions on real-time data streams, ensuring timely response to high-speed vehicle movement and dynamic changes in traffic environment, fully meeting the real-time requirements in the Internet of Vehicles scenario.

[0061] This method improves upon the Transformer to extract interdependencies between vectors in multivariate time series. To ensure robustness, it uses a cascade of feature extractors to extract more representative features, which are then reconstructed for better anomaly detection. This method leverages the error between real and predicted data to achieve relatively accurate anomaly detection.

[0062] This method incorporates innovative encoder designs based on the unique characteristics of the intelligent connected vehicle (ICV) operating environment. First, it introduces temporal pooling and a channel attention mechanism (TCAM) to extract the complex interactions between feature and temporal dimensions. Second, it incorporates a module based on channel weight adjustment (SE) to dynamically adjust channel weights, reducing the model's computational complexity while improving its ability to express key features. Finally, it integrates an interactive convolutional block (ICB) to capture dependencies in multidimensional space and support the simultaneous detection of multiple types of abnormal events. These improvements enable the model to improve detection accuracy while also enhancing robustness and real-time performance, enabling it to effectively address the complex dynamic scenarios and high-dimensional data challenges faced by intelligent transportation systems.

[0063] The vehicle-road-cloud integrated complex time series real-time anomaly detection system includes:

[0064] Memory; Memory is used to store computer programs;

[0065] Executor; The executor is used to execute the computer program in the memory. When executing the computer program, the above-mentioned vehicle-road-cloud integrated complex time series real-time anomaly detection method is implemented.

[0066] like Figure 1 、 Figure 2 As shown in the figure, the vehicle-road-cloud integrated system includes:

[0067] Vehicle-mounted terminal: The vehicle-mounted terminal is used to obtain vehicle sensor data in real time;

[0068] Roadside terminal: The roadside terminal is used to sense traffic data in real time, and the signal terminal of the vehicle terminal is connected to the signal terminal of the roadside terminal;

[0069] The cloud includes the above-mentioned vehicle-road-cloud integrated complex time series real-time anomaly detection system, and the signal end of the cloud is connected to the signal end of the vehicle end and the signal end of the roadside end respectively.

[0070] Experimental evaluation:

[0071] 1. Dataset:

[0072] Five real-world representative complex multivariate time series benchmark datasets SMD, PSM, MSL, SMAP, and SWAT from practical applications are used to evaluate the models of our proposed method.

[0073] 2. Model training process:

[0074] ① Data embedding and time encoding: Multi-dimensional time series data collected by the Internet of Vehicles system (Such as speed, steering angle, tire pressure, battery voltage, GPS location, throttle opening, etc.) before inputting into the model (Among them, represents the data collected by the nth sensor at time step t, T represents the length of the time series, and N represents the total number of sensors). The input time series window of each layer needs to be converted into an embedded representation through the embedding layer first. Since the monitoring data in the Internet of Vehicles system is often high-dimensional and heterogeneous, directly processing the raw data may lead to insufficient feature expression and high computational complexity. Therefore, the multi-dimensional monitoring indicator data is converted into a low-dimensional dense vector representation through the embedding operation, which can effectively reduce the dimension of the data, strengthen the expression of key features, and retain the relative relationship of multi-dimensional characteristics. In order to compensate for the time information that may be lost during the dimensionality reduction process and maintain the temporal characteristics of the sequence, position encoding is added to the embedding representation Z to explicitly represent the timestamp information, so that the model can better understand the order and dynamic changes in the time series data, which is expressed as:

[0075] ;

[0076] Z represents the input feature matrix after embedding, InputEmbedding() maps the input sequence X to a high-dimensional embedding space, and PositionEncoding() encodes the information.

[0077] Position encoding uses sine and cosine functions, expressed as:

[0078] ; ;

[0079] Among them, PE represents the result of position encoding, m represents the dimension index, d represents the total embedding dimension, and t is the time step index.

