Method and apparatus for anomaly detection

Abstract

The invention relates to a method for anomaly detection. The method comprises the following steps: reconstructing data graph feature representations of a plurality of sensors based on sensor data from the plurality of sensors; generating knowledge graph feature representations of the plurality of sensors based on the knowledge graph about the plurality of sensors; generating false knowledge graph feature representations of the plurality of sensors based on a false knowledge graph corresponding to the knowledge graph; an anomaly metric value is determined based on the data graph feature representation, the knowledge graph feature representation, and the false knowledge graph feature representation, where the anomaly metric value is used to determine whether an anomaly has occurred in the plurality of sensors.

Description

Technical Field

[0001] This application relates to artificial intelligence technology, and more particularly, to a method and apparatus for anomaly detection based on sensor data. Background Art

[0002] Perception systems composed of various sensors play an important role in various devices and systems. Especially with the development of the Internet of Things (IoT) technology, various types of sensors are widely used in, for example, intelligent production devices, smart home devices, intelligent medical devices, intelligent vehicle devices, intelligent agricultural devices, etc. to collect information.

[0003] Taking the application in a vehicle as an example, the sensors installed on the vehicle can detect various information during vehicle operation, such as vehicle speed, position, gas concentration, light brightness, humidity, distance, temperature of various media, engine operating conditions, etc. The information detected by the sensors is converted into electrical signals and provided to the vehicle control system, so that the vehicle control system controls various operations of the vehicle based on the information detected by these sensors, and keeps the vehicle in a good working state.

[0004] In various devices or systems such as vehicles, component aging and other situations may lead to failures and even potential safety hazards. Anomaly detection (AD) technology is used to detect possible abnormal situations in devices. For example, the outlier detection (OD) method determines whether a vehicle is in an abnormal state by analyzing sensor signals of vehicle sensors such as pressure sensors, acceleration sensors, and voltage sensors. Since the number of abnormal samples is small and previously unseen anomalies may be encountered in practice, fully supervised anomaly detection is usually difficult to achieve. Therefore, research efforts have focused on unsupervised anomaly detection that does not require any labeled training data.

[0005] Existing anomaly detection techniques learn the general distribution of normal samples of sensor data and perform unsupervised anomaly detection by determining the degree of deviation of test data from the general distribution of normal samples. By training a machine learning model on a large dataset of normal sensor data, anomalous data is reflected as large reconstruction errors in the model, enabling the distinction of anomalies. However, the limitation of existing methods is that they rely only on the inherent characteristics of sensor data. If the sensor data is noisy, or if a device or system such as a vehicle is operating under special conditions, these methods may produce incorrect detection results because the training data used to train the machine learning model does not include these special data types, and these special data types will be reflected as large reconstruction errors in the autoencoder model. At least based on the above problems, it would be advantageous to improve the accuracy of anomaly detection based on sensor data. Summary of the Invention

[0006] The following introduction is provided to introduce some selected concepts in a simple form, which will be further described in the detailed description below. This introduction is not intended to highlight the key features or essential features of the claimed subject matter, nor is it intended to limit the scope of the claimed subject matter.

[0007] In view of the above problems, the present application provides a method for improving anomaly detection performance by combining a knowledge graph and a data graph regarding sensors in a device.

[0008] According to one aspect of the present application, there is provided a method for anomaly detection, including: reconstructing a data graph feature representation of the plurality of sensors based on sensor data from the plurality of sensors; generating a knowledge graph feature representation of the plurality of sensors based on a knowledge graph regarding the plurality of sensors; generating a fake knowledge graph feature representation of the plurality of sensors based on a fake knowledge graph corresponding to the knowledge graph; and determining an anomaly metric value based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation, wherein the anomaly metric value is used to determine whether the plurality of sensors are anomalous.

[0009] According to one aspect of the present application, there is provided a method for training an anomaly detection model, including: having the anomaly detection model reconstruct a data graph feature representation of the plurality of sensors based on sensor data from the plurality of sensors; having the anomaly detection model generate a knowledge graph feature representation of the plurality of sensors based on a knowledge graph regarding the plurality of sensors; having the anomaly detection model generate a fake knowledge graph feature representation of the plurality of sensors based on a fake knowledge graph corresponding to the knowledge graph; determining a loss value based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation; and updating learnable parameters of the anomaly detection model based on the loss value.

[0010] According to one aspect of the present application, a device for anomaly detection is provided, including: a data graph reconstruction module that reconstructs a data graph feature representation of the multiple sensors based on sensor data from the multiple sensors; a knowledge graph encoding module that generates a knowledge graph feature representation of the multiple sensors based on a knowledge graph about the multiple sensors, and generates a fake knowledge graph feature representation of the multiple sensors based on a fake knowledge graph corresponding to the knowledge graph; and a metric value determination module that determines an anomaly metric value based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation, where the anomaly metric value is used to determine whether an anomaly has occurred in the multiple sensors.

[0011] According to one aspect of the present application, a device for anomaly detection is provided, including: multiple sensors; one or more processors; and one or more memories that store computer-executable instructions, which, when run by the one or more processors, perform the operations for performing anomaly detection according to the embodiments of the present application.

[0012] According to one aspect of the present application, a processing device is provided, including: one or more processors; and one or more memories that store computer-executable instructions, which, when run by the one or more processors, perform the operations for performing anomaly detection and the operations for training an anomaly detection model according to the embodiments of the present application.

[0013] According to one aspect of the present application, a machine-readable storage medium is provided, which stores executable instructions that, when executed, cause one or more processors to perform the operations for performing anomaly detection and the operations for training an anomaly detection model according to the embodiments of the present application.

