Anomaly detection method based on graph deviation network

Abstract

The invention discloses an anomaly detection method based on a graph deviation network, and particularly relates to the field of anomaly detection and health assessment. Comprising the following steps: S1, data acquisition: acquiring related data of equipment operation as original data; s2, data preprocessing: preprocessing the original data acquired in the step S1; s3, prediction model acquisition: constructing a prediction model based on the data processed in the step S2; s4, anomaly detection: explaining abnormal behaviors occurring in the system based on deviation score detection; and S5, health assessment: making quantitative description on the health degree of the electronic equipment based on the maximum deviation score in the step S4. By the adoption of the technical scheme, the problem that an existing anomaly detection algorithm cannot detect a specific module or subsystem with a fault is solved, and a basis is provided for planned maintenance of the system.

Description

Technical Field

[0001] The present invention relates to the field of anomaly detection and health assessment, and particularly relates to an anomaly detection method based on a graph deviation network. Background Art

[0002] Industrial equipment has a complex structure, numerous components, and a harsh working environment, making it extremely prone to system failures. On the one hand, industrial equipment failures may directly cause equipment damage and even seriously threaten the safety of industrial infrastructure; on the other hand, industrial equipment failures may lead to an increase in production line downtime, resulting in huge economic losses. Due to the large-scale and complexity of industrial equipment, failures of any component or equipment may lead to system downtime and even cause serious casualties and huge economic losses. To ensure the safety of the production process, enterprises usually need experienced engineers to conduct regular inspections or repairs on industrial equipment according to their experience and rules to prevent secondary damage and equipment downtime. However, this method is essentially preventive maintenance, which is costly and overly dependent on human experience, and has limited ability to ensure the health of industrial equipment and the efficient operation of the equipment. Anomaly detection based on deep learning can significantly improve the accuracy of anomaly detection, while health assessment can give a quantitative evaluation of the current operating state of the system / equipment, providing support for equipment maintenance decisions, thereby greatly improving equipment operation and maintenance efficiency and reducing operation and maintenance costs.

[0003] The main network structures currently used in anomaly detection algorithms based on deep learning include Long Short-Term Memory (LSTM), Convolutional Neural Network (CNN), etc. These methods can only determine whether the system is in a normal or abnormal working state, and cannot explain which modules or subsystems are faulty and cause the system anomaly. On the other hand, when the system is in a normal working state, it is impossible to make a quantitative evaluation of the health of the system. Therefore, there is an urgent need for an anomaly detection method that can detect specific faulty modules or faulty systems. Summary of the Invention

[0004] The present invention aims to provide an anomaly detection method based on a graph deviation network, which solves the problem that existing anomaly detection algorithms cannot detect specific faulty modules or subsystems.

[0005] To achieve the above object, the technical solution of the present invention is as follows: An anomaly detection method based on a graph deviation network, comprising the following steps:

[0006] S1. Data collection: Collect relevant data of equipment operation as raw data;

[0007] S2. Data preprocessing: Preprocess the raw data collected in step S1;

[0008] S3. Prediction model acquisition: Build a prediction model based on the data processed in step S2;

[0009] S4. Anomaly detection: Explain the abnormal behavior of the system based on deviation score detection;

[0010] S5. Health assessment: Make a quantitative description of the health of the electronic equipment based on the maximum deviation score in step S4.

[0011] Furthermore, the preprocessing method in step S2 is as follows:

[0012] Feature selection: Select feature data related to the task according to the task requirements;

[0013] Data alignment: The system monitoring data is located in multiple parsing files. By analyzing the system operation mechanism, align the required data;

[0014] Data cleaning: Delete duplicate values and process outliers. Processing outliers includes removal, trimming, replacement, induction, and transformation; Fill missing values with the mean, median, or the value of the previous moment.