[0080] Monitoring data in connected vehicle systems exhibits typical characteristics: high dimensionality, multivariate nature, and strong interdependencies. The embedding and positional encoding described above both reduce computational complexity and enhance the model's understanding of multidimensional features and temporal dynamics. These characteristics pose challenges in directly processing the data, such as insufficient feature representation and difficulty capturing key patterns. Therefore, after the embedding operation, this method stacks L encoders with the same structure for further feature extraction. To accurately capture the key features of multidimensional monitoring data in cloud systems, a cascaded feature extractor combined with an anomaly attention mechanism is deployed within each encoder layer.

[0081] ② Abnormal attention mechanism: The feature sequence after convolution is input into the encoder. Since the number of normal points is dominant, it will suppress the feature expression of abnormal points. Therefore, this method uses the abnormal attention mechanism to quantify the correlation difference to effectively distinguish normal points from abnormal points. At the same time, the minimum maximization strategy is used to amplify the correlation difference, and then focus on feature extraction through the sparse distribution of abnormal points. The correlation loss AssDis is obtained by averaging the correlation differences of L layers, which is expressed as:

[0082] ;

[0083] Among them, NLs is the number of network layers, represents the probability distribution of normal points of the cth channel of the nlsth layer, represents the probability distribution of outliers in the cth channel of the nlsth layer. KL represents the Kullback-Leibler divergence, which is used to measure the difference between two distributions. N represents the number of sensors, and c and nls both represent indices.

[0084] ③ Temporal context perception: Introduce time pooling and channel attention mechanism to extract context information of time series. Specific details are as follows Figure 5 As shown in the figure, by sliding the window and using attention pooling and average pooling strategies to extract local and global features at different time scales, the redundancy problem caused by long sequences is alleviated. The global feature is expressed as: ; Local features are expressed as: ;in, represents the sliding window length, represents the embedding feature of the cth channel at the tth time step, Represents the attention weight, which is used to emphasize key time points. represents the global average feature, Represents local features of the context. It also uses a shared memory filter to store and fuse features. Based on the pooled feature vector, it uses 1×1 convolution and softmax operations to calculate the interaction between channels, dynamically adjust the importance of each channel, and enhance temporal dynamic information. , (in, represents the pooling feature of channel c, w represents the weight parameter, o represents the index, β represents the channel attention coefficient, represents the re-weighted feature representation), and then uses the additive fusion strategy to finally generate the enhanced temporal feature matrix , expressed as: ; Thereby improving the model's ability to perceive anomalies.

[0085] ④ Channel adaptive enhancement: such as Figure 6 As shown in the figure, the feature vector of each time step is first compressed by global average pooling to extract global channel information and compress the channel dimension. Then, the importance of each channel is learned through two layers of fully connected layers and activation functions, and the channel weights are generated using the Sigmoid activation function. Finally, these weights are used to adaptively adjust the channel strength of the input features, thereby strengthening key features, suppressing irrelevant information, improving the model's discriminative ability, and improving the problems of high-dimensional feature redundancy and device resource constraints. It is expressed as :

[0086] ;

[0087] in, Represents the input feature map The value of the (i, j)th position in , H, W represent the height and width of the feature map, and represents the weight of the fully connected layer, σ represents the Sigmoid activation function, Represents the channel weight vector.

[0088] ⑤ Multi-scale feature fusion: In order to enhance the model's adaptability to complex anomalies, the extracted enhanced time and channel features are fed into the interactive convolution module, such as Figure 3 As shown in Figure 2, the multi-scale convolution module uses one-dimensional convolution with different kernel sizes to capture short-term anomalies and long-term trends, and uses feature splicing and nonlinear transformation to model complex correlations between channels to form a complete representation. , expressed as:

[0089] ;

[0090] in, and Represents different convolution kernel sizes, Represents a one-dimensional convolution operation, GELU represents the Gaussian error linear unit activation function, Representation layer normalization.

[0091] ⑥ Reconstruction and prediction: Reconstruct the input sequence through the linear mapping layer and calculate the reconstruction error. The final output of the model is the predicted value of the original sequence: , Represents a linear projection layer.