[0014] According to one aspect of the present application, a computer program product is provided, which includes executable instructions that, when executed, cause one or more processors to perform the operations for performing anomaly detection and the operations for training an anomaly detection model according to the embodiments of the present application.

[0015] In various aspects of the present disclosure, a knowledge graph regarding multiple sensors on a device is utilized to improve the performance of anomaly detection. A knowledge graph is a structured representation of human knowledge, and since it contains information on how humans conceptualize a sensor system, it can help improve the performance of a data-driven automotive anomaly detection model. By defining the relationships between various sensors on the device through the knowledge graph, learning a data graph that reflects these relationships from sensor data from these sensors, and training a machine learning model using graph contrastive learning with a large amount of sensor data under normal conditions, an anomaly metric for anomaly detection is constructed. By using the contrastive learning framework provided by the embodiments of the present disclosure to incorporate the knowledge of the knowledge graph regarding the sensors in the device into data-driven anomaly detection at the data graph level, the data-driven machine learning model can effectively utilize the advantages of knowledge to improve the accuracy of anomaly detection. Other advantages of various aspects of the present disclosure will be described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] A further understanding of the nature and advantages of the content of this application can be achieved by referring to the following drawings. In the drawings, similar components or features may have the same reference numerals.

[0017] Figure 1 A block diagram of a device or system for performing anomaly detection according to one embodiment is shown.

[0018] Figure 2A and 2B A schematic diagram for illustrating a knowledge graph of sensors in a vehicle according to one embodiment is shown.

[0019] Figure 3 A schematic structural diagram of a neural network model for anomaly detection according to one embodiment is shown.

[0020] Figure 4 A flowchart of a method for anomaly detection according to one embodiment is shown.

[0021] Figure 5 A flowchart of a method for training an anomaly detection model according to one embodiment is shown.

[0022] Figure 6 A block diagram of a device for anomaly detection according to one embodiment is shown.

[0023] Figure 7 A block diagram of a device for anomaly detection according to one embodiment is shown.

[0024] Figure 8 A block diagram of a processing device according to one embodiment is shown. DETAILED DESCRIPTION

[0025] Reference will now be made to example embodiments to discuss the subject matter described herein. It should be understood that the discussion of these embodiments is merely to enable those skilled in the art to better understand and thereby implement the subject matter described herein, and is not a limitation on the scope of protection, applicability, or examples set forth in the claims. Changes may be made to the functions and arrangements of the elements discussed without departing from the scope of protection of the present application. Each example may omit, substitute, or add various processes or components as needed. For example, the methods described may be performed in a different order than described, and each step may be added, omitted, or combined. Additionally, features described relative to some examples may be combined in other examples.

[0026] As used herein, the term "comprising" and its variants denote open-ended terms meaning "including but not limited to". The term "based on" means "at least partially based on". The terms "one embodiment" and "an embodiment" mean "at least one embodiment". The term "another embodiment" means "at least one other embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other definitions may be included below, whether explicit or implicit. Unless clearly specified in the context, the definition of a term is consistent throughout the specification.

[0027] Figure 1 A block diagram of a device or system for performing anomaly detection according to one embodiment is shown.

[0028] The device or system 100 includes a sensor module 110, a processing module 120, and a communication module 130. The device 100 can be any device suitable for implementing the anomaly detection technology of the embodiments of the present disclosure. For example, it can be a traffic device, a production device, a home device, a medical device, an agricultural device, etc. that includes various sensors. For the sake of convenience, the embodiments of the present disclosure will be described below by taking a vehicle as an example of the device 100, and the various embodiments described can also be applied to other devices or systems.

[0029] The sensor module 110 includes various sensors in the device 100. For example, in a vehicle, the sensor module 110 represents various sensors installed on the vehicle, such as lidar, millimeter-wave radar, ultrasonic radar, image sensors, pressure sensors, position sensors, temperature sensors, acceleration sensors, angular velocity sensors, flow sensors, gas concentration sensors, and liquid level sensors. The sensors on the vehicle are the information sources of the vehicle electronic control system, which convert the sensed information into electrical signals and provide them to the processing module 120 (which can also be referred to as the control system 120). After the processing module 120 processes the sensor data, instructions are formed to be sent to the actuator for corresponding control. The communication module 130 is used for communication between the vehicle 100 and the outside world. For example, the vehicle 100 can communicate with other devices through the communication model 130, and the other devices can be other vehicles, traffic assistance terminal devices, server devices (such as the cloud). In one embodiment, part of the processing in the processing module 120 can be sent to the server through the communication module 130 for execution and the execution result can be received from the server. For example, the processing of detecting anomalies based on sensor data through a machine learning model in the embodiments of the present disclosure can be executed in the processing module 130 or can be executed in the server by sending the sensor data to the server and receiving the anomaly detection result from the server. It can be understood that the device 100 may include other modules, and Figure 1 only the modules related to the embodiments of the present disclosure are shown.

[0030] Figure 2A A schematic diagram showing a knowledge graph for illustrating sensors in a vehicle according to one embodiment is shown.