[0015] Furthermore, the method for building the prediction model in step S3 is as follows:

[0016] S3.1. Sensor embedding: Introduce an embedding vector for each sensor to represent the features of the sensor, where d is the dimension of the embedding vector, N represents the number of sensors, the embedding vector is initialized to random values, and then trained together with the rest of the prediction model;

[0017] S3.2. Graph structure learning: Use a directed graph to represent the dependency relationship between sensors. Different nodes in the directed graph represent different sensors, and the edges between nodes represent the dependency relationship between sensors;

[0018] S3.3. In order to obtain the sensors that generate abnormal behavior, predict the behavior of sensors based on the existing data, and then identify the abnormal behavior of sensors by comparing the deviation degree between the predicted value and the actual observed value.

[0019] Furthermore, the specific method in step S3.2 is as follows: In order to determine whether there is a dependency relationship between sensors i and j, first use the formula:. Calculate the similarity between sensors i and j:

[0020]

[0021] where, e ij is the similarity between sensors i and j, ||v i || and ||v j||respectively represent v i and v j modulus;

[0022] Select the k sensors with the highest similarity to sensor i. Assume that these k sensors will have a significant impact on sensor i, as shown in the following formula:

[0023] A ji ={j∈TopK({e ki :k∈C i})}, (2)

[0024] Among them, TopK(·) represents the sensor indices corresponding to the largest k values.

[0025] Furthermore, the specific method of step S3.3 is as follows:

[0026] Introduce a graph attention-based feature extractor to fuse the information of nodes with adjacent nodes according to the learned graph structure to obtain the relationship between sensors; the calculation method of the aggregated representation of sensor i is as follows:

[0027]

[0028] Among them, z i (t) is the aggregated representation of sensor i at time t, ReLU(·) is a non-linear activation function, is a trainable parameter matrix, x i (t) and x j (t) are the model inputs. The definition of the model input at time t is as follows:

[0029] x (t) :=[s (t-w) ,s (t-w+1) ,…,s (t-1) , (4)

[0030] Among them, w is the size of the sliding window, s t-i (i = 1,2,…,w); α i,j is the attention coefficient, and its calculation method is as follows:

[0031]

[0032] Among them, represents the concatenation operation, a is the learning coefficient vector of the attention mechanism, and LeakyReLU(·) is a non-linear activation function;

[0033] After obtaining the aggregate representation of N sensors, the predicted value of the sensor at time t is calculated using the following formula:

[0034]

[0035] in, is the predicted value of the sensor data at time t, Represents element-wise multiplication;

[0036] Finally, the mean square error is used as the loss function to train the network, as shown below:

[0037]

[0038] Furthermore, the specific method of step S4 is as follows:

[0039] First, calculate the error value Err between the predicted value and the observed value at time t. The formula is as follows:

[0040]

[0041] Secondly, the error value of each sensor is robustly normalized to prevent the error value of any one sensor from having too large an impact on other sensors:

[0042]

[0043] Among them, a i (t) is the normalized outlier value, and

[0044] median and interquartile range, respectively;

[0045] Then, to calculate the overall anomaly at time t, the sensors are aggregated using the max function:

[0046] A(t)=max i a i (t) (12);

[0047] At time t, if A(t) is greater than a maximum deviation score A max , it is marked as abnormal state.

[0048] Furthermore, the specific method of step S5 is as follows: Get the maximum deviation score A max Finally, the health of the electronic equipment is described in percentage form, and the calculation method is as follows:

[0049]

[0050] Among them, D is the health degree.

[0051] Compared with the prior art, the beneficial effects of this solution are as follows:

[0052] 1. This solution provides an anomaly detection method based on a graph deviation network, which solves the following three technical problems:

[0053] (1) General anomaly detection methods based on deep learning can only determine whether the system is in a normal or abnormal state, and cannot determine which modules or subsystems cause the system failure state;

[0054] (2) After determining that the system is in an abnormal state, it cannot provide effective information to assist in troubleshooting the source of the failure;

[0055] (3) After determining that the system is in a normal working state, it cannot make a quantitative evaluation of the system's health.