[0092] ⑦Model training: Use reconstruction error and association loss to train the model, loss function Using mean square error:

[0093] ;

[0094] in, represents the Frobenius norm, AssDis represents the association loss, and λ represents the weight factor of the loss term.

[0095] ⑧Anomaly detection: After training is completed, the anomaly score of each time step is calculated through a sliding window , the reconstruction error is combined with the associated difference and compared with the threshold δ. If the anomaly score exceeds the threshold, it is determined to be an anomaly point;

[0096] ;

[0097] Among them, the weight factor , represents the squared reconstruction error of the matrix at time point t, and AssDis represents the association loss.

[0098] 3. Model performance indicators:

[0099] The performance comparison of the models uses several main performance indicators of classification based on the confusion matrix: precision, recall, and F1 score.

[0100] Precision is the percentage of correctly detected anomalies among all instances; Recall is the percentage of correctly detected anomalies; and the F1 score is the equally weighted average of Precision and Recall. TP (True Positive) refers to the number of samples correctly identified as positive; FP (False Positive) refers to the number of negative samples incorrectly classified as positive, and FN (False Negative) refers to the number of positive samples incorrectly classified as negative.

[0101] ; ; ;

[0102] The F1 score is used to verify the robustness of the model. The F1Average Rank represents the average ranking of the F1 score of each model in the seven datasets.

[0103] 4. Model comparison results:

[0104] The model of this paper's method is compared with 17 other baseline models. Figure 7 、 Figure 8 、 Figure 9 、 Figure 10 、 Figure 11 、 Figure 12 , The 17 models in Tables 1 and 2 correspond to comparison methods 1, 2...17 respectively. Comparison method 1: LOF, a density-based local outlier factor unsupervised anomaly detection algorithm; Comparison method 2: DAGMM, a deep autoencoder Gaussian mixture model; Comparison method 3: Transformer, a deep neural network model based on self-attention mechanism; Comparison method 4: Deep-SVDD, a deep single-class anomaly detection model; Comparison method 5: InterFusion, an unsupervised anomaly detection algorithm that uses hierarchical variational autoencoders, explicit low-dimensional mutual metrics and time embedding layers to jointly learn robust multidimensional time series representations; Comparison method 6: DLinear, a decomposition linear prediction model for modeling trend and seasonal components; Comparison method 7: THOC, a time series anomaly detection method combining autoencoders and clustering; Comparison method 8: ITAD, a time series anomaly detection method with strong interpretability; Comparison method 9: Autoformer, a long-term series prediction model based on deep decomposition architecture and autocorrelation mechanism; Comparison method 10: iTran sformer, an inverted Transformer that encodes the multi-time point data of a single feature as a sequence and then performs an attention mechanism; Comparative method 11: FEDFormer, a Transformer model decomposed by frequency enhancement; Comparative method 12: ModernTCN, an improved model based on the traditional temporal convolutional network (TCN); Comparative method 13: CrossFormer, a multivariate time series prediction model with cross-dimensional dependencies; Comparative method 14, OmniAnomaly, a multivariate time series robust anomaly detection model based on random recurrent networks; Comparative method 15: LSTM-VAE, a hybrid model combining long short-term memory networks (LSTM) and variational autoencoders (VAE); Comparative method 16: TimesNet, a time two-dimensional variational modeling method for general time series analysis; Comparative method 17: AnomalyTransformer, a time series anomaly detection method based on correlation differences.

[0105] from Figure 7 、 Figure 8 、 Figure 9 、 Figure 10 、 Figure 11 、 Figure 12 As can be seen from Table 1 and Table 2, compared with the existing models, the experimental results of the model of this method on the real data set are as follows:

[0106] (1) Table 1 shows the Precision (P), Recall (R), and F1 score values ​​of the proposed model and 17 other baseline models on the SMD, PSM, SML, SMAP, and SWAT datasets. It can be observed that the proposed model outperforms all other baseline models on these five datasets. Compared with the AnomalyTransformer model of the comparison method 17, the F1 score is improved by 4.74%, 13.07%, 0.61%, 2.79%, and 0.07%, respectively. As shown in Table 2, in terms of overall average performance, the proposed model also achieves excellent results compared with other baseline models. Specifically, the proposed model has an overall average precision of 93.14%, an average recall of 97.15%, and an average F1 score of 95.10%. The average accuracy is 0.27% higher than the ModernTCN model (92.87% → 93.14%) in comparison method 12, and the average recall and F1 score are 7.27% (89.88% → 97.15%) and 4.26% (90.84% ​​→ 95.10%) higher than the AnomalyTransformer model in comparison method 17, respectively. The robustness of the model of this method is better than all other baseline models. Its overall average accuracy, recall, and F1 score on the five datasets are all above 93%, which is a level unmatched by any other baseline model. All results in Tables 1 and 2 are expressed in percentages, with the best results in bold and the second-best results underlined. P, R, and F1 are precision, recall, and F1 score, respectively.

[0107] (2) Figure 7 As shown, it is clear that the model of our method ranks highest in the three average evaluation metrics across the five datasets.

[0108] (3) Figure 8 、 Figure 9 、 Figure 10 、 Figure 11 、 Figure 12 The F1 score performance of the proposed model and all baseline methods on the SMD, PSM, MSL, SMAP and SWAT datasets are shown respectively. As can be seen from the figure, the proposed model performs well on the five datasets, proving the superiority of the proposed model.

[0109] This invention improves the key issues in real-time anomaly detection in intelligent transportation systems through a cloud-based centralized anomaly detection design that integrates vehicle, road, and cloud, and has important theoretical significance and practical application value.

[0110] Table 1 is a performance comparison table of the proposed method and the baseline model on 5 datasets

[0111]

[0112] Table 2 is the overall mean comparison results of the proposed method and all baseline models on 5 datasets

[0113]

[0114] The technical solution of the present invention is not limited to the above-mentioned specific embodiments. Any technical variations made according to the technical solution of the present invention fall within the protection scope of the present invention.

Claims

1. A real-time anomaly detection method for complex time series based on vehicle-road-cloud integration, characterized by: include: S1. Construct the initial anomaly detection model. The anomaly detection model includes an embedded coding module, multiple encoders, a reconstruction module, and an anomaly analysis module. The output of the embedded coding module is used as the input of multiple encoders, the output of multiple encoders is used as the input of the reconstruction module, and the output of the reconstruction module is used as the input of the anomaly analysis module. The embedded coding module is used to reduce the dimension of the input multi-dimensional time series data and add position coding. The encoder Used for feature extraction to generate coding sequences; the reconstruction module is used to reconstruct the input sequence from the coding sequence; the anomaly analysis module is used to calculate the anomaly score of each time step and compare it with the threshold δ to obtain the anomaly detection result; each encoder includes an anomaly attention module, a temporal context perception module, a first residual connection and layer normalization module, a channel adaptive enhancement module, a second residual connection and layer normalization module, an interactive convolution module, a third residual connection and layer normalization module, a forward propagation module and a fourth residual connection and layer normalization module. The anomaly attention module uses an anomaly attention mechanism to quantify the correlation difference to effectively distinguish normal points from anomalies and amplify the features of anomalies; the temporal context perception module is used to extract global features and local features and generate a temporal feature matrix; the channel adaptive enhancement module is used to strengthen key features; the interactive convolution module is used to capture short-term anomalies and long-term trends and splice short-term anomalies and long-term trends; the temporal context perception module includes an attention pooling layer, an average pooling layer, a shared fully connected layer, two convolution activation layers and a first fusion layer. The output of the anomaly attention module is used as the input of the attention pooling layer and the average pooling layer respectively. The attention pooling layer is used to extract local features , the average pooling layer is used to extract global features After weighted summation, local features are input into a shared fully connected layer together with global features for feature storage and fusion; two convolution activation layers calculate the interaction between channels, dynamically adjust the importance of each channel, and enhance temporal dynamic information. The output of the shared fully connected layer is used as the input of the two convolutional activation layers, and the output of the two convolutional activation layers is used as the input of the first fusion layer. The first fusion layer uses the additive fusion strategy to fuse the enhanced features of the two convolutional activation layers and the output of the abnormal attention module to generate an enhanced temporal feature matrix. ; S2, obtain training data set; S3. Import the training data set into the initial anomaly detection model, train and optimize it, and obtain the optimized anomaly detection model; S4. Obtain data to be predicted; S5. Use the optimized anomaly detection model to perform anomaly detection on the data to be predicted to obtain anomaly detection results.