[0031] A knowledge graph is constructed based on the mutual relationship of multiple sensors installed on the vehicle, and the knowledge graph can be represented as where ε = {e i} represents the entity set, which includes multiple entities corresponding to the multiple sensors, represents the relationship set, which includes one or more relationship types, represents the knowledge fact set, which includes multiple knowledge fact items, and each knowledge fact item f k includes two entities among the multiple sensor entities and the relationship type between the two entities. In one implementation, a knowledge fact item f kIt is represented by a triple. For example, the relationship type r1 represents "the temperature value is greater than". Since the configurations of temperature sensors e1 and e2 determine that the detected temperature value of temperature sensor e1 should be greater than that of temperature sensor e2, the knowledge fact item f1=(e1, r1, e2) that reflects this fact. Another example, the relationship type r2 represents "perception range overlap". Since the configurations of ultrasonic sensor e3 and radar sensor e4 determine that their detection ranges overlap, the knowledge fact items f2=(e3, r2, e4) and f3=(e4, r2, e3) that reflect this fact. According to the known knowledge of the configurations of various sensors in the vehicle, multiple relationship types can be included in the knowledge graph. For example, relationship types based on numerical magnitudes, such as "value greater than", "pressure value greater than", "pressure value equal to", "concentration value less than", etc. Another example, relationship types based on whether they are in the same subsystem, such as "in the first subsystem together", "in the second subsystem together", etc. Another example, relationship types based on upstream and downstream, such as "upstream", "downstream", etc. It can be understood that depending on the specific configuration of device 100 and sensors 110 therein, various different relationship types between sensors can be constructed, and knowledge facts between sensors with such relationship types can be established based on each relationship type.

[0032] Figure 2A Fig. shows a schematic diagram of a knowledge graph corresponding to a relationship type of sensors related to visual detection. Figure 2A The sensors shown include rear camera e1 and front camera e2, lidar e3, short-range radars e4 to e9 such as ultrasonic radars, which are left-rear radar e4, rear radar e5, right-rear radar e6, left-front radar e7, front radar e8, and right-front radar e9 respectively. For the relationship type r1 "perception range overlap", corresponding knowledge fact items can be established to represent Figure 2A the knowledge graph shown. For example, the knowledge fact item that the perception ranges of rear camera e1 and lidar e3 overlap can be represented as the triple (e1, r1, e3), and correspondingly, the knowledge fact item that the perception ranges of lidar e3 and rear camera e1 overlap can be represented as the triple (e3, r1, e1). Similarly, Figure 2A the graph-level relationships between the respective sensors e1 to e9 shown can be represented as knowledge fact items in corresponding triple forms. With respect to the knowledge graph of the sensors of vehicle 100, Figure 2A the knowledge graph shown can be referred to as a knowledge subgraph. Corresponding knowledge subgraphs can be established for each relationship type, and the set of these knowledge subgraphs constitutes the knowledge graph of the sensors of vehicle 100

[0033] Figure 2BShows a graphical schematic of a knowledge graph corresponding to a relationship type according to an embodiment.

[0034] Figure 2B The exemplified relationship type r2 can be "value greater than". As Figure 2B shown, the oxygen detection value of the front oxygen sensor e 10 is greater than the oxygen detection value of the front oxygen sensor e 11 . This knowledge fact can be represented as a triple (e 10 , r2, e 11 ). The temperature detection value of the temperature sensor e 12 is greater than the temperature detection value of the temperature sensor e 13 . This knowledge fact can be represented as a triple (e 12 , r2, e 13 ). For example, the temperature sensors e 12 and e 13 are the temperature sensors at the front exhaust pipe and the middle exhaust pipe respectively, the temperature sensors at the middle exhaust pipe and the rear exhaust pipe respectively, the temperature sensors at the exhaust manifold and the front exhaust pipe respectively, the temperature sensors at the inlet and outlet of the cooling device respectively, the in-vehicle temperature sensor and the out-of-vehicle temperature sensor respectively, and so on. The pressure detection value of the pressure sensor e 14 is greater than the pressure detection value of the pressure sensor e 15 . This knowledge fact can be represented as a triple (e 14 , r2, e 15 ). For example, the pressure sensors e 14 and e 15 are the pressure sensors at the front exhaust pipe and the middle exhaust pipe respectively, the pressure sensors at the middle exhaust pipe and the rear exhaust pipe respectively, the pressure sensors at the exhaust manifold and the front exhaust pipe respectively, and so on. It can be understood that based on the magnitude relationship between the predetermined measurement values of each sensor in the vehicle or device 100, a Figure 2B shown knowledge subgraph regarding the "value greater than" relationship type can be constructed.

[0035] Based on Figure 2A and 2BSimilar principles can be used to construct knowledge subgraphs for sensors for each relationship type. For example, knowledge subgraphs can be constructed based on relationship types such as "in the same subsystem", "upstream", etc. For example, subsystems can include engine control systems, chassis control systems, body control systems, navigation systems, etc. The sensors included in a subsystem can be constructed into a corresponding knowledge subgraph. For example, the sensors of the engine control system include air flow sensors, throttle position sensors, accelerator pedal position sensors, intake air temperature sensors, coolant temperature sensors, camshaft position sensors, crankshaft position sensors, oxygen sensors, knock sensors, etc. Thus, a knowledge subgraph can be established among the sensors of the relationship type "in the same engine control system". Similarly, a knowledge subgraph can be established among the sensors of the relationship type "in the same chassis control system", a knowledge subgraph can be established among the sensors of the relationship type "in the same body control system", and so on. In one embodiment, for example, the set of knowledge subgraphs of relationship types such as "in the same engine control system", "in the same chassis control system", "in the same body control system", etc. can be used as the knowledge subgraph of the relationship type "in the same subsystem". Based on and Figure 2B Similar principles can be used to establish a knowledge subgraph of the relationship type r1 of "upstream". For example, if sensor e1 is logically or physically upstream of sensor e2, then the knowledge fact (e1, r1, e2) of this relationship type can be established. For example, the accelerator pedal position sensor e1 is logically upstream of the speed sensor e2, or for another example, the engine speed sensor e1 is logically upstream of the speed sensor e2, or for another example, the front exhaust pipe pressure sensor e1 is physically upstream of the rear exhaust pipe pressure sensor e2, and so on.