[0056] 2. This solution is based on a graph convolutional neural network. By using the system operation data to learn the graph structure of the system, then calculating the deviation score of the system, and further completing the anomaly detection task of the system. And based on the learned system graph structure and the deviation scores of each sensor at each moment, the path that may cause the system to be abnormal can be found, thus providing a basis for troubleshooting the system anomaly. After determining that the system is in a normal state, the system health can also be calculated based on the deviation score of the system and the set maximum deviation score, providing a basis for the planned maintenance of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 is a flowchart of an anomaly detection method based on a graph deviation network of the present invention;

[0058] Figure 2 is a flowchart of constructing a prediction model in an anomaly detection method based on a graph deviation network of the present invention;

[0059] Figure 3 is a test result graph in this embodiment;

[0060] Figure 4 is the system graph structure in this embodiment;

[0061] Figure 5 is a health assessment result graph in this embodiment;

[0062] Figure 6 is a possible path graph between sensor No. 47 and sensor No. 4 in this embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0063] The present invention will be further described in detail below through specific embodiments:

[0064] Embodiment

[0065] AsFigure 1 As shown in the figure, an anomaly detection method based on a graph deviation network includes the following steps:

[0066] S1. Data collection: Collect relevant data of device operation as the original data.

[0067] S2. Data preprocessing: Preprocess the original data collected in step S1; the preprocessing method is as follows:

[0068] Feature selection: A large amount of monitoring data is included in the original data. Select the feature data related to the task according to the task requirements. Data alignment: The system monitoring data is located in multiple parsing files. By analyzing the system operation mechanism, align the required data.

[0069] Data cleaning: Delete duplicate values and process outliers. Processing outliers includes removal, trimming, replacement, induction, and transformation; fill in missing values using the mean, median, or the value of the previous moment.

[0070] S3. Obtain the prediction model: Build a prediction model based on the data processed in step S2; as Figure 2 shown, the prediction model building method is as follows:

[0071] S3.1. Sensor embedding: Different sensors have different characteristics, and these characteristics may affect each other in unknown ways. Therefore, introduce an embedding vector for each sensor to represent the characteristics of the sensor, where d is the dimension of the embedding vector, N represents the number of sensors, the embedding vector is initialized to random values, and then trained together with the rest of the prediction model.

[0072] S3.2. Graph structure learning: The connection between sensors is not necessarily symmetric. Therefore, use a directed graph to represent the dependence relationship between sensors. Different nodes in the directed graph represent different sensors, and the edges between nodes represent the dependence relationship between sensors. For a directed graph, use the adjacency matrix A to represent it. If A ij = 0, it means that node i will not affect node j. On the contrary, if it means that node i will have an impact on node j; for sensor i, use to represent its candidate connections. If there is no prior knowledge of the system, the candidate connections of sensor i at the initial moment are all sensors except itself.

[0073] To determine whether there is a dependence relationship between sensors i and j, first use the formula. Calculate the similarity between sensors i and j:

[0074]

[0075] where, e ijis the similarity between sensors i and j, ||v i || and ||v j || represent the norms of v i and v j respectively.

[0076] Then, select the k sensors with the highest similarity to sensor i. Assume that these k sensors will have a significant impact on sensor i, as shown in the following formula:

[0077] A ji = {j ∈ TopK({e ki : k ∈ C i})}, (2)

[0078] where TopK(·) represents the sensor indices corresponding to the largest k values.

[0079] S3.3. To obtain the sensors that generate abnormal behaviors, predict the behaviors of sensors based on existing data, and then identify the abnormal behaviors of sensors by comparing the deviation between the predicted values and the actual observed values.

[0080] First, introduce a graph attention-based feature extractor to fuse the information of nodes with adjacent nodes according to the learned graph structure to obtain the relationships between sensors; the aggregation representation of sensor i is calculated as follows:

[0081]

[0082] where z i (t) is the aggregation representation of sensor i at time t, ReLU(·) is a non-linear activation function, is a trainable parameter matrix, x i (t) and x j (t) are the model inputs. The definition of the model inputs at time t is as follows:

[0083] x (t) := [s (t-w) , s (t-w+1) , …, s (t-1) , (4)

[0084] where w is the size of the sliding window, s t-i (i = 1, 2, …, w); α i,j is the attention coefficient, and its calculation method is as follows:

[0085]

[0086] where, Denotes the splicing operation, a is the learning coefficient vector of the attention mechanism, and LeakyReLU(·) is the non-linear activation function.