2. The vehicle-road-cloud integrated complex time series real-time anomaly detection method according to claim 1 is characterized in that: The output of the abnormal attention module is used as the input of the temporal context perception module and the reconstruction module respectively, the output of the embedded coding module is used as the input of the abnormal attention module and the first residual connection and layer normalization module, the output of the temporal context perception module is used as the input of the first residual connection and layer normalization module, the output of the first residual connection and layer normalization module are used as the input of the channel adaptive enhancement module and the second residual connection and layer normalization module respectively, the output of the second residual connection and layer normalization module are used as the input of the interactive convolution module and the third residual connection and layer normalization module respectively, the output of the interactive convolution module is used as the input of the third residual connection and layer normalization module, the output of the third residual connection and layer normalization module are used as the input of the forward propagation module and the fourth residual connection and layer normalization module respectively, the output of the forward propagation module is used as the input of the fourth residual connection and layer normalization module, and the output of the fourth residual connection and layer normalization module is used as the input of the reconstruction module.

3. The vehicle-road-cloud integrated complex time series real-time anomaly detection method according to claim 1 is characterized in that: The channel adaptive enhancement module includes a global attention pooling layer, two fully connected layers, an activation layer, and an adjustment layer from input to output. The global attention pooling layer is used to perform global average pooling on the feature vector of each time step and compress the channel dimension. The two fully connected layers are used to generate channel weights. The activation layer is activated by the sigmoid function. The adjustment layer is used to adjust the original features according to the weights to obtain the adjusted features. .

4. The vehicle-road-cloud integrated complex time series real-time anomaly detection method according to claim 1 is characterized in that: The interactive convolution module includes multi-scale convolution blocks and splicing layers. The multi-scale convolution blocks capture short-term anomalies and long-term trends. The splicing layer is used to splice short-term anomalies and long-term trends to form a complete representation. .

5. The vehicle-road-cloud integrated complex time series real-time anomaly detection method according to claim 1 is characterized in that: The reconstruction module includes a linear mapping layer and a normalization layer from input to output. The linear mapping layer is used to reconstruct the input sequence. ,The output of the abnormal attention module and the output of the fourth residual connection and layer normalization module are both used as the input of the linear mapping layer.

6. The vehicle-road-cloud integrated complex time series real-time anomaly detection method according to claim 1 is characterized in that: In S3, the reconstruction error is used to train the anomaly detection model.

7. The vehicle-road-cloud integrated complex time series real-time anomaly detection method according to claim 1 is characterized in that: In S5, when the anomaly score exceeds the threshold δ, it is an anomaly point; otherwise, it is a normal point.

8. The vehicle-road-cloud integrated complex time series real-time anomaly detection system is characterized by: include: Memory; Memory is used to store computer programs; Actuator; The executor is used to execute the computer program in the storage, and when executing the computer program, the real-time anomaly detection method for complex time series of vehicle-road-cloud integration as described in any one of claims 1 to 7 is implemented.

9. The vehicle-road-cloud integrated system is characterized by: include: Vehicle terminal; The vehicle-mounted terminal is used to obtain the vehicle's sensor data in real time; roadside end; The roadside terminal is used to sense traffic data in real time, and the signal terminal of the vehicle terminal is connected to the signal terminal of the roadside terminal; cloud; cloud It includes the vehicle-road-cloud integrated complex time series real-time anomaly detection system as described in claim 8, and the signal end of the cloud is connected to the signal end of the vehicle end and the signal end of the roadside end respectively.

Images