[0036] It can be understood that for different devices 100, knowledge subgraphs of each relationship type can be constructed based on the existing knowledge of the sensors 100 of the device 100, and the set of these knowledge subgraphs constitutes the knowledge graph of the sensors of the device 100 It can be understood that the knowledge subgraph of each relationship type can be represented in the form of a corresponding adjacency matrix and sensor entity matrix.

[0037] Figure 3 The structural schematic diagram of an anomaly detection model for anomaly detection according to an embodiment is shown.

[0038] Still taking the vehicle as an example of the device 100 to illustrate Figure 3 The structure and training process of the shown anomaly detection model 300. The preprocessing module 310 preprocesses the input data D1 to obtain the input data D2. The input data D1 is the sensor data of multiple sensors of the vehicle 100. The multiple sensors of the vehicle 100 can include those combined above Figure 2A and2B The various vehicle sensors described may include more or fewer vehicle sensors in different implementations. For one sensor e i For, the input data D1 i is a sequence of sensor data samples {x i1 , x i2 , …} sampled by the sensor at multiple time points. The preprocessing module 310 uses a sliding time window to preprocess the input data sample sequence D1 i = {x i1 , x i2 , …} to obtain a short sequence of data samples D2 corresponding to each time period of the sliding time window ij , where i represents the i-th sensor, j represents the j-th time period, and each time period includes t samples. Therefore, the data sample of the j-th time period of the i-th sensor can be expressed as D2 ij = X ij ∈ R t . The preprocessed data of the i-th sensor can be expressed as D2 i = {X ij ∈ R t} j＝1…n , where n represents the number of time periods. Correspondingly, for multiple sensors with a quantity of N, the input data preprocessed by the preprocessing module 310 is expressed as D2 = {X j ∈ R N×t} j＝1…n . In other words, each input data X j includes N time sample sequences of N sensors, and each time sample sequence includes t samples in time order. It can be understood that the j-th time period and the j + 1-th time period corresponding to two adjacent input data X j and X j+1 may overlap or be adjacent

[0039] The first neural network model 3210 in the anomaly processing model 300 processes the input sensor data X j to obtain a first feature representation H j = f θ (X j ) = {h ji ∈ R m} i＝1,…,N ∈ R N×m , where i represents the i-th sensor, m represents the dimension of the feature vector corresponding to each sensor, h ji represents the feature vector of the i-th sensor, and f θLet the first neural network 3210 represent an encoded neural network, and let θ represent the learnable parameters of the first neural network model 3210. In one embodiment, the first neural network model 3210 is implemented by a Recurrent Neural Network (RNN). For example, the first neural network model 3210 is implemented by a Long Short-Term Memory (LSTM) neural network. The LSTM network is a neural network model known in the art for processing time series samples, so its details will not be elaborated here. In one embodiment, the first neural network model 3210 can also be implemented using other chronological order networks, such as by a Temporal Convolutional Network (TCN). In one embodiment, the first neural network model 3210 can also be implemented using a Transformer model.

[0040] The second neural network model 3220 in the anomaly handling model 300 is based on the first feature representation H of the sensor data j Reconstruct the data graphs of the multiple sensors. In one embodiment, the second neural network model 3310 is implemented by a Graph Attention Network (GAT). For the knowledge graph G of the multiple sensors K For each relationship type r included in s , based on the first feature representation H of the multiple sensors through the GAT model j Reconstruct the adjacency matrix of the multiple sensors The adjacency matrix is represented as an N×N matrix, where the element a ij represents the probability that there is a relationship r between the i-th sensor and the j-th sensor s . It can be understood that any GAT model can be used to reconstruct the adjacency matrix of the multiple sensors based on the sensor data feature H of the multiple sensors j Reconstruct the adjacency matrix of the multiple sensors In one example, the following formula (1) can be used to calculate the data graph adjacency matrix where softmax(·) represents the activation function, the matrices and represent the learnable parameters in the GAT model, r s represents the knowledge graph of the multiple sensors included in the s-th relationship type among the

[0041] After obtaining the adjacency matrix of the data graph for each relationship type r s the data graph adjacency matrix it is possible to reconstruct the data graph feature representation of the multiple sensors based on this data graph adjacency matrix and the sensor data feature H j For example, the data graph feature representation p of the multiple sensors can be calculated through the following equations (2) to (4) j : where σ(·) represents the Sigmoid activation function represents the degree matrix of the data graph adjacency matrix and the matrix represents the learnable parameters in the GAT model

[0042] In the example shown in equations (1) to (4), when the number of relationship types is multiple, the data graph feature representation p of the multiple sensors is obtained through heterogeneous data subgraphs corresponding to relationship types j Accordingly, the second neural network model 3220 can be referred to as a heterogeneous graph attention network model, and the data graph feature representation p j is referred to as a heterogeneous data graph feature representation

[0043] As Figure 3 shown, the false knowledge graph acquisition module 330 obtains the false knowledge graph G K based on the knowledge graph G FK of the multiple sensors of the vehicle 100. For example, the knowledge graph G K can be the knowledge graph of vehicle sensors described above in combination with Figure 2A and 2B The false knowledge graph acquisition module 330 obtains the false knowledge graph G by randomly modifying one or more knowledge fact items in the knowledge fact set The modification can include deleting or adding knowledge fact items, and can also include changing the information in the knowledge fact items. For example, swapping the order of two entities in the knowledge fact item, changing the relationship type in the knowledge fact item, and randomly changing one entity in the knowledge fact item into a third entity FK The third neural network model 340 processes the knowledge graph G

[0044] K and the false knowledge graph G FK respectively to obtain the knowledge graph feature representation q j and the false knowledge graph feature representation q​Fj , where j corresponds to the above sensor data X j In one embodiment, the third neural network model 340 can be implemented by a graph convolutional neural network (GCN). In another embodiment, the third neural network model 340 can be implemented by a relational graph convolutional neural network (RGCN). GCN and RGCN are both existing neural network models in the art, which are used to encode entities and relationships between entities in a graph into feature representations of an embedding space, so that the feature representation contains both information about the entity and information about the relationship between entities. It can be understood that any neural network model that encodes graph data can be used to implement the third neural network model 340.