[0087] After obtaining the aggregated representation of N sensors, the predicted value of the sensor at time t is calculated using the following formula:

[0088]

[0089] Where, is the predicted value of the sensor data at time t, denotes element-wise multiplication.

[0090] Finally, the mean squared error is used as the loss function to train the network, as shown in the following formula:

[0091]

[0092] S4. Anomaly detection: Given the learned relationships, it is necessary to calculate the individual deviation scores for each sensor and combine them into a single deviation score for each time step, so as to detect and interpret the abnormal behavior of the system based on the deviation scores.

[0093] First, calculate the error value Err between the predicted value and the observed value at time t, and the formula is as follows:

[0094]

[0095] Secondly, perform robust normalization on the error values of each sensor to prevent the error value generated by any one sensor from having too much influence on other sensors:

[0096]

[0097] Where, a i (t) is the normalized outlier, and are the median and interquartile range respectively.

[0098] Then, in order to calculate the overall anomaly at time t, the max function is used to aggregate the sensors:

[0099] A(t) = max i a i (t) (12);

[0100] At time t, if A(t) is greater than a maximum deviation score A max , it is marked as an abnormal state. The acquisition of the maximum deviation score can be selected according to specific situations, such as using extreme value theory and other methods.

[0101] S5, Health Assessment: Based on the maximum deviation score in step S4, a quantitative description of the health of the electronic equipment is made. The specific method is as follows: Obtain the maximum deviation score A max After that, a quantitative description of the health of the electronic equipment can be made based on the maximum deviation score. The health of the electronic equipment is described in the form of a percentage, and the calculation method is as follows:

[0102]

[0103] where D is the health degree.

[0104] Result Analysis:

[0105] To verify the effectiveness of the proposed method, the SWaT data is used to verify the proposed method. The SWaT dataset is constructed based on a real industrial water treatment test platform, which simulates the complex operations of a modern industrial water treatment system. The dataset is obtained by installing a variety of sensors and monitoring devices on the test platform. The data that these sensors can collect includes various physical parameters such as flow rate, pressure, and temperature, as well as system status and operation instructions. During the construction of the dataset, special attention is paid to the integrity and consistency of the data to ensure that each data point can accurately reflect the actual operating state of the system.

[0106] The verification dataset used contains 50 sensor nodes. The training dataset contains 47,520 data samples, all of which are normal data. The test data contains 39,498 normal data and 5,493 abnormal data. The test results are as Figure 3 shown. The precision rate, recall rate, and F1 score are shown in Table 1:

[0107] Table 1 Test Results

[0108]

[0109]

[0110] The learned graph structure is as Figure 4 shown.

[0111] After setting an appropriate maximum deviation score, the health assessment of the system can be completed using the deviation score of the system at each moment, as Figure 5 shown. Assume that from left to right are the moments t1, t2, and t3, where the system is determined to be faulty at the moment t3. Obviously, the system has shown a trend of abnormal occurrence in advance.

[0112] After determining that the system is in an abnormal state, analyzing the deviation scores of each sensor can further provide a basis for troubleshooting anomalies. For example, in the above example, at times t1 and t2, it was found that the deviation score of sensor 47 was relatively high, and at time t3, the deviation score of sensor 4 was higher than the maximum anomaly value, so the system was marked as abnormal. Combining the learned system diagram structure, the path from sensor 47 to sensor 4 can be found, such as Figure 6 As shown, three possible paths are marked with green arrows.

[0113] The above are only embodiments of the present invention, and common knowledge such as specific structures and / or characteristics known in the solution is not described in detail here. It should be noted that for those skilled in the art, without departing from the structure of the present invention, several deformations and improvements can still be made, which should also be regarded as the protection scope of the present invention, and these will not affect the implementation effect of the present invention and the practicality of the patent. The protection scope required by this application should be based on the content of its claims, and the specific implementation manners described in the specification can be used to interpret the content of the claims.