[0045] For example, taking RGCN as an example, for the sensor data X in the jth time period j The corresponding fake knowledge graph G FKj , the third neural network model 340 encodes it as Q Fj =g θ (G FKj )={Q Fji ∈R m} i＝1,…,N ∈R N×m , and then through Get the fake knowledge graph feature representation q Fj , where q Fji represents the feature representation of the i-th sensor in the fake knowledge graph, g θ (·) represents the third neural network 340 as the encoding neural network, and θ represents the learnable parameters of the third neural network model 340; similarly, for the true knowledge graph G Kj , the third neural network model 340 encodes it as Q j =g θ (G Kj )={q ji ∈R m} i＝1,…,N ∈R N×m , and then through Get the true knowledge graph feature representation q j , where q ji Represents the feature representation of the i-th sensor in the true knowledge graph.

[0046] For example, taking GCN and RGCN as examples, for the sensor data X in the jth time period j The corresponding fake knowledge graph G FKj Each relationship type r s, the third neural network model 340 encodes the corresponding false knowledge sub-graph into By aggregating the encoded features of multiple false knowledge sub-graphs to obtain Furthermore, through Obtain the false knowledge graph feature representation q Fj , where q Fji Represents the feature representation of the i-th sensor in the false knowledge graph, Represents the third neural network 340 as the encoding neural network, and θ represents the learnable parameters of the third neural network model 340; similarly, for the true knowledge graph G Kj , the third neural network model 340 encodes each relationship type r s The corresponding knowledge sub-graph is encoded as Furthermore, the true knowledge graph is encoded as Furthermore, through Obtain the knowledge graph feature representation q j , where q ji Represents the feature representation of the i-th sensor in the true knowledge graph.

[0047] The loss determination module 350 determines the loss value L based on the data graph feature representation p j , the knowledge graph feature representation q j And the false knowledge graph feature representation q Fj , determine the loss value L. For example, the loss value L can be determined by the following formula (5): Among them, β is a hyperparameter, σ(·) is the Sigmoid activation function, j represents the j-th time period among n time periods, and the calculation results for n time periods are summed in formula (5) to obtain the loss value.

[0048] It can be understood that the loss value can be determined in any suitable way. For example, the average of the calculation results for n time periods can also be used to obtain the loss value. For example, the cosine similarity is used in the loss function shown in formula (5) to evaluate the distance between feature representations. It can be understood that other distance measurement methods can be used to calculate the distance between feature representations. Minimizing this loss is equivalent to increasing the similarity between the data graph nodes and the true knowledge and reducing the similarity between the data graph nodes and the false knowledge. In one embodiment, the learnable parameters of the neural network model 300 are updated based on the loss value L, where the learnable parameters include the learnable parameters in the first, second, and third neural network models 3210, 3220, and 340. For example, the learnable parameters of the neural network model 300 can be updated based on the loss value L by the method of gradient descent. For example, the learnable parameters of the neural network model 300 can be updated based on the loss value L by the Adam method known in the art.

[0049] Although in Figure 3 the anomaly detection model 300 is described as including modules 310 to 350, it can also be understood that the anomaly detection model 300 includes modules 320 and 340, or includes modules 320, 340, and 350, while the preprocessing module 310 and the false knowledge graph acquisition module 330 are processing modules outside the anomaly detection model 300.

[0050] The anomaly detection model 300 has been described above in combination with the training process. After the model is trained, the trained anomaly detection model 300 can be used to detect whether an anomaly occurs based on the sensor data obtained in real time by the vehicle 100. When an anomaly occurs, the abnormal situation will be reflected in the changes in the sensor data of a single or multiple sensors, and further reflected in the changes in the relationships between the sensors. Referring to the loss function shown in formula (5), the changes in the relationships between the sensors will cause to decrease, which will make the first item become larger. On the other hand, the similarity between the sensor data from the sensors and the false knowledge will increase, which makes the second item

[0051] become larger. The combined effect of these two items can help detect anomalies better. Therefore, the loss value shown in formula (5) can be directly used as an anomaly score. For example, whether an anomaly has occurred can be detected by setting a threshold. Therefore, in the stage of performing anomaly detection using the trained anomaly detection model 300, the module 350 can be called the anomaly metric determination module 350, which outputs an anomaly metric value. Further, it is determined whether an anomaly is detected by comparing the anomaly metric value with a threshold. j When performing anomaly detection through the trained anomaly detection model 300, the preprocessing module 310 preprocesses the tactile sensor data D1 from multiple sensors to obtain the preprocessed sensor data D2. The preprocessing process is the same as the preprocessing in the above training stage, except that the sensor data D1 is the data detected in real time by the sensors on the device 100. The data graph reconstruction module 320 processes the sensor data D2 to obtain the corresponding data graph feature representation p FK . Correspondingly, the false knowledge graph determination module 330 obtains the false knowledge graph G K , and the knowledge graph encoding module 340 processes the knowledge graph G FK and the false knowledge graph G j to obtain the corresponding knowledge graph feature representation q Fj and the false knowledge graph feature representation q jRecalculate the knowledge graph feature representation q for all j , and only need to obtain the fake knowledge graph G again FKj and calculate the fake knowledge graph feature representation q through the model 340 Fj . The anomaly metric determination module 350 is based on the data graph feature representation p j , the knowledge graph feature representation q j and the fake knowledge graph feature representation q Fj to generate an anomaly metric. Then, it can be determined whether an anomaly has occurred based on this anomaly metric value. For example, it is determined whether an anomaly has occurred based on the comparison between this anomaly metric value and an anomaly threshold

[0052] Figure 4 FIG. shows a method for anomaly detection according to an embodiment

[0053] In step 410, reconstruct the data graph feature representation of the multiple sensors based on the sensor data from the multiple sensors

[0054] In step 420, generate the knowledge graph feature representation of the multiple sensors based on the knowledge graph about the multiple sensors

[0055] In step 430, generate the fake knowledge graph feature representation of the multiple sensors based on the fake knowledge graph corresponding to the knowledge graph

[0056] In step 440, determine the anomaly metric value based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation, where the anomaly metric value is used to determine whether an anomaly has occurred in the multiple sensors

[0057] In one embodiment, the method 400 may further include a step of determining whether an anomaly has occurred based on the determined anomaly metric value and an anomaly threshold

[0058] In one embodiment, the knowledge graph includes an entity set, an entity relationship set, and a knowledge fact set. The entity set includes multiple entities corresponding to the multiple sensors. The entity relationship set includes one or more relationship types. The knowledge fact set includes multiple knowledge fact items. Each knowledge fact item includes two entities among the multiple entities and the relationship type between the two entities. Each relationship type and the corresponding knowledge fact subset in the knowledge graph can be represented as a knowledge subgraph, which can be represented by a corresponding adjacency matrix and an entity subset

[0059] In one embodiment, the fake knowledge graph is obtained by randomly modifying one or more knowledge fact items in the knowledge fact set of the knowledge graph

[0060] In one embodiment, at step 420, the knowledge graph feature representation is generated based on the knowledge graph by the RGCN model, and at step 430, the fake knowledge graph feature representation is generated based on the fake knowledge graph by the RGCN model.

[0061] In one embodiment, at step 420, for one or more relationship types in the knowledge graph, one or more corresponding knowledge sub-graph feature representations are generated based on one or more knowledge sub-graphs respectively corresponding to the one or more relationship types, and the knowledge graph feature representation is produced based on the one or more knowledge sub-graph feature representations. At step 430, for one or more relationship types in the fake knowledge graph, one or more corresponding fake knowledge sub-graph feature representations are generated based on one or more fake knowledge sub-graphs respectively corresponding to the one or more relationship types, and the fake knowledge graph feature representation is produced based on the one or more fake knowledge sub-graph feature representations.

[0062] In one embodiment, at step 410, the data graph feature representation of the multiple sensors is reconstructed based on the sensor data from the multiple sensors by the GAT network model.

[0063] In one embodiment, at step 410, for one or more relationship types included in the knowledge graph, one or more corresponding data sub-graph feature representations are respectively reconstructed based on the sensor data by the GAT network model; the data graph feature representation is generated based on the one or more data sub-graph feature representations.

[0064] In one embodiment, at step 410, one or more corresponding data graph adjacency matrices are respectively reconstructed based on the sensor data by the GAT network model; the one or more data sub-graph feature representations are respectively generated based on the one or more data graph adjacency matrices.

[0065] In one embodiment, at step 410, a first feature representation is generated based on the sensor data from the multiple sensors by a first neural network model; the data graph feature representation of the multiple sensors is reconstructed based on the first feature representation of the multiple sensors by the GAT network model. In one embodiment, the first neural network model is one of an RNN model, an LSTM model, and a transformer encoder model.

[0066] In one embodiment, the multiple sensors are sensors in a device, and the device is one of a vehicle, an Internet of Things device, and an automatic control device.

[0067] Figure 5 A method for training an anomaly detection model according to one embodiment is shown.

[0068] In step 510, the anomaly detection model reconstructs the data graph feature representation of the multiple sensors based on the sensor data from the multiple sensors.

[0069] In step 520, the anomaly detection model generates the knowledge graph feature representation of the multiple sensors based on the knowledge graph about the multiple sensors.

[0070] In step 530, the anomaly detection model generates the fake knowledge graph feature representation of the multiple sensors based on the fake knowledge graph corresponding to the knowledge graph.

[0071] In step 540, the loss value is determined based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation.

[0072] In step 550, the learnable parameters of the anomaly detection model are updated based on the loss value.

[0073] In one embodiment, in step 520, the knowledge graph feature representation is generated based on the knowledge graph by the RGCN model in the anomaly detection model, and in step 530, the fake knowledge graph feature representation is generated based on the fake knowledge graph by the RGCN model.

[0074] In one embodiment, in step 520, for one or more relationship types in the knowledge graph, one or more knowledge subgraph feature representations corresponding to the one or more relationship types are generated based on one or more knowledge subgraphs respectively corresponding to the one or more relationship types, and the knowledge graph feature representation is produced based on the one or more knowledge subgraph feature representations. In step 530, for one or more relationship types in the fake knowledge graph, one or more fake knowledge subgraph feature representations corresponding to the one or more relationship types are generated based on one or more fake knowledge subgraphs respectively corresponding to the one or more relationship types, and the fake knowledge graph feature representation is produced based on the one or more fake knowledge subgraph feature representations.

[0075] In one embodiment, in step 510, the data graph feature representation of the multiple sensors is reconstructed based on the sensor data from the multiple sensors by the GAT network model in the anomaly detection model.

[0076] In one embodiment, in step 510, for one or more relationship types included in the knowledge graph, one or more data subgraph feature representations corresponding to the one or more relationship types are respectively reconstructed based on the sensor data by the graph attention neural network model; the data graph feature representation is generated based on the one or more data subgraph feature representations.