Claims

1. An anomaly detection method based on a graph deviation network, characterized in that It includes the following steps: S1. Data collection: Collect relevant data of the equipment operation as the original data; S2. Data preprocessing: Preprocess the original data collected in step S1; S3. Prediction model acquisition: Build a prediction model based on the data processed in step S2; S4. Anomaly detection: Explain the abnormal behavior of the system based on the deviation score detection; S5. Health assessment: Make a quantitative description of the health degree of the electronic equipment based on the maximum deviation score in step S4.

2. The anomaly detection method based on a graph deviation network according to claim 1, wherein: The preprocessing method of step S2 is as follows: Feature selection: Select feature data related to the task according to the task requirements; Data alignment: The system monitoring data is located in multiple parsing files. By analyzing the system operation mechanism, align the required data; Data cleaning: Delete duplicate values and process outliers. Processing outliers includes removal, trimming, replacement, induction, and transformation; Fill in the missing values with the mean, median, or the value of the previous moment.

3. The anomaly detection method based on a graph deviation network according to claim 2, characterized in that: The method for building the prediction model in step S3 is as follows: S3.

1. Sensor Embedding: Introduce an embedding vector for each sensor to represent the characteristics of the sensor, where is the dimension of the embedding vector, represents the number of sensors. The embedding vector is initialized with random values and then trained together with the rest of the prediction model; S3.

2. Graph structure learning: Use a directed graph to represent the dependency relationship between sensors. Different nodes in the directed graph represent different sensors, and the edges between nodes represent the dependency relationship between sensors; S3.

3. In order to obtain the sensors that generate abnormal behavior, predict the behavior of the sensors based on the existing data, and then identify the abnormal behavior of the sensors by comparing the deviation degree between the predicted value and the actual observed value.

4. The anomaly detection method based on a graph deviation network according to claim 3, wherein: The specific method of step S3.2 is as follows: To determine whether there is a dependency relationship between the sensors and , first use formula (1) to calculate the similarity between the sensors and : （1） wherein, is the sensor and is the similarity between and respectively represent and modulus; Select the sensor with the greatest similarity. Assume that this sensor will have a significant impact on the sensor as shown in the following formula: （2） Among them, represents the sensor index corresponding to the largest values.

5. The anomaly detection method based on a graph deviation network according to claim 3, characterized in that: The specific method of step S3.3 is as follows: Introduce a graph attention-based feature extractor to fuse the information of nodes with adjacent nodes according to the learned graph structure to obtain the relationship between sensors; sensors The calculation method of the aggregated representation is as follows: (3） Among them, is the aggregated representation of the sensor at moment, is a non-linear activation function, is a trainable parameter matrix, , and are the model inputs. The definition of the model inputs at moment is as follows: （4） wherein, is the size of the sliding window, ; is the attention coefficient, and its calculation method is as follows: （5） （6） （7） Among them, represents a splicing operation, is the learning coefficient vector of the attention mechanism, is a non-linear activation function; After obtaining the aggregated representation of the sensors, the predicted value of the sensor at the moment is calculated using the following formula: （8）； Among them, is the predicted value of the moment sensor data, indicating element-wise multiplication; Finally, use the mean square error as the loss function to train the network, as shown in the following formula: （9）。 6. The anomaly detection method based on a graph deviation network according to claim 1, characterized in that: The specific method of step S4 is as follows: First, calculate the error value between the predicted value and the observed value at a moment , and the formula is as follows: （10）； Secondly, perform robust normalization on the error values of each sensor to prevent the error values generated by any one sensor from having too much influence on other sensors: （11）； Among them, is the normalized outlier, and are the median and the interquartile range respectively; Then, to calculate the overall anomaly at the moment, use the function to aggregate the sensors: （12）； At moment, if is greater than a maximum deviation score , it is marked as an abnormal state.

7. The anomaly detection method based on a graph deviation network according to claim 1, characterized in that: The specific method of step S5 is as follows: Obtain the maximum deviation score After that, describe the health level of the electronic equipment in the form of a percentage. The calculation method is as follows: （13）； Among them, is the health degree.

Images