[0077] In one embodiment, at step 510, the GAT network model respectively reconstructs one or more data graph adjacency matrices corresponding to the one or more relationship types based on the sensor data; and generates one or more data subgraph feature representations based on the one or more data graph adjacency matrices.

[0078] In one embodiment, at step 510, the first neural network model in the anomaly detection model generates a first feature representation of the multiple sensors based on the sensor data from the multiple sensors; and the GAT network model reconstructs the data graph feature representation of the multiple sensors based on the first feature representation of the multiple sensors. In one embodiment, the first neural network model is one of an RNN model, an LSTM model, and a Transformer encoder model.

[0079] Figure 6 FIG. shows a device for anomaly detection according to one embodiment.

[0080] The anomaly detection device 600 includes: a data graph reconstruction module 610 that reconstructs the data graph feature representation of the multiple sensors based on the sensor data from the multiple sensors; a knowledge graph encoding module 620 that generates the knowledge graph feature representation of the multiple sensors based on the knowledge graph about the multiple sensors, and generates the false knowledge graph feature representation of the multiple sensors based on the false knowledge graph corresponding to the knowledge graph; and a metric value determination module 630 that determines an anomaly metric value based on the data graph feature representation, the knowledge graph feature representation, and the false knowledge graph feature representation, where the anomaly metric value is used to determine whether an anomaly occurs in the multiple sensors.

[0081] In one embodiment, the anomaly detection device 600 may further include an anomaly determination module that determines whether an anomaly occurs in the multiple sensors based on the anomaly metric value, for example, determines whether an anomaly occurs in the multiple sensors based on the anomaly metric value and an anomaly threshold.

[0082] In one embodiment, the data graph reconstruction module 610 includes a GAT network model that reconstructs the data graph feature representation of the multiple sensors based on the sensor data from the multiple sensors. In one embodiment, for one or more relationship types included in the knowledge graph, the GAT network model respectively reconstructs one or more data subgraph feature representations corresponding to the one or more relationship types based on the sensor data, and generates the data graph feature representation based on the one or more data subgraph feature representations. In one embodiment, the GAT network model respectively reconstructs one or more data graph adjacency matrices corresponding to the one or more relationship types based on the sensor data, and generates the one or more data subgraph features based on the one or more data graph adjacency matrices.

[0083] In one embodiment, the data graph reconstruction module 610 includes a first neural network model that generates a first feature representation of the plurality of sensors based on sensor data from the plurality of sensors; the GAT network model reconstructs a data graph feature representation of the plurality of sensors based on the first feature representation of the plurality of sensors. In one embodiment, the first neural network model is one of an RNN model, an LSTM model, and a transformer encoder model.

[0084] Figure 7 FIG. shows a block diagram of an apparatus for anomaly detection according to one embodiment.

[0085] Apparatus 700 includes a plurality of sensors 710, one or more processors 720, and one or more memories 730. The memory 730 stores computer-executable instructions that, when executed by the one or more processors 720, perform the various operations and functions for anomaly detection described above in connection with Figures 1-6 description.

[0086] Figure 8 FIG. shows a block diagram of a processing apparatus according to one embodiment.

[0087] The processing apparatus or processing system 800 includes one or more control units or processing units 810 that execute one or more machine-readable instructions stored or encoded in a machine-readable storage medium (i.e., memory 820). In one embodiment, the processing unit 810 is configured to perform the various operations and functions described above in connection with Figures 1-6 description when executing program instructions.

[0088] Although not shown in Figure 7 and 8 those skilled in the art will appreciate that apparatuses 700 and 800 may also include various other components, such as various communication modules, bus modules, and possibly user interface modules, etc.

[0089] According to one embodiment, a program product such as a non-transitory machine-readable medium is provided. The non-transitory machine-readable medium may have instructions that, when executed by the processing unit 720 or 810, are capable of performing the various operations and functions described above in connection with each embodiment of the present application Figures 1-6 description.

[0090] According to one embodiment, a computer program product is provided. The computer program product includes machine-executable instructions that, when executed by the processing unit 720 or 810, are capable of performing the various operations and functions described above in connection with each embodiment of the present application Figures 1-6 description.

[0091] The specific embodiments described above in conjunction with the accompanying drawings describe exemplary embodiments, but do not represent all embodiments that can be implemented or fall within the scope of protection of the claims. The term "example" or "exemplary" used throughout this specification means "serving as an example, instance, or illustration" and does not mean "preferred" or "advantageous" over other embodiments. For the purpose of providing an understanding of the described technology, the specific embodiments include specific details. However, these technologies can be implemented without these specific details. In some instances, well-known structures and devices are shown in block diagram form to avoid obscuring the concepts of the described embodiments.

[0092] The foregoing description of the content of this application is provided to enable any ordinary person skilled in the art to implement or use the content of this application. Various modifications to the content of this application will be obvious to those of ordinary skill in the art, and the general principles defined herein can also be applied to other variations without departing from the scope of protection of the content of this application. Therefore, the content of this application is not limited to the examples and designs described herein, but is consistent with the broadest scope that conforms to the principles and novel features disclosed herein.

Claims

1. A method for anomaly detection, comprising: Reconstructing a data graph feature representation of the plurality of sensors based on sensor data from the plurality of sensors; Generating a knowledge graph feature representation of the plurality of sensors based on a knowledge graph about the plurality of sensors; Generating a false knowledge graph feature representation of the plurality of sensors based on a false knowledge graph corresponding to the knowledge graph; Determining an anomaly metric value based on the data graph feature representation, the knowledge graph feature representation, and the false knowledge graph feature representation, wherein the anomaly metric value is used to determine whether an anomaly occurs in the plurality of sensors.

2. The method according to claim 1, wherein, The knowledge graph includes an entity set, an entity relationship set, and a knowledge fact set. The entity set includes a plurality of entities corresponding to the plurality of sensors. The entity relationship set includes one or more relationship types. The knowledge fact set includes a plurality of knowledge fact items, and each knowledge fact item includes two entities among the plurality of entities and the relationship type between the two entities.

3. The method according to claim 2, wherein The false knowledge graph is obtained by randomly modifying one or more knowledge fact items in the knowledge fact set of the knowledge graph.

4. The method according to one of claims 1 to 3, wherein, The generating the knowledge graph feature representation of the plurality of sensors includes: generating the knowledge graph feature representation based on the knowledge graph through a relational graph convolutional network (RGCN) model; Wherein, the generating the false knowledge graph feature representation of the plurality of sensors includes: generating the false knowledge graph feature representation based on the false knowledge graph through the RGCN model.

5. The method according to one of claims 1 to 3, wherein, The reconstructing the data graph feature representation of the plurality of sensors includes: Reconstructing the data graph feature representation of the plurality of sensors based on sensor data from the plurality of sensors through a graph attention (GAT) network model.

6. The method according to claim 5, wherein, The reconstructing the data graph feature representation of the plurality of sensors includes: For one or more relationship types included in the knowledge graph, respectively reconstructing one or more data sub-graph feature representations corresponding to the one or more relationship types based on the sensor data through the GAT network model; Generating the data graph feature representation based on the one or more data sub-graph feature representations.

7. The method according to claim 6, wherein, The reconstructing the one or more data sub-graph feature representations corresponding to the one or more relationship types includes: Respectively reconstructing one or more data graph adjacency matrices corresponding to the one or more relationship types based on the sensor data through the GAT network model; Generating the one or more data sub-graph feature representations respectively based on the one or more data graph adjacency matrices.

8. The method according to claim 5, wherein The reconstructing the data graph feature representation of the plurality of sensors includes: Generating a first feature representation based on sensor data from the plurality of sensors through a first neural network model; Reconstructing the data graph feature representation of the plurality of sensors based on the first feature representation of the plurality of sensors through the GAT network model.

9. The method according to claim 1, wherein The plurality of sensors are sensors in a device, and the device is one of a vehicle, an Internet of Things device, and an automatic control device.

10. A method for training an anomaly detection model, comprising: The anomaly detection model reconstructs a data graph feature representation of the multiple sensors based on sensor data from the multiple sensors; The anomaly detection model generates a knowledge graph feature representation of the multiple sensors based on a knowledge graph about the multiple sensors; The anomaly detection model generates a fake knowledge graph feature representation of the multiple sensors based on a fake knowledge graph corresponding to the knowledge graph; Determine a loss value based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation; and Update learnable parameters of the anomaly detection model based on the loss value.

11. The method according to claim 10, wherein, The generating the knowledge graph feature representation of the multiple sensors includes: generating the knowledge graph feature representation based on the knowledge graph through a relational graph convolutional network (RGCN) model in the anomaly detection model; wherein, the generating the fake knowledge graph feature representation of the multiple sensors includes: generating the fake knowledge graph feature representation based on the fake knowledge graph through the RGCN model.

12. The method according to claim 10, wherein The reconstructing the data graph feature representation of the multiple sensors includes: Reconstructing the data graph feature representation of the multiple sensors based on sensor data from the multiple sensors through a graph attention (GAT) network model in the anomaly detection model.

13. The method according to claim 12, wherein, The reconstructing the data graph feature representation of the multiple sensors includes: For one or more relationship types included in the knowledge graph, reconstructing one or more data sub-graph feature representations corresponding to the one or more relationship types respectively based on the sensor data through the graph attention neural network model; Generating the data graph feature representation based on the one or more data sub-graph feature representations.

14. The method according to claim 13, wherein, The reconstructing the one or more data sub-graph feature representations corresponding to the one or more relationship types respectively includes: Reconstructing one or more data graph adjacency matrices corresponding to the one or more relationship types respectively based on the sensor data through the GAT network model; Generating the one or more data sub-graph feature representations based on the one or more data graph adjacency matrices respectively.

15. The method according to claim 12, wherein, The reconstructing the data graph feature representation of the multiple sensors includes: Generating a first feature representation of the multiple sensors based on sensor data from the multiple sensors through a first neural network model in the anomaly detection model; Reconstructing the data graph feature representation of the multiple sensors based on the first feature representation of the multiple sensors through the GAT network model.

16. An apparatus for anomaly detection, comprising: A data graph reconstruction module that reconstructs a data graph feature representation of the multiple sensors based on sensor data from the multiple sensors; A knowledge graph encoding module that generates a knowledge graph feature representation of the multiple sensors based on a knowledge graph about the multiple sensors, and generates a fake knowledge graph feature representation of the multiple sensors based on a fake knowledge graph corresponding to the knowledge graph; A metric determination module that determines an anomaly metric value based on the data graph feature representation, the knowledge graph feature representation, and the fake knowledge graph feature representation, wherein the anomaly metric value is used to determine whether the multiple sensors are abnormal.

17. A device for anomaly detection, comprising: a plurality of sensors; one or more processors; and one or more memories storing computer-executable instructions that, when run by the one or more processors, perform the operations of any one of claims 1 to 9.

18. A processing device, comprising: one or more processors; and one or more memories storing computer-executable instructions that, when run by the one or more processors, perform the operations of any one of claims 1 to 15.

19. A machine-readable storage medium storing executable instructions that, when executed, cause one or more processors to perform the method as recited in any one of claims 1 to 15.

20. A computer program product comprising executable instructions that, when executed, cause one or more processors to perform the method as recited in any one of claims 1 to 15.

